# Follow a read of the pricing project through a Chio host This application includes a trusted Rust host, an authenticated worker client, and a small `workspace` connector over a copy of the pricing project in `repository/`. Use Rust 1.94.1 or newer on a supported Unix host and the `chio` CLI of the same release. The project depends on the published Chio crates and includes the application's complete source, worker client and lockfile. The example exercises authenticated invocation, durable admission, retained receipts and original-operation recovery. The connector runs inside the host. It does not launch a cage or isolate an untrusted worker from other files under the same Unix account. The Execution chapter treats Linux launch enforcement as a separate deployment check. ## Read a source file Pull the project, build it, and start the host: ```sh chio new security-execution --example security-execution cd security-execution cargo build --locked --bins export PATH="$PWD/target/debug:$PATH" security-execution-host .chio repository ``` Keep the host running. In another terminal in the same directory, select the example commands for that shell once: ```sh export PATH="$PWD/target/debug:$PATH" review read-pricing-v1 src/pricing.py read-pricing.receipt.json < .chio/connection.json chio receipt verify --input read-pricing.receipt.json --trusted-kernel-pubkey .chio/kernel.pub ``` The client prints the source text, its length and SHA-256 digest. It saves the original signed receipt before interpreting the returned output. A denied call exits 2; a pending approval exits 3. A transport or incomplete-result error exits nonzero and retains the need to resolve the original operation. `read-pricing-v1` is the logical operation key. It is separate from a socket request's correlation ID. Reusing it must preserve the same server, tool and arguments. Changing the path under that key is a conflict, not a new read. The host authenticates the delivered bearer, selects process `reviewer`, and reconstructs the tool request from its retained capability. Its fixed security profile selects tenant `larkfield`, isolation epoch `review-epoch-1` and generation 1. The runtime derives principal and lineage from the retained process. The worker supplies none of those identities. ## Inspect the boundary The host grants `repository/read_file` under `src/`. A different operation key does not expand that scope: ```sh review read-parent-v1 ../README.md refused.receipt.json < .chio/connection.json cat .chio/resource-reads.jsonl ``` The connector writes `resource-reads.jsonl` only after it has opened and read a file. Compare it before and after the refusal. This observation belongs to the connector; it is not a signed receipt or a source of execution authority. The connector opens every path component relative to a held directory descriptor with `O_NOFOLLOW`. It refuses parent traversal and symlinks, requires a regular UTF-8 file and caps reads at 64 KiB. These adapter checks complement scope evaluation. They do not create an operating-system sandbox for arbitrary code. ## Restart and resolve the original read Stop the host with Ctrl-C, restart it against the same state and repository, then run the original `review` command again. The host replaces the worker connection credential, so read its newly published connection file. The old receipt file must match byte for byte, and `resource-reads.jsonl` must gain no second read. To request fresh source content intentionally, choose a new logical operation key and receipt filename. An original operation remains bound to its retained result even if the repository file has since changed. The state directory binds the repository's canonical path and retains issuer, subject, capability and stores. A different repository, second serving owner or expired grant is refused. Initialization never silently refreshes the grant's identity or lifetime. Keep the kernel public key for independent verification. ## Study the implementation - `src/main.rs`: exclusive host ownership, fixed security profile, authenticated worker service, private connection publication and orderly shutdown. - `src/kernel.rs`: persistent keys, grant, receipt/revocation/accounting stores, durable admission, connector registration and startup reconciliation. - `src/repository.rs`: context-required dispatch and descriptor-relative reads. - `src/review.rs`: real worker request, original receipt retention and explicit returned/denied/pending/error handling. - `src/storage.rs`: private directories, retained keys and synced file creation. ## Deliberate interruption The optional `pause-after-read` file belongs to the host operator. Creating `.chio/pause-after-read` makes the connector wait after recording the source read and before returning it. This allows a separate process to interrupt the host at that exact boundary. A worker cannot request the pause through tool arguments. After interruption, preserve the original host directory, remove only the pause file, and reopen the host. Inspect its startup result and resolve the original operation through the same client. If Chio retains an unknown outcome, preserve that state: do not substitute a new key and describe it as recovery. This read exercise cannot establish deduplication of a mutating external effect. Use a short state path if the host reports the Unix socket path limit. ## Authority: issued children and one shared budget The Authority chapter reuses this connector and durable host setup. The initial `--bins` build includes its executable. Use `authority init --repository repository` to retain the selected repository in fresh `.authority` state. Later commands reopen that binding; `--state DIR` deliberately selects another retained context. This is a trusted operator command; the process selector is not a worker authentication mechanism. Keep the private state and this command with the host. Use the separate authenticated worker interface in the Execution chapter for untrusted worker connections. The parent grants six reads and delegation under `src/`. Reviewer and tester receive signed child capabilities with invoke-only access under `src/discount/` and `src/refund/`, a two-call grant limit, a 5,000-basis-point share, and shorter expiry. The parent is issued with a separate three-invocation delegation-family limit. Both children retain that same verified signed root binding. The process tree's 32-new-key ceiling is distinct from both kernel invocation