# Census overlay rootfs-apps-1-new (rootfs apps Plan 1: carlos ship --rootfs and --check, the console's rootfs ship door, release.ShipSpooled; spec docs/superpowers/specs/2026-10-24-rootfs-apps-design.md §5.1, §5.8), hand-written: the decisions census-propose refuses (AGENTS.md, The census). Loaded from the chain manifest after plans-3b-never-sleep (main's last at the merge of origin/main) and before plan14-root-reads-rootfs-apps-1.tsv, which census-propose wrote for the approvals. Every row carries rev3=census-ruling-rootfs-apps-1 from the start; the census owner rules on #280 (docs/superpowers/notes/census-proposal-rootfs-apps-1.md). # 49 new units, each legacy accepted-legacy at J4, none a box unit. 43 run in the carlos CLI on a person's machine, as the person: 14 in the root package (cli.go shipNoteText, ship_rootfs.go, ship_runtime.go, ship_check.go, ship_check_probe.go; listeningPorts runs as the in-container probe inside the --check container) and 29 in internal/rootfsimage, imported only by those files. 2 are the console's (apiship_rootfs.go: the request body and its own spool). 2 are internal/release's, reached only from ShipSpooled (the console and the CLI's direct mode, each over a file it spooled itself), and 2 more in internal/release are matched on the word Command (release.Process's argv field). What they read: files the person named, scratch the CLI or the console made for itself, the probe cached under the user cache dir, the docker or podman CLI it runs; many read no file at all (a Command field, crypto/rand.Read, an io.Reader's Read, an in-memory tree lookup). Frozen declarations are added, so the seal moves; plans-3b-never-sleep's is checked first. @legacy 4a9dbe55f930719356c73d38a7e92a62d7ff2e1ad88e267565989251d28b1292 cli.go shipNoteText legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), reads the --notes-file the person named (os.ReadFile), moved out of runShip so the rootfs path shares it; decides nothing for root file:ReadFile@223 5ff92a8a2c69c43489ae0bb175b6ed77f591cd149bd726e8b1d9e77ce1279f54 @legacy 099fcb9aceae22e32c976d4c47d3262d2d2a2a42445845d7968f6737615db50a internal/console/apiship_rootfs.go shipBody.Read legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the console (cmd/console serve under console.service, user carlos-console): new (rootfs Plan 1), reads the ship request's HTTP body under the door's byte limit (the reader's Read, not a file); decides nothing for root file:Read@19,file:Read@398 d14b28f4d7d27cef252623996b3f86e3c5d04bae08d4195abeabe341bda41c8d @legacy 634167b960a3365935a447e49323ac0631fcd7a2382ccdf8e926e98526a566d9 internal/console/apiship_rootfs.go spoolRootfsPart legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the console (cmd/console serve under console.service, user carlos-console): new (rootfs Plan 1), creates the upload's spool file (O_EXCL, 0600) in its own private directory under the console's seed scratch, reserved before the body is read and removed on every path; reads the incoming multipart part (the upload's bytes) and writes them to the spool, opened O_WRONLY; decides nothing for root file:OpenFile@114 46acf7814f63300522ec5b21936b02f63e29f1e6d22e8da8c60cb697a6584150 @legacy 3c40d72a06c394dfff8ea2db6b5ef7a48235f29b144f7a771b90d851facb98c3 internal/release/rootfs.go type Process legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the release manifest's process type, compiled into every carlos binary: new (rootfs Plan 1); the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@23 fd439e6bfa93df12a105bccbe41604aae8b6c71248830884685f9fb25dc4cb17 @legacy 0c20259a67f7c49d39171d96a06011770851af460270a30d7fb06ba04f553ed4 internal/release/rootfs.go validateProcess legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the shape rule for a manifest's processes, run at ship (console and CLI) and on decode: new (rootfs Plan 1); the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@242,file:Command@61,file:Command@80 66c6ce57518082f62c7a55895351cfc5ba65781e906074cb094b5f6c82c6d398 @legacy f1662a273a07f1c63ef82adb6ff0a3208b3d29a6b4562fca5a50f4d4226d5395 internal/release/rootfs_ship.go hashSpooledFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the console (cmd/console serve under console.service, user carlos-console) and the carlos CLI on a person's machine, as the person, in direct mode (no box unit): new (rootfs Plan 1), reached only from release.ShipSpooled, opens the image file its caller spooled (the console's upload spool or the CLI's own scratch) to hash and size it once before publication; decides nothing for root file:Open@70 89fd0516bddd454293bb0cb78d06f60d969e2d80f74ed422a3f43bd6fd66bf27 @legacy 94e3922bed4b0df1bde55554c09dc9765ee620e1125721673be25f4018646bd8 internal/release/rootfs_ship.go putImmutableFrom legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the console (cmd/console serve under console.service, user carlos-console) and the carlos CLI on a person's machine, as the person, in direct mode (no box unit): new (rootfs Plan 1), reached only from release.ShipSpooled, opens the same