Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

B-21 · Medium

planarian @ a924e09 · Spec v4.6 · snapshot main · all versions

§12d, as amended on #34, defines network-security units by a classifier: network tools (from their systemd configuration) that the kernel attributes as protecting traffic (netwatch). This PR ships the interim rule only: a unit tagged both Security and External, or the firewall by name. Until the classifier lands, an untagged VPN, WireGuard or tailscaled unit holds nothing when it fails, and vm-netsec’s classifier subtests are expected to fail here

BreaksStatusMitigationCloses in
Correct (§12d not yet met)Closed (lane-nix/network-tool #38, with netwatch #42)The classifier (§12d “Which units”): every network tool, computed from its systemd configuration, carries the OnFailure= hold, and the hold’s condition reads its kernel-attributed footprint; no name list. module-eval asserts each branchA

The guarantees it narrows

None: a process or availability row.