limits. ```sh authority init --repository repository --json > authority-initial.json authority read src/discount/rules.py --as reviewer --operation review-1 authority inspect authority revoke parent ``` `read` prints the decision, selected caller, operation key and guarded source text. Use `--json` for the complete record, including original signed evidence. This format choice does not change the request or its retained result. Both allow and deny are successful observations (exit 0); invocation or persistence failures exit 1. Every original request is retained before invocation. Init refuses existing state. Reopening verifies the repository/profile, keeps original tokens, restores ancestors and reads current revocation and accounting. The command uses no DPoP requirement; its process selection belongs to the trusted operator. Inspect uses the verified family owner and the serving authority's budget API. An absent quota record means zero captured/reserved use in this fresh example. It is an observation, not permission to dispatch. The child token signature can remain valid while an ancestor is revoked or a shared quota is exhausted. For the maintainer's independent scenarios (useful read, sibling-path refusal, family versus child exhaustion, parent withdrawal and receipt signatures): ```sh python3 exercise_authority.py --binary "$(command -v authority)" \ --chio "$(command -v chio)" --output /tmp/chio-authority-check ``` This creates new private state and retains raw evidence. Choose a new output path for another campaign. It does not test native confinement or an external provider effect. ## Caller delivery: a retained executor appends a review note `review-note` is a trusted operator program with separate kernel and executor commands. It demonstrates actual reservation, committed start, a durable executor claim and signed-report reconciliation. The commands use private directories under one demo Unix account; they do not authenticate an untrusted worker, expose HTTP control routes or establish OS confinement. Keep them and their signing keys with the operator. The existing `review` client is the separate authenticated worker example. ```sh review-note init printf 'Reviewed PR #421: the fixture for #414 carries an injected comment; do not merge.\n' > review.txt review-note authorize review.txt --operation note-1 review-note execute note-1 review-note report note-1 chio receipt verify --input .caller/requests/note-1/completed.receipt.json --trusted-kernel-pubkey .caller/host/kernel.pub cat .caller/resource/review-notes.jsonl ``` Initialization provisions both owners before an execution interval begins. The host pins the executor identity and key epoch; the executor receives a separate kernel public-key pin. The host retains the original grant, request and expected invocation. The grant permits four `review-notes/append` calls, and the executor ledger retains at most four claims. Notes are UTF-8 and at most 4,096 bytes. The executor owns one fixed append destination; the request cannot select a path. Run `execute` promptly after `authorize`: the signed start has a 120-second execution window and the original grant lasts one hour. Replaying a retained report does not create a fresh execution window. `init` refuses existing state; reopening never creates a replacement executor ledger or silently replaces a missing host key/grant/database. Each command is a new OS process. To exercise acknowledgement loss after the signed report is durable, use a new operation for that distinct experiment: ```sh review-note authorize review.txt --operation note-2 review-note execute note-2 --drop-reply # The deliberate cutpoint exits 75. The note exists; report.json was not delivered. review-note execute note-2 review-note report note-2 ``` The replacement `execute` opens the same inode-bound ledger and returns its original signed report without appending again. Repeating `report` returns the same receipt. A callback interrupted before its report is retained remains a different case: the ledger preserves an unknown claim and will not repeat the effect. This exercise cuts after report persistence, not inside the append. The original request files contain the note. Treat the request directory as private operator handoff, not public telemetry. The executor's signed report is its attestation; it is not an independent provider attestation. For retained useful-operation, replay, missing-ledger and tampered-report checks: ```sh python3 exercise_caller.py --binary "$(command -v review-note)" \ --chio "$(command -v chio)" --output /tmp/chio-caller-check ``` Choose a fresh output directory. The driver keeps private state separately from its allowlisted evidence export. It independently counts the note journal and verifies completed kernel receipts under the original host key. ## Inspect a direct grant against an independent issuer The read-only `verify-grant` binary uses the portable Chio verifier. It consumes an original direct grant and a separately selected public-key file; it opens no host stores and dispatches no tool. It is included in the initial build: ```bash authority init --repository repository --state .trust-review verify-grant .trust-review/root-capability.json .trust-review/kernel.pub ``` The initializer creates and retains `kernel.pub` before verification. Select that operator-owned file independently, not the issuer field from the incoming token. The verifier explicitly supports the signed aggregate-root feature used by this application. It checks that binding, issuer trust, signature and the validity window under the selected classical cryptographic floor. It refuses delegated tokens because their current lineage admission belongs to the serving kernel. `--at UNIX_SECONDS` selects an explicit inspection time, reported as `operator_selected` in the output. Omit it to use the system clock. Checking a historical time does not authorize execution now. A verified grant still needs current revocation, subject-possession, request-scope and retained-use checks. To observe that distinction while the initialized grant is still live: ```bash authority read src/discount/rules.py \ --as reviewer --operation before-revocation \ --state .trust-review authority revoke parent --state .trust-review verify-grant .trust-review/root-capability.json .trust-review/kernel.pub authority read src/discount/rules.py \ --as reviewer --operation after-revocation \ --state .trust-review ``` Static