spooled image file to stream it into the release bucket as a create-only put; on a lost race it hashes the existing object, never the box's state; decides nothing for root file:Open@106 a60dc283fe607f89671b55ff706fd3b656b303e356ac0060261c5cdbfd6855c6 @legacy 9173125d07a721094c05ea5eeb9120477ec9f3e123ea2c4dec445877e79ef481 internal/rootfsimage/archive.go OpenArchive legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats and opens the docker save or podman save archive the person named (or the one the CLI exported into its own scratch) and reads its entries in place as sections; nothing is extracted by name; decides nothing for root file:Open@226,file:Stat@73 c19ae55f5619df47cfe2afb53de8e408a173e234b26212c1b0eff3036f1f9397 @legacy e96595389ea9636e30509372d9e34220005df126a618d40569c35b7e7671192d internal/rootfsimage/dir.go readDir legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, walks the directory the person named (EvalSymlinks of that root only, Stat, WalkDir, Readlink of each symlink, never followed); reads names, modes and link targets, the bytes later through Tree.Open; decides nothing for root; final review: refuses when the tree's entry or metadata budget is passed (add's error), the same reads file:EvalSymlinks@123,file:Readlink@1719,file:Stat@193,file:WalkDir@757 d5e66fdefdf4d203ce528ed30772dea6f22e3443c591123aff8a3c0d21622f8e @legacy 4ce9c95915443f2c22c10b77c845a916a8f243ec516701e689a5573022a88cd4 internal/rootfsimage/errors.go CommandError.Error legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the refusal's sentence; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@237 b8d64424f4e118c297fa0982e245c29de171e9aa56287e264bef997f13ad08e4 @legacy 980af1a9be9f489c84b9e5f9a94e36f45498107244ae279179acb33d81e580f1 internal/rootfsimage/errors.go type CommandError legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the refusal's type; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@35 9812608a0a0b885f8fdea0526df6e71896a61a3243be9dd16fac8019f8e6254c @legacy cad0de2fa8dca1e2c35bdf3d04e30027f986f5fffff738454199007fd06bc7fd internal/rootfsimage/flatten.go boundedReader.Read legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads a layer's decompressed stream (from a blob of the person's image) and fails past the image's byte bound; the reader's Read, not a file; decides nothing for root file:Read@160,file:Read@24 7d5b4f8bac0a432cbfe1ece92b971aa8ee915be49d4b21475afb29dc0d023499 @legacy 4adcd87a4cf55bcdb2c7fd8b6fbc1d387a8f1e69c98bfca3dce1063ff0bdd4ae internal/rootfsimage/framework.go FillConsole legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, fills in a known framework's console process from the in-memory tree; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@897 94952824384be27a5a8a6a003f48f0afaabd8a57c5b23900391b7aa6cffc728f @legacy 38687b3a14749ceedc43514d8ba068c240ff5a46f929708434f0890d6729a380 internal/rootfsimage/oci.go OpenLayout legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, opens the OCI layout directory the person named as an os.Root, so no blob or symlink leads out of it; decides nothing for root file:OpenRoot@66 82dd665eb26ac5d8f2c8aef7510b0d80fbc2817d8d63d3c2e3e1e4ee25bfdb35 @legacy 8708098c5a62564e5167d96de9f80738857c2eaf06ec44ce541430e332010ca6 internal/rootfsimage/oci.go layoutStore.has legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats a file of the layout through its os.Root; decides nothing for root file:Stat@57 064049e649e466d9df1e478cd6e55b37f2227522752f864a851e197c2ffde3a5 @legacy 8386a5a0c23c595ce2f016e28ff838f50cba8c3f2e3d1958be614518bff8f720 internal/rootfsimage/oci.go layoutStore.open legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats and opens a regular file of the layout through its os.Root, refusing anything else; decides nothing for root file:Open@345,file:Stat@116,file:Stat@449 6dbd8278e86f1c433285c1c0910bfd11b68f9119ff2e346b3f6e425ba99de7e4 @legacy 927c5246cda1b1e5a8af125c5b8389627d3b3dcd73dd688d0ef46ef26f23d0eb internal/rootfsimage/oci.go ociReader.readBlob legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads one blob of the person's image (an index, manifest or config, at most a fixed size), verified against its digest; decides nothing for root file:ReadAll@161 6f20a40de98390d87a7042061ddc00e54779b7044684d3a3b375e8b7b8a202c1 @legacy 2ea8112ef0b8065b221e0c545e81656b06ab84f36da85f48ca67e077ce9e0c87 internal/rootfsimage/oci.go readFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads index.json or manifest.json of the person's layout or archive, at most maxJSONBytes; decides nothing for root file:ReadAll@242 e31050069c07a50df4faf17e527d390a44b57451b3e0ef8a8bd88489daab80b2 @legacy c187fa6fa0464d0739b063159cfdbde65172dc4a859421257d915354d705c0e7 internal/rootfsimage/oci.go verifier.Read legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads a blob stream of the person's image and checks its sha256 digest at the end; the reader's Read, not a file; decides nothing for root file:Read@102,file:Read@19 3155388f7ec924e45ef345aaae668c1d4340648c673f1e4c4534597085778103 @legacy 