qbit-scripting/worker/QUALIFICATION.md

Runtime qualification status

Status: not qualified for untrusted production workloads. There is no production-approved image digest, runsc attestation, deployment evidence ID, or hostile containment test result from this session. Docker Desktop Linux availability is insufficient. The launcher has no process/runc fallback and refuses an unconfigured production invocation.

Implementation verification on 2026-10-30 uses pinned Node 24.22.0, TypeScript 6.0.3, strict compiler checks, and ESLint. Tests exercise deterministic compilation, type errors, import policy, manifest hashes, path bounds, byte framing, configuration refusal, broker round trips, context results, and host transport timeout/output/cancellation/token checks. Synthetic host processes run only fixed repository-owned harmless fixtures. They do not test container escape resistance, and no adversarial user code was executed on the host. Exact latest test counts belong in the implementation report.

Verification update 2026-11-02: the worker enforces Node 24.22.2 exactly (an older note above says 24.22.0). Current source passes npm test (18/18) and npm run lint (0 warnings) under the pinned Node 24.22.2 binary (sha256 1C331340FA6CAC5E4294725959070A143FA0507195A78AD77EED7943F719AAC9); under any other Node the strict pin refuses, which is intended. See ../deploy/BUILD-CLOSURE.md. This does not change the not-qualified status below.

Before a deployment may assign an accepted qualification identifier:

1. Pin and review the Node base and final image digests, dependency lock, SBOM, licensing, and current vulnerability findings. Build reproducibly and retain image provenance. The Dockerfile comment alone does not enforce an immutable base argument.
2. Attest the actual Linux host, gVisor binary/version/configuration, Docker runtime mapping, default seccomp policy, cgroup support, and isolation configuration. A runtime merely named runsc is insufficient.
3. Deploy and qualify the implemented independent reaper-cli.js and durable attempt journal for abandoned containers. Service/timer examples are supplied. Synthetic tests verify exact immutable ID removal, ownership mismatch refusal, lease expiry, create-response loss, retry after removal failure, and fail-closed durability errors. Test real coordinator SIGKILL, host restart, Docker disconnect, stuck removal, and ambiguous create timeouts. Alert on cleanup failures and prevent accumulated or orphaned workers.
4. Verify wall time, total CPU accounting across child processes, RSS/memory/OOM, tmpfs, PID/file descriptor, output, source and diagnostic bounds. Compilation is hostile work too. The current CPU policy combines cgroup throttling with per-process RLIMIT_CPU; it does not prove an exact invocation-wide CPU budget.
5. In a disposable qualified test environment, exercise filesystem, network, syscall, process creation, device, environment/secret, and cross-invocation isolation boundaries. No host application data, sockets, secrets, or filesystem mounts may be supplied to a worker. Native Node access inside its own container is expected, so tests must target the real OS boundary.
6. Verify the concrete Java WorkerProvider adapter, cancellation through container removal, caller-thread broker callbacks, source/artifact signatures, current caller/tenant authorization, bounded query returns, published context output checks, audited failures, and output acceptance only after host cleanup.
7. Load test compile and execution under the proposed deployment's concurrency limits. Account for Docker setup/cleanup latency and TypeScript baseline memory. Demonstrate recovery under capacity exhaustion and establish service limits from measurements.

Qualification evidence must be versioned against the image, runtime, host policy, Java adapter, and protocol. Changing them requires review. This file records missing evidence, not an approval or a claim of complete security.

An operator-only harness is implemented: node dist/qualification-cli.js --run-qualified-fixtures /absolute/new-evidence.jsonl. It is never invoked by build/test. Run it only in an explicitly authorized disposable Linux/runsc laboratory with all server-owned environment settings present. It compiles a fixed fixture inside the sandbox, verifies a broker/context round trip, checks termination of a fixed endless-loop fixture, and records fsynced evidence. The loop is never executed on the host. The harness deliberately records completeQualification: false; these checks do not replace the remaining host-failure, resource, and escape-boundary assessment.

Primary documentation consulted

• TypeScript noEmitOnError and compiler options: strict checking and emit behavior are compiler settings, not an execution sandbox.
• Node child_process: separate processes, bounded buffers/timeouts, and argument arrays without a shell.
• Node TypeScript support: native type stripping does not replace TypeScript type checking and does not use tsconfig as this compiler does.
• gVisor Docker quick start and production guidance: configuring runsc and qualifying a deployment is separate from building a container image.
• Docker container run reference: runtime, namespaces, read-only filesystem, capabilities, memory/CPU/PID controls, and security options. Actual support must be verified on the deployment host.

Security baseline correction (2026-10-31)

The historical24.22.0 verification above does not qualify the corrected source. Current source requires Node24.22.1 after the official October21 security release. The original image and scan reports remain immutable; a new candidate, trusted regression run and complete scan must establish the updated evidence. Removing unused package managers is separate image minimization and cannot substitute for patching Node's embedded dependencies. Hostile-runtime isolation qualification remains outstanding.

Corrected implementation evidence (2026-10-31)

Node24.22.1 compile/lint/17 trusted tests and new OCI build passed. Candidate qbit-documents/artifacts/worker-image-20261031-0059 records exact identities and new231-occurrence OS scan, with0 Node-package findings. Package-manager pruning removes npm/Yarn; Corepack remains inventoried. Runtime/escape qualification remains outstanding; no hostile work or launcher fallback occurred. Original0020 evidence is unchanged.

2026-10-31 Node24.22.2 Distroless candidate

All exact worker guards now require24.22.2. Compile/lint and17 trusted tests pass. Separate immutable Trixie builder and Distroless runtime produce candidate worker-image-20261031-0240; final-image trusted compilation and fixed nonroot/runtime/library/license checks pass. Independent local scan reports32 OS occurrences (23medium,8low,1unknown),0high/critical and0 Node-package findings. Base index signature verifies; upstream SPDX predicate verification remains unresolved and is not called verified. No hostile code ran, no global runtime changed, and no runsc/deployment qualification is inferred. Historical evidence remains unchanged.

02:56 SPDX verification follow-up

The exact upstream legacy SPDX attestation now verifies using unmodified patched Cosign2.6.5 with the same official identity, issuer and digest. Wrong signer and wrong subject digest are refused. Original3.1.4 predicate failures remain preserved. See ../../qbit-documents/docs/reviews/worker-spdx-verification-20261031-0256.md. This closes only attestation verification; image/source bytes are unchanged and hostile-runtime, vulnerability, license and deployment gates remain open.