verification remains accepted; current admission refuses the descendant's new read. The original resource journal retains one read. Use the original signed receipt for cryptographic evidence; the verifier's JSON summary is unsigned. ## Shared-limit race and request proofs Initialize a separate context with `authority init --repository repository --state .limits`. Read once with `authority read src/discount/rules.py --as reviewer --operation first --state .limits` and once with `authority read src/refund/rules.py --as tester --operation first --state .limits`. Each child then has one local use left, while the family has only one use left. `authority race --state .limits` prepares both `last-use` operations and releases two threads at one barrier. One serving host owns the original stores. Inspect the race responses, retained family usage and `resource-reads.jsonl` together. The command retains its first observations and refuses another race run in that state. Use `authority read PATH --as PROCESS --operation last-use --state .limits` to replay the winning completion, preserving its original process and path. The result and signed receipt are retained and no additional read occurs. A refused attempt need not have a completed terminal result to replay; presenting the exhausted loser again can produce another refusal receipt. Thread competition in this example does not establish multi-host concurrency. The initial build includes the complete request-proof exchange. `proof` generates disposable issuer/subject keys, pins the issuer independently, signs canonical arguments, serializes the proof, and verifies the received object. It exercises changed arguments, repeated nonce and different subject-key refusals before accepting a fresh proof. It dispatches no tool and uses an in-memory nonce store; it is a protocol example, not durable replay activation. The default summary compares the actual verification outcomes. `proof --json` prints the original decoded proof and complete verifier outcomes. Private keys are not printed or retained. ## Stop the owning kernel and retain withdrawal From the prepared application directory, `containment demo .containment repository` creates fresh private exercise state and owns one live kernel. It performs a useful read, engages the stop, retains the denied next call, resumes for a second useful read, then stops and revokes the grant. A later resume still refuses that revoked grant. The exercise leaves this instance stopped, records its last observed status and exits. `containment inspect .containment repository` opens the original stores in a new process. The kernel's in-memory stop is clear, but the durable revocation remains and the resource journal still contains two reads. The demo's automatic resumes illustrate the API; a deployed incident runbook requires operator review before resume. This local command owns its own disposable kernel; it is not an administrative connection to an existing service. ## Collect independent approvals across restarts The initial build includes `approvals`. `approvals init .approvals` creates private original state, a one-use publication capability, a two-of-three policy, SQLite approval/replay stores and durable kernel admission. The three disposable approver keys share the operator's account for this exercise. Real approvers keep their keys independently and require their own authenticated interfaces. ```bash printf 'Reviewed release 42. Publish the signed artifact index.\n' > release.txt approvals prepare .approvals release.txt approvals vote .approvals reviewer approvals vote .approvals release approvals deliver .approvals approvals execute .approvals ``` Each command reopens the original host and stores. Prepare obtains a real pending admission and kernel-signed proposal. The kernel-owned collector resolves that original operation; it does not trust a context supplied by the vote sender. Complete collection within 900 seconds. Repeating a vote reuses its signed token. A fresh token ID from that same key refuses. Delivery alone produces no tool effect and can be repeated before execution with the exact same returned set. The approved effect appends the note and a bounded spending authorization of 100 USD minor units to `publications.jsonl`. It does not settle payment or report a tool charge. Repeating execute returns the same completed result and signed receipt with one journal entry. This is completion replay, not a claim about interrupting the callback during its append. Missing original keys or stores refuse; a new init cannot replace pending authority. ## Issue a bounded grant through the trust service `policies/issuance.yaml` supplies the complete one-tier policy for the Issuance Governance chapter. It caps lifetime at 300 seconds and tool invocations at five, requires a constraint and excludes delegation. It does not select a task's server, tool or path for the requesting host. The chapter runs a local `chio trust serve` authority with separate administrative and workload credentials, requests a bounded repository grant, verifies it with `verify-grant`, and compares the result with the retained original request. Oversized grants refuse before return. The workload role permits status and issuance, not authority rotation. It is an issuance credential, not authentication of the subject named in the request body. This HTTP exercise does not install the embedded kernel's tenant/lineage freeze authority. Follow the context-bound API when that incident boundary is required. ## Command interface and summaries `authority`, `review-note` and `proof` have readable output by default and `--json` for complete machine records. Use `--help` for their syntax. `review-note` retains `.caller` by default; use `--state DIR` to select a deliberately separate example. These are example applications, separate from the installed `chio` CLI. The original positional JSON interface remains compatible with the supplied verification drivers. New interactive instructions use named options so the selected caller and original operation are visible at the call site. Exercise these interfaces, refusal paths and retained completion checks with: ```sh python3 exercise_commands.py --binary-dir "$(dirname "$(command -v authority)")" \ --output /tmp/chio-command-review-1 ``` Choose fresh output state. The driver exports readable summaries separately from private keys, stores and signed records; it never publishes the private directory.