74c7b1cffea253f291e3294345f74211c0cbd5675924d397863c19eab9d7c17c internal/rootfsimage/processes.go ApplyImageConfig legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, merges the image config's env and working dir into the processes; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root; final review: keeps a ".." in the config's working dir for the resolver, the same Command fields file:Command@547,file:Command@572 c40aeac492cb68c58d8b5c9ab199680fb4a63c2cce30d76286d651a7df84c70a @legacy eb0946e4251047589ff151c848bd2d6d1fab3bf651436a02cd6fed94941b7723 internal/rootfsimage/processes.go ResolveCommands legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, looks each process's command up in the in-memory tree; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@171,file:Command@230,file:Command@239 eb4611c838927abcee9390eb2088065490ff44a46bbd421ce071b9630f09a8d9 @legacy 645a8572481d74bb18b892b0c972ec76d6bb7a580905ab993fc9a662a719828d internal/rootfsimage/processes.go jitOf legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, names the program a process runs, from the in-memory tree; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@56 af5faa5d1eb5e07e2f330dbdf08efbe89d7a4af73ac10c667029fbb2f751a60a @legacy 2016b0945e612ce342558483f00f11b96022320877472c5b473baf5e79cf9047 internal/rootfsimage/processes.go shebangRuntime legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads at most the first shebangBytes of one script of the person's image through Tree.Open, for the JIT warning; decides nothing for root file:Open@60 46fd0d8c36717f12e1da2bc1bcdd4452b03077c5217cdb777181e618e69a9667 @legacy 78f7744b11bdb013bf6ef3a05876746f33edd1db49351db7e4be67a2bcdefb17 internal/rootfsimage/progarch.go Tree.head legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads at most 20 bytes of a regular file of the person's directory source through Tree.Open, to name a program not built for linux/arm64; decides nothing for root file:Open@60 e7aa22afec3b4581c58c14ef25b1dff69ec7ce89ee10d7a62a18408c61d82792 @legacy 4f2b03b8cb11cf9b0509ff577ecbfcbfdcf38cde637e24f04847ddc7e4223408 internal/rootfsimage/squashfs.go treeFS.Lstat legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the squashfs writer's view of the in-memory tree; a lookup, reads no file; decides nothing for root file:Lstat@16,file:Stat@65 f3ba827c853bcf504c2931d880147b32c3c1fa328e453e36a3ad7258a81768ab @legacy 21a567de8b1e8bce9f452ad04a1d65c3d7fe8adb66de4ec60c8ed17594e4c631 internal/rootfsimage/squashfs.go treeFS.Open legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the squashfs writer's view of the tree; a regular file's bytes come through treeFS.ReadFile; decides nothing for root file:Open@16,file:ReadFile@204 51d5cb9d3a1655644a3f9d718fb14853964ab64c546cba1efe1ca9c287cf90f6 @legacy 1da905f3bfdc194c42bad6fe5cfef528830e4bb1e4d8babe9ff77f5223c18614 internal/rootfsimage/squashfs.go treeFS.ReadDir legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the squashfs writer's view of the in-memory tree; a listing, reads no file; decides nothing for root file:ReadDir@16 06438d0c8d4806ae807aefe04fe2ca0882ed805b5df19cc4947d7be321d046ef @legacy 6d2b7723ec229d29e753abab980830ac25f5e0e16d411c7400b222f621e82106 internal/rootfsimage/squashfs.go treeFS.ReadFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads exactly the size the tree recorded of a regular file through Tree.Open (the spool under the CLI's own scratch, or the person's directory source in place), refusing a file that changed size; decides nothing for root file:Open@139,file:Read@461,file:ReadFile@16 4d4f4214cd70d7f95e018c2284a6091490f67e0438461ae6d84f1e09268e6178 @legacy dc4cb84cc9c7e128bb27901fbb2d6736d4b9c1cb8af56fcdf106e49f6aaf4a16 internal/rootfsimage/squashfs.go treeFS.Stat legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the squashfs writer's view of the in-memory tree; a lookup, reads no file; decides nothing for root file:Stat@16 426d5d99a9b28a6c7e1b1650f60ee32dcb6df54a66715441c1f814f441e1c594 @legacy 5bb2d77ffdfaa3abd24b2c7dba8bbfb4ebc9830763fd3b1b264fd9361b51f387 internal/rootfsimage/squashfs.go treeFile.Read legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads bytes already in memory (from treeFS.ReadFile); reads no file; decides nothing for root file:Read@19 226e1cf7c0fb761b2d929a70f0ac48662678f0a6107b255192e881086ab438b8 @legacy 26b8c71698044b42089fcba6558309a166015bb0e45125b1b7b33c0ac9754809 internal/rootfsimage/squashfs.go treeFile.Stat legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, an in-memory entry's info; reads no file; decides nothing for root file:Stat@19 df4b21a4f97b380a56870d7b4d984dd5e46f31e1f407daa8426bb3c88ba6f082 @legacy 4b77e79861d5320fd1ddc23cd27d94a5eb574b003e88e2053649230a7f7ec5ab internal/rootfsimage/squashfs.go writeSquashfs legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats the image file its caller created in its own scratch, for its size after writing; decides nothing for root file:Stat@1987 273105c82eedfdad9598f62da631268d6658abf2530a736f9e65cdd9e5b649aa @legacy 874192cedc6e364d72be6d4b3a49c8c849eb1dde8ae37b49aa5e8ccd941de27d