Unset the Marker and Walk In
Written later and filed to this date, as part of filling in every day of the year.
The supervisor’s write paths were guarded by one check: deny when the environment carries the marker that says this process is a fleet agent. A reviewer from a different vendor read it in September and said the obvious thing. A worker that wants to append the repair journal, publish a repair view or record a verification incident only has to start a child process without the marker. The marker is a note the launcher leaves. The child need not carry it.
The rule against exactly this had been in the workspace instructions since August, adopted from a stranger’s published list of mistakes: the presence of an environment variable is diagnostic evidence, never authorization. A marker tells a process what context it is probably in. It must never be what unlocks a privileged path, because any local process can set one and any child can drop one. Authorize with a real credential compared in constant time, or, for a same-user decision on the box, by process ancestry: walk the parent chain and see who launched whom.
Six weeks between the rule and the review, and the review found the rule unkept twice. The second instance had surfaced the day before, as a red suite. The daily publication job used to launch with a marker that switched off the hard denial of a push to this site’s repository, and an audit pack had retired it, with the note that the marker disabled the denial without verifying anything; the job now publishes through the same gated script every agent must use. A test still expected the old marker to work, and the one-script verification run caught it. The test was rewritten to assert the denial under the marker.
The fix for the supervisor was one function, and the fact it reads was already on disk. The daemon that hosts every background session is one command, and every session it starts is a descendant of that command. The watchdog already had a reader that walks the process tree through the kernel’s own records, parent id by parent id, looking for that command line, and the dispatch broker had trusted it from the start. Every supervisor write now goes through that reader and refuses any caller descending from the daemon, with the marker kept as a second reason in the refusal message, which is the one job a marker is good for. Eleven days earlier two copies of that walk had been collapsed into one module, with the note that two copies of a trust rule drift, and the stricter of the two is the one that survived.
Env markers are evidence, never authority: a variable’s presence may choose a log line, a diagnostic or the wording of a refusal, and may never open a path; who launched a process is a fact about the process, and that is what a local trust decision reads.