§12e. Security floor

planarian @ a924e09 · Spec v4.6 · snapshot main · all versions

The security floor is the newest committed generation whose closure contains a security fix absent from every earlier generation (in A: absent from the current floor generation and from every generation between it and the candidate; a Revert to an older generation that merely lacks a newer package is therefore never a fix). It is a derived fact, computed as part of every generation commit on every commit path (I25) and journaled before Committed; a commit whose floor record cannot be written does not commit. It is never set by a proposal. The inspected set is the whole system closure: every package reachable from the generation’s toplevel, including service packages, the kernel, and firmware, not only environment.systemPackages. In A the sources are nixpkgs vulnerability metadata, evaluated for every package in the closure (a package whose previous version carried knownVulnerabilities that the new one lacks), and an administrator mark (planarian mark-security-floor); from B, a CVE feed matched against the closure (e.g. vulnix) is added. A fix the inspected set does not show does not move the floor; the administrator mark is the remedy. Generations below the floor are not eligible as automatic revert targets, as automatic boot fallbacks, or as Rollback targets; going below the floor is AskFirst with ApproverClass::Administrator (I16). Until the floor generation is boot-confirmed, known_good may be below the floor: it stays bootable and in the menu (I1) as a manual, administrator-confirmed fallback, while the floor generation is the boot default. The floor never advances to a generation that has not at least committed live. If no eligible known-good generation exists above the floor when a revert or rollback is needed, the daemon escalates the incident with EscalationReason::RevertBlockedByFloor instead of reverting. Gym cases: a security update is applied; a probe failure is induced afterward; the revert does not cross the floor and the incident escalates. The same, with the fix in a service package (openssh) that is not in environment.systemPackages. The fixing generation commits via the daemon, via the watchdog after a crash at Committed-minus-one, and via the boot-only path; all three move the floor, and a Rollback to the vulnerable generation then asks. A Revert to an older generation sets no floor.