X-13 · Accepted
planarian @ a924e09 · Spec v4.6 · snapshot main · all versions
The network hold (§12d Network security fails closed):
planariadapplies and liftsplanarian-hold@<unit>with noPreparedrecord, no lease and no op tag, mirroring systemd’sOnFailure=; the hold drops connectivity without asking
| Breaks | Status | Mitigation | Closes in |
|---|---|---|---|
| Correct (I15, I21) | Accepted | A failure posture response, the same class as §12d’s other responses, not a transition (coordinator, Nov 2). Safe because applying only ever restricts traffic; lifting follows only a unit observed Running with every Readiness probe passing, or an attested release; both calls are idempotent. Auditable: HoldApplied { unit, by } and HoldLifted { unit, reason } are journaled before each call (hash-chained), and the journal’s holds are the recovery source of truth, reconciled with the host’s after a restart, failing closed. The decision to unblock is never the bypass: planarian hold release is an attested Override on the hold unit through the executor, administrator authority or AskFirst with an Administrator approver. Gym: core tests a_held_unit_crash_holds_restarts_at_once_and_lifts, an_unattributed_stop_is_held_by_the_daemon_and_an_attested_one_is_not, a_failed_repair_keeps_the_hold_and_notifies_across_a_restart, hold_release_needs_an_administrator; VM vm-netsec | A |