internal/rootfsimage/tar.go Tree.copyFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads a regular file of the tree through Tree.Open (the spool under the CLI's own scratch, or the person's directory source) into the tar stream the --check import reads; decides nothing for root file:Open@67 d5284439478bde0664831320693f1cd3f9aa7a97890c32508c9b62f49d0cb531 @legacy 3abc9f24b1bc610c76561df20f9734c826324ca51453552f5e4f1752985ae328 internal/rootfsimage/tree.go Open legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats the source the person named (and its oci-layout file) to choose a layout, an archive or a directory; decides nothing for root file:Open@5,file:Stat@154,file:Stat@58 ca04f5016aa1e1c185940c7992b1a39cc167bfdae2e89287be87e9c353aa927d @legacy 349b05675adef44a1a3331d79989fcef013cdf27b25dc3a0c0ac006dc8617599 internal/rootfsimage/tree.go Tree.Open legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, opens a regular file of the tree: a spool file it wrote under the CLI's own scratch, or a file of the person's directory source; decides nothing for root file:Open@15,file:Open@165 c7d8f05180d3aa358720be290041d77f08bc631dddc46cb3631a437ec86c0e05 @legacy 83559b0e34e8fb350aa97fb7bb77674b587eb72a29187b7673d310b2e72412b7 internal/rootfsimage/tree.go Tree.writeBlob legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, creates a spool file (O_EXCL, 0600, named by a counter, never by the image) under the tree's spool in the CLI's own scratch (writes, does not read); decides nothing for root file:OpenFile@249 5ae91de79c050ab1be920de4e1cae3487f3bd933f61bee9841bc280b3762fdb6 @legacy 1b8938c8d50e48ad187a7acde871b20cfda3b9af9dd3cec276dc5b76a51b679c ship_check.go const#2 legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), the paths a box gives an instance (/data/instances/check, /run/carlos/instances/check, the socket and the db) as they appear inside the --check container, on volumes the check made; the host's /data is never named or read; decides nothing for root data-literal@24 74baca97cbc13497d790d98c2ed43ce2123c27ccd9c40d6fc98b857d155aceb8 @legacy 3a80febe2bc13dceef326bb1f3a71e91a738b8903fa172ac98dcb85302552631 ship_check.go rootfsCheck.runArgs legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), builds the docker or podman run argv for one check container; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@770,file:Command@854 b21dca7ccd34f38f969f891ea6615f1f4c0057b342ecb44b2a2b2214cb9f46e4 @legacy 355e3ead803016c7080595fccdeee34cc16e4764f1a3e8737d66a27e4b452337 ship_check.go runRootfsCheck legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), the scanner matches crypto/rand.Read (four random bytes naming the check's containers and volumes); reads no file; decides nothing for root file:Read@143 e3b27e7e63eb6c6ccb38515261589a5f4dcb2f9cae2290db018d9b3bc66268b1 @legacy 226180b993303675c54cc8da32c3c0de4642d484bdf14872e845eee6475911e3 ship_check_probe.go cachedCheckProbe legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), reads the sha256 it recorded beside the probe binary it cached under the user cache dir (/carlos/check-probe//), to check the copy before mounting it, and fetches a signed, checksummed release asset when it is absent or damaged; decides nothing for root; final review: its atomic writes take the context, the same read file:ReadFile@289 0475c3c6803343f34acfb869441b51b06cef0d41bd0f85eb96f9b89700959520 @legacy 6f2a41a1ba94310a52f7995beff204fc3523a34a526f9f1d757a2730a0d1b0b0 ship_check_probe.go checkProbeBinary legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), resolves the running carlos executable's own path (filepath.EvalSymlinks) to mount it as the in-container probe, or CARLOS_CHECK_PROBE when the person set it; decides nothing for root file:EvalSymlinks@271 6da69f2d06b63a702dc178d091c053d9c63e95aa851e17e64cd7381c5b4e29f0 @legacy 7180f2f5a41ec9d0267aaab27b52927dadc64cd35e05c8c87f78a8e5dd6b7cdc ship_check_probe.go fileSHA256 legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), opens the probe binary it cached under the user cache dir to hash it against its recorded sha256; decides nothing for root file:Open@58 4e45c59d7c9465d8033f993de91fa17e8d81e1e3e3dd9c959fb3aa0e1b743cda @legacy fd8281363fa24883d43579d4d0189265631045ca68bcaa185c3910387482774f ship_check_probe.go listeningPorts legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), run as the in-container probe (carlos __rootfs-check-probe, uid 65534 inside the --check container, the carlos binary mounted read-only): opens /proc/net/tcp and /proc/net/tcp6 inside that container to name the ports web listens on when it misses the socket; never on a box; decides nothing for root file:Open@107 4b48f8b7a6b82fdb794d61f1451ba94a34ebd73abda84b2dac398e4822631e9a @legacy 403933a3d332f17b70ce2f1e9b99ccf073e9063aaa65316ac68b92a558de9d09 ship_check_probe.go staticELF legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), opens the running carlos executable (debug/elf.Open) to see that it has no program interpreter before mounting it in the image; decides nothing for