[futurepaul]

The active Latitude hosts run Linux 6.18.39 with public Caddy MPTCP listeners. Their kernel lacks the CVE-2026-98432 fix, and no IPv4-options barrier was installed.

This change imports one shared NixOS module on lat2, lat3, lat4, lat5, and lat7. It installs an early boot raw-PREROUTING filter for IPv4 TCP packets carrying IP options, disables MPTCP, and pins the upstream 6.18.56 kernel source without advancing the OS, application, or Kata inputs. Applying the guard restores first position by inserting before any earlier rules, retaining older copies to avoid a removal gap or rule-number races. Check enforces the same ordering invariant. The guard has no stop action, so service replacement does not remove the packet barrier. Ordinary TCP, IPv6, and UDP do not match the rule.

finite-status --tcp-security reports the exact first rule, MPTCP state, active service, persistent unit and matching boot-link ownership, and running kernel. It rejects runtime-only units/links, runtime-backed aliases, and higher-priority conflicting overrides; both operator system.control and declarative NixOS paths are covered. The runbook documents the emergency operator-unit handoff and exact rollback boundary. Guest-local or directly bridged traffic bypassing the host IP stack requires its own kernel protection; this is not a guest-kernel patch audit.

Validation:

• Isolated network/mount namespace: actual apply script, idempotence, ordinary IPv4 TCP, blocked benign IPv4 TCP options, unaffected IPv6/UDP, and exact filter rollback.
• Eighteen focused security regressions cover stateful script application/checks, insertion/sysctl failures, persistent filesystem fixtures, runtime-only attachment, and NixOS handoff.
• Full just finite-status-contract: 244 tests run with no failures (11 skipped); 58 CI routing tests passed.
• just source-structure-check and Nix formatting passed.
• All five NixOS host configurations evaluated with no failing assertions, fixed kernel selection, MPTCP disabled, and correct rendered guard units.
• Kernel archive hash verified through Nix; both affected IPv4 files contain the upstream RCU-safe frees.

The user-authorized emergency mitigation is already active and attached to boot on all five hosts. Each host passed a live benign-options drop-counter test and ordinary TCP test. Before/after canonical status did not regress; public dashboard/chat and local Core/dashboard/chat/Brain health probes pass. No product services were restarted and no hosts rebooted. Existing fleet/host-health warnings remain unchanged.

The running kernels are still 6.18.39. Full closure builds and controlled kernel reboots remain pending review/merge and the existing main-only CI artifact workflows; no full kernel build or boot qualification is claimed here. Retain the emergency guard during that rollout and follow the documented operator-unit handoff.

[github-actions]

Documentation census

This PR adds 1 new Markdown file and 104 lines of Markdown, and removes 0 Markdown files and 0 lines of Markdown.

Net documentation change: +104 lines.

Are you sure all of this needs to live in the repo? Future us already has enough required reading.

Counts .md and .markdown files anywhere in the repo, case-insensitively. Lines include additions and deletions across all matching files; net change is additions minus deletions. Renamed files are not counted as new or removed. Advisory only; never a merge gate.

[alexlwn123]

Fail for now — two mitigation-state gaps on ad2b6d1:

1. [P2] Re-establish the first-rule invariant when applying the guard (infra/scripts/mitigate-cve-2026-98432:15–24). If another raw PREROUTING rule is inserted ahead of an existing guard, iptables -C still succeeds, so restarting/reapplying the guard leaves it in the wrong position. An earlier ACCEPT can bypass the drop, yet both --apply and --check exit 0. I reproduced this with the actual Bash script and a stateful iptables/sysctl mock; the canonical probe correctly reports red for the same rules. Ensure apply puts the exact barrier first without temporarily removing protection or disturbing unrelated rules, and make check enforce the same invariant. Cover an existing guard behind an ACCEPT as well as clean/idempotent application.

2. [P2] Verify persistent boot attachment, not only the loaded dependency graph (scripts/finite_status_tcp_security.py:22–24,47–50). A runtime-enabled unit can have WantedBy=multi-user.target and be active while its unit and wants link exist only under /run/systemd/system. The probe reports green for that state, although both disappear at reboot. An offline disposable systemd-root fixture confirms enabled-runtime; the matching mocked collector result is green. Inspect persistent unit/dependency ownership (including the documented operator system.control and declarative NixOS paths), and reject runtime-only attachment. Add this case alongside the existing test that merely omits WantedBy.

Validation: 5 new probe tests and 58 CI-selection tests pass; finite-status contract checker, Bash syntax and diff whitespace checks pass. Stateful script mocks cover clean/repeated apply, insertion/sysctl failures, invalid arguments and the ordering defect. The existing finite-status suite ran 134 tests: 129 passed, 4 skipped, 1 errored because this environment lacks the sqlite3 CLI. Tests used the available Python, not the pinned Nix environment. Upstream kernel CVE notice and fix commit confirm 6.18.56 and both RCU-free changes; the source hash matches kernel.org's checksum listing.

Limits: no Nix/just available, no Nix evaluation or closure/kernel build, no actual kernel packet filtering or reboot/handoff/rollback execution, and no live-host or product probes. No host security settings or repository source changed. Guest-local/directly bridged traffic remains outside the documented mitigation scope. CI status summaries show relevant status/Nix contracts passing; some other jobs remain pending. No restricted CI logs accessed.

[alexlwn123]

Pass for the two requested fixes on 59d7b14; no new material defect found in the follow-up delta.

Independently reran the earlier ordering scenario against the actual script with stateful command mocks: check now rejects a buried guard, apply inserts protection first while retaining old/unrelated rules, and repeated apply stays stable. Failure to verify the inserted first rule stops before the MPTCP write. An offline systemd-root fixture classified as enabled-runtime is now red despite WantedBy being present. Separate filesystem fixtures verified persistent operator attachment, the operator-to-NixOS symlink handoff, and rejection of missing boot links, masks and broken higher-priority overrides.

Validation: all 76 focused probe/script/CI-routing tests pass, plus the finite-status contract checker, Bash syntax and diff whitespace checks. Current CI summaries show Finite status contract and Nix service packages passing; Nix static contracts remains pending.

Limits: available Python and disposable mocks/filesystem fixtures only; offline systemctl inspected unit files without starting a service. No actual kernel filtering, running-systemd boot/handoff/rollback, Nix evaluation, closure/kernel build, reboot or live-host/product probes. Nix/just and the sqlite3 CLI remain unavailable locally; the broader SQLite-dependent suite was not rerun. No source, host security or production changes, and no restricted CI logs accessed. This is a resolution COMMENT, not an approval or deployment qualification.

addressed