Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

B-22 · Medium

planarian @ a924e09 · Spec v4.6 · snapshot main · all versions

netwatch (#42) does not yet observe every steering kind §12d names. (a) DNS servers on a tool’s interface (set through systemd-resolved over D-Bus, or by writing /etc/resolv.conf) and the system proxy (environment or settings) never pass the netlink probes: ChangeKind::Dns and Proxy are produced only by the gym’s simulator. A tool whose only steering is DNS or the proxy (a DNS-over-VPN client, a DNS leak guard, a Tor or SOCKS front end) reads protecting no, so its failure holds nothing and queries or traffic go out directly: fails open. (b) WireGuard peer endpoints are configured over generic netlink, which netwatch does not parse (genl → nothing), so no footprint has endpoint lines. The tunnel’s interface and routes are seen, so its failure holds (fails closed), but the hold does not pass its peer: it cannot re-handshake, its Readiness probe cannot pass, and the hold lifts only by an administrator’s planarian hold release

BreaksStatusMitigationCloses in
Correct (§12d not yet met: inputs to the hold)Open, temporary, and closes before the Phase A gate (coordinator, Nov 2: Medium on that condition): closed by lane-change-path’s B-22 follow-up PR (after the journal-versions PR and the move-probe PR, coordinator, Nov 3) (resolved and proxy watches; generic-netlink WireGuard endpoints)(a) Declare a DNS- or proxy-only tool’s steering explicitly until then (a manifest holdInterfaces/holdAllow entry, or tag the unit so the hold treats it as protecting); (b) declare each VPN peer in the manifest’s holdAllow, so the hold passes it and repair can succeedA

The guarantees it narrows

None: a process or availability row.