root file:Open@46 d1d0ff59e269d7f189d49ef2993e33c2a571cb118622c0cfcdb24ca479d87799 @legacy a4f997e86200f5661fc320c0fa53678c7e941ceeddecfafa40b555691344b77d ship_check_probe.go writeFileAtomic legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), creates a temp file beside the probe it caches under the user cache dir and renames it into place (writes, does not read); decides nothing for root; final review: holds the ship's stop lifecycle while it writes, so a stop waits for the rename or the temp file's removal, the same CreateTemp file:CreateTemp@192 652b1687f40342d61f3e5c4f690eb6d83637b12c0456191073c3c3a6196115ab @legacy 3a3fdc18e773848d3d2cead508bbd04ad05b789781aa7d7bdc2afcae187b864f ship_rootfs.go buildRootfs legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), creates /rootfs.squashfs (O_EXCL, 0600) in its own private scratch under the system temp dir, which runShip removes on every path and on a stop signal; Command is release.Process's argv field, not os/exec; the source is read through rootfsimage; decides nothing for root file:Command@1016,file:OpenFile@1379 410bdfc067caf4a02b84e6388302f4dcac16e1b913ae58a2af58cd0376f1b7bf @legacy 213612395cfa923e8e5f395691fc2f28b167860fe81bd1b562535095771c23ad ship_rootfs.go readProcessesFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), reads the --processes file the person named (os.ReadFile) and decodes it with release.DecodeProcesses; decides nothing for root file:ReadFile@87 88e5324d435c9aa9d027155e6b60afa2fbea74b65066f9db25704f3dda3320fa @legacy 9d9018d9aefd19c57abd5d7f8ce5dbde717993d30235913f7566f55618d93edb ship_runtime.go execRunner legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), runs the docker or podman CLI (exec.CommandContext) found on PATH or named by CARLOS_CONTAINER_RUNTIME, as the person, for docker save of a local image name, the --check import, run, inspect, logs and removal; decides nothing for root; final review: holds the ship's stop lifecycle while the child runs, so a stop waits for it to be killed and reaped, the same CommandContext file:CommandContext@230 0b541b4e179d17512a72601d635bea1bc6eb7198cdf60e7b90a2aa52b46befc0 @legacy 610f1e4501e73a6fb1fac81013e77c464c7695e2c37e3999302a96ad969944ce ship_runtime.go openRootfsSource legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), stats the source the person named; an existing path goes to rootfsimage.Open, a local image name is exported with the runtime to /image.tar in its own scratch and opened there; Open is rootfsimage.Open; decides nothing for root file:Open@268,file:Stat@146 5d90d22dd97cb5cc12a1c4d58cebe365e592be325141c545d1bf42a7e98ec58d cli.go shipNoteText legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), reads the --notes-file the person named (os.ReadFile), moved out of runShip so the rootfs path shares it; decides nothing for root file:ReadFile@223 5ff92a8a2c69c43489ae0bb175b6ed77f591cd149bd726e8b1d9e77ce1279f54 internal/console/apiship_rootfs.go shipBody.Read legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the console (cmd/console serve under console.service, user carlos-console): new (rootfs Plan 1), reads the ship request's HTTP body under the door's byte limit (the reader's Read, not a file); decides nothing for root file:Read@19,file:Read@398 d14b28f4d7d27cef252623996b3f86e3c5d04bae08d4195abeabe341bda41c8d internal/console/apiship_rootfs.go spoolRootfsPart legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the console (cmd/console serve under console.service, user carlos-console): new (rootfs Plan 1), creates the upload's spool file (O_EXCL, 0600) in its own private directory under the console's seed scratch, reserved before the body is read and removed on every path; reads the incoming multipart part (the upload's bytes) and writes them to the spool, opened O_WRONLY; decides nothing for root file:OpenFile@114 46acf7814f63300522ec5b21936b02f63e29f1e6d22e8da8c60cb697a6584150 internal/release/rootfs.go type Process legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the release manifest's process type, compiled into every carlos binary: new (rootfs Plan 1); the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@23 fd439e6bfa93df12a105bccbe41604aae8b6c71248830884685f9fb25dc4cb17 internal/release/rootfs.go validateProcess legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the shape rule for a manifest's processes, run at ship (console and CLI) and on decode: new (rootfs Plan 1); the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@242,file:Command@61,file:Command@80 66c6ce57518082f62c7a55895351cfc5ba65781e906074cb094b5f6c82c6d398 internal/release/rootfs_ship.go hashSpooledFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the console (cmd/console serve under console.service, user carlos-console) and the carlos CLI on a person's machine, as the person, in direct mode (no box unit): new (rootfs Plan 1), reached only from release.ShipSpooled, opens the image file its caller spooled (the console's upload spool or the CLI's own scratch) to hash and size it once before publication; decides nothing for root file:Open@70 89fd0516bddd454293bb0cb78d06f60d969e2d80f74ed422a3f43bd6fd66bf27 internal/release/rootfs_ship.go putImmutableFrom legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the console (cmd/console serve under console.service, user carlos-console) and the carlos CLI on a person's machine, as the person, in direct mode (no box unit): new (rootfs Plan 1), reached only from release.ShipSpooled, opens the same spooled image file to stream it into the release bucket as a create-only put; on a lost race it hashes the existing object, never the box's state; decides nothing for root file:Open@106 a60dc283fe607f89671b55ff706fd3b656b303e356ac0060261c5cdbfd6855c6 internal/rootfsimage/archive.go OpenArchive legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats and opens the docker save or podman save archive the person named (or the one the CLI exported into its own scratch) and reads its entries in place as sections; nothing is extracted by name; decides nothing for root file:Open@226,file:Stat@73 c19ae55f5619df47cfe2afb53de8e408a173e234b26212c1b0eff3036f1f9397 internal/rootfsimage/dir.go readDir legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, walks the directory the person named (EvalSymlinks of that root only, Stat, WalkDir, Readlink of each symlink, never followed); reads names, modes and link targets, the bytes later through Tree.Open; decides nothing for root; final review: refuses when the tree's entry or metadata budget is passed (add's error), the same reads file:EvalSymlinks@123,file:Readlink@1719,file:Stat@193,file:WalkDir@757 d5e66fdefdf4d203ce528ed30772dea6f22e3443c591123aff8a3c0d21622f8e internal/rootfsimage/errors.go CommandError.Error legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the refusal's sentence; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@237 b8d64424f4e118c297fa0982e245c29de171e9aa56287e264bef997f13ad08e4 internal/rootfsimage/errors.go type CommandError legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the refusal's type; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@35 9812608a0a0b885f8fdea0526df6e71896a61a3243be9dd16fac8019f8e6254c internal/rootfsimage/flatten.go boundedReader.Read legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads a layer's decompressed stream (from a blob of the person's image) and fails past the image's byte bound; the reader's Read, not a file; decides nothing for root file:Read@160,file:Read@24 7d5b4f8bac0a432cbfe1ece92b971aa8ee915be49d4b21475afb29dc0d023499 internal/rootfsimage/framework.go FillConsole legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, fills in a known framework's console process from the in-memory tree; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@897 94952824384be27a5a8a6a003f48f0afaabd8a57c5b23900391b7aa6cffc728f internal/rootfsimage/oci.go OpenLayout legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, opens the OCI layout directory the person named as an os.Root, so no blob or symlink leads out of it; decides nothing for root file:OpenRoot@66 82dd665eb26ac5d8f2c8aef7510b0d80fbc2817d8d63d3c2e3e1e4ee25bfdb35 internal/rootfsimage/oci.go layoutStore.has legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats a file of the layout through its os.Root; decides nothing for root file:Stat@57 064049e649e466d9df1e478cd6e55b37f2227522752f864a851e197c2ffde3a5 internal/rootfsimage/oci.go layoutStore.open legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats and opens a regular file of the layout through its os.Root, refusing anything else; decides nothing for root file:Open@345,file:Stat@116,file:Stat@449 6dbd8278e86f1c433285c1c0910bfd11b68f9119ff2e346b3f6e425ba99de7e4 internal/rootfsimage/oci.go ociReader.readBlob legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads one blob of the person's image (an index, manifest or config, at most a fixed size), verified against its digest; decides nothing for root file:ReadAll@161 6f20a40de98390d87a7042061ddc00e54779b7044684d3a3b375e8b7b8a202c1 internal/rootfsimage/oci.go readFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads index.json or manifest.json of the person's layout or archive, at most maxJSONBytes; decides nothing for root file:ReadAll@242 e31050069c07a50df4faf17e527d390a44b57451b3e0ef8a8bd88489daab80b2 internal/rootfsimage/oci.go verifier.Read legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads a blob stream of the person's image and checks its sha256 digest at the end; the reader's Read, not a file; decides nothing for root file:Read@102,file:Read@19 3155388f7ec924e45ef345aaae668c1d4340648c673f1e4c4534597085778103 internal/rootfsimage/processes.go ApplyImageConfig legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, merges the image config's env and working dir into the processes; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root; final review: keeps a ".." in the config's working dir for the resolver, the same Command fields file:Command@547,file:Command@572 c40aeac492cb68c58d8b5c9ab199680fb4a63c2cce30d76286d651a7df84c70a internal/rootfsimage/processes.go ResolveCommands legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, looks each process's command up in the in-memory tree; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@171,file:Command@230,file:Command@239 eb4611c838927abcee9390eb2088065490ff44a46bbd421ce071b9630f09a8d9 internal/rootfsimage/processes.go jitOf legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, names the program a process runs, from the in-memory tree; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@56 af5faa5d1eb5e07e2f330dbdf08efbe89d7a4af73ac10c667029fbb2f751a60a internal/rootfsimage/processes.go shebangRuntime legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads at most the first shebangBytes of one script of the person's image through Tree.Open, for the JIT warning; decides nothing for root file:Open@60 46fd0d8c36717f12e1da2bc1bcdd4452b03077c5217cdb777181e618e69a9667 internal/rootfsimage/progarch.go Tree.head legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads at most 20 bytes of a regular file of the person's directory source through Tree.Open, to name a program not built for linux/arm64; decides nothing for root file:Open@60 e7aa22afec3b4581c58c14ef25b1dff69ec7ce89ee10d7a62a18408c61d82792 internal/rootfsimage/squashfs.go treeFS.Lstat legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the squashfs writer's view of the in-memory tree; a lookup, reads no file; decides nothing for root file:Lstat@16,file:Stat@65 f3ba827c853bcf504c2931d880147b32c3c1fa328e453e36a3ad7258a81768ab internal/rootfsimage/squashfs.go treeFS.Open legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the squashfs writer's view of the tree; a regular file's bytes come through treeFS.ReadFile; decides nothing for root file:Open@16,file:ReadFile@204 51d5cb9d3a1655644a3f9d718fb14853964ab64c546cba1efe1ca9c287cf90f6 internal/rootfsimage/squashfs.go treeFS.ReadDir legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the squashfs writer's view of the in-memory tree; a listing, reads no file; decides nothing for root file:ReadDir@16 06438d0c8d4806ae807aefe04fe2ca0882ed805b5df19cc4947d7be321d046ef internal/rootfsimage/squashfs.go treeFS.ReadFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads exactly the size the tree recorded of a regular file through Tree.Open (the spool under the CLI's own scratch, or the person's directory source in place), refusing a file that changed size; decides nothing for root file:Open@139,file:Read@461,file:ReadFile@16 4d4f4214cd70d7f95e018c2284a6091490f67e0438461ae6d84f1e09268e6178 internal/rootfsimage/squashfs.go treeFS.Stat legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the squashfs writer's view of the in-memory tree; a lookup, reads no file; decides nothing for root file:Stat@16 426d5d99a9b28a6c7e1b1650f60ee32dcb6df54a66715441c1f814f441e1c594 internal/rootfsimage/squashfs.go treeFile.Read legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads bytes already in memory (from treeFS.ReadFile); reads no file; decides nothing for root file:Read@19 226e1cf7c0fb761b2d929a70f0ac48662678f0a6107b255192e881086ab438b8 internal/rootfsimage/squashfs.go treeFile.Stat legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, an in-memory entry's info; reads no file; decides nothing for root file:Stat@19 df4b21a4f97b380a56870d7b4d984dd5e46f31e1f407daa8426bb3c88ba6f082 internal/rootfsimage/squashfs.go writeSquashfs legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats the image file its caller created in its own scratch, for its size after writing; decides nothing for root file:Stat@1987 273105c82eedfdad9598f62da631268d6658abf2530a736f9e65cdd9e5b649aa internal/rootfsimage/tar.go Tree.copyFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads a regular file of the tree through Tree.Open (the spool under the CLI's own scratch, or the person's directory source) into the tar stream the --check import reads; decides nothing for root file:Open@67 d5284439478bde0664831320693f1cd3f9aa7a97890c32508c9b62f49d0cb531 internal/rootfsimage/tree.go Open legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats the source the person named (and its oci-layout file) to choose a layout, an archive or a directory; decides nothing for root file:Open@5,file:Stat@154,file:Stat@58 ca04f5016aa1e1c185940c7992b1a39cc167bfdae2e89287be87e9c353aa927d internal/rootfsimage/tree.go Tree.Open legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, opens a regular file of the tree: a spool file it wrote under the CLI's own scratch, or a file of the person's directory source; decides nothing for root file:Open@15,file:Open@165 c7d8f05180d3aa358720be290041d77f08bc631dddc46cb3631a437ec86c0e05 internal/rootfsimage/tree.go Tree.writeBlob legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, creates a spool file (O_EXCL, 0600, named by a counter, never by the image) under the tree's spool in the CLI's own scratch (writes, does not read); decides nothing for root file:OpenFile@249 5ae91de79c050ab1be920de4e1cae3487f3bd933f61bee9841bc280b3762fdb6 ship_check.go const#2 legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), the paths a box gives an instance (/data/instances/check, /run/carlos/instances/check, the socket and the db) as they appear inside the --check container, on volumes the check made; the host's /data is never named or read; decides nothing for root data-literal@24 74baca97cbc13497d790d98c2ed43ce2123c27ccd9c40d6fc98b857d155aceb8 ship_check.go rootfsCheck.runArgs legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), builds the docker or podman run argv for one check container; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@770,file:Command@854 b21dca7ccd34f38f969f891ea6615f1f4c0057b342ecb44b2a2b2214cb9f46e4 ship_check.go runRootfsCheck legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), the scanner matches crypto/rand.Read (four random bytes naming the check's containers and volumes); reads no file; decides nothing for root file:Read@143 e3b27e7e63eb6c6ccb38515261589a5f4dcb2f9cae2290db018d9b3bc66268b1 ship_check_probe.go cachedCheckProbe legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), reads the sha256 it recorded beside the probe binary it cached under the user cache dir (/carlos/check-probe//), to check the copy before mounting it, and fetches a signed, checksummed release asset when it is absent or damaged; decides nothing for root; final review: its atomic writes take the context, the same read file:ReadFile@289 0475c3c6803343f34acfb869441b51b06cef0d41bd0f85eb96f9b89700959520 ship_check_probe.go checkProbeBinary legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), resolves the running carlos executable's own path (filepath.EvalSymlinks) to mount it as the in-container probe, or CARLOS_CHECK_PROBE when the person set it; decides nothing for root file:EvalSymlinks@271 6da69f2d06b63a702dc178d091c053d9c63e95aa851e17e64cd7381c5b4e29f0 ship_check_probe.go fileSHA256 legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), opens the probe binary it cached under the user cache dir to hash it against its recorded sha256; decides nothing for root file:Open@58 4e45c59d7c9465d8033f993de91fa17e8d81e1e3e3dd9c959fb3aa0e1b743cda ship_check_probe.go listeningPorts legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), run as the in-container probe (carlos __rootfs-check-probe, uid 65534 inside the --check container, the carlos binary mounted read-only): opens /proc/net/tcp and /proc/net/tcp6 inside that container to name the ports web listens on when it misses the socket; never on a box; decides nothing for root file:Open@107 4b48f8b7a6b82fdb794d61f1451ba94a34ebd73abda84b2dac398e4822631e9a ship_check_probe.go staticELF legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), opens the running carlos executable (debug/elf.Open) to see that it has no program interpreter before mounting it in the image; decides nothing for root file:Open@46 d1d0ff59e269d7f189d49ef2993e33c2a571cb118622c0cfcdb24ca479d87799 ship_check_probe.go writeFileAtomic legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), creates a temp file beside the probe it caches under the user cache dir and renames it into place (writes, does not read); decides nothing for root; final review: holds the ship's stop lifecycle while it writes, so a stop waits for the rename or the temp file's removal, the same CreateTemp file:CreateTemp@192 652b1687f40342d61f3e5c4f690eb6d83637b12c0456191073c3c3a6196115ab ship_rootfs.go buildRootfs legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), creates /rootfs.squashfs (O_EXCL, 0600) in its own private scratch under the system temp dir, which runShip removes on every path and on a stop signal; Command is release.Process's argv field, not os/exec; the source is read through rootfsimage; decides nothing for root file:Command@1016,file:OpenFile@1379 410bdfc067caf4a02b84e6388302f4dcac16e1b913ae58a2af58cd0376f1b7bf ship_rootfs.go readProcessesFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), reads the --processes file the person named (os.ReadFile) and decodes it with release.DecodeProcesses; decides nothing for root file:ReadFile@87 88e5324d435c9aa9d027155e6b60afa2fbea74b65066f9db25704f3dda3320fa ship_runtime.go execRunner legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), runs the docker or podman CLI (exec.CommandContext) found on PATH or named by CARLOS_CONTAINER_RUNTIME, as the person, for docker save of a local image name, the --check import, run, inspect, logs and removal; decides nothing for root; final review: holds the ship's stop lifecycle while the child runs, so a stop waits for it to be killed and reaped, the same CommandContext file:CommandContext@230 0b541b4e179d17512a72601d635bea1bc6eb7198cdf60e7b90a2aa52b46befc0 ship_runtime.go openRootfsSource legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), stats the source the person named; an existing path goes to rootfsimage.Open, a local image name is exported with the runtime to /image.tar in its own scratch and opened there; Open is rootfsimage.Open; decides nothing for root file:Open@268,file:Stat@146 5d90d22dd97cb5cc12a1c4d58cebe365e592be325141c545d1bf42a7e98ec58d