Plan per-attempt steps 3-9, including the jailer command the authorized arm emits

dag/extdeps/exec/command.dag

@@ -83,6 +83,7 @@ fn argv_command(program: NonEmptyStr, arguments: List<String>) -> ArgvCommand
     decl_ref(module_path: "extdeps.tools.tar", decl_name: "tar_extract_command"),
     decl_ref(module_path: "extdeps.tools.squashfs_tools", decl_name: "unsquashfs_extract_command"),
     decl_ref(module_path: "extdeps.tools.e2fsprogs", decl_name: "mke2fs_populate_command"),
+    decl_ref(module_path: "extdeps.tools.e2fsprogs", decl_name: "mke2fs_format_command"),
     decl_ref(module_path: "extdeps.tools.make", decl_name: "make_command"),
     decl_ref(module_path: "extdeps.package_managers.pip", decl_name: "pip_install_pinned_command"),
     decl_ref(module_path: "extdeps.package_managers.conda_forge", decl_name: "micromamba_create_command"),
@@ -108,6 +109,7 @@ fn argv_command(program: NonEmptyStr, arguments: List<String>) -> ArgvCommand
     decl_ref(module_path: "extdeps.tools.hostname", decl_name: "hostname_short_read_command"),
     decl_ref(module_path: "extdeps.tools.busybox", decl_name: "busybox_httpd_command"),
     decl_ref(module_path: "extdeps.tools.busybox", decl_name: "busybox_tftpd_over_udpsvd_command"),
+    decl_ref(module_path: "extdeps.tools.busybox", decl_name: "busybox_dd_sparse_image_command"),
     decl_ref(module_path: "extdeps.tools.curl", decl_name: "curl_ftps_upload_command"),
     decl_ref(module_path: "extdeps.tools.mosquitto_pub", decl_name: "mosquitto_publish_command"),
     decl_ref(module_path: "extdeps.tools.gnu_time", decl_name: "gnu_time_max_rss_command"),
@@ -123,6 +125,7 @@ fn argv_command(program: NonEmptyStr, arguments: List<String>) -> ArgvCommand
     decl_ref(module_path: "extdeps.posix.test_utility", decl_name: "test_executable_command"),
     decl_ref(module_path: "extdeps.virtualization.firecracker", decl_name: "firecracker_version_command"),
     decl_ref(module_path: "extdeps.virtualization.firecracker", decl_name: "firecracker_run_config_command"),
+    decl_ref(module_path: "extdeps.virtualization.firecracker", decl_name: "firecracker_jailer_run_command"),
     decl_ref(module_path: "extdeps.ssh.openssh_client_commands", decl_name: "ssh_keygen_public_key_command"),
     decl_ref(module_path: "extdeps.ssh.openssh_client_commands", decl_name: "ssh_keygen_fingerprint_command"),
     decl_ref(module_path: "extdeps.ssh.openssh_client_commands", decl_name: "ssh_keygen_known_hosts_find_command"),

dag/extdeps/tools/busybox.dag

@@ -1,6 +1,7 @@
 module extdeps.tools.busybox
 
 import std.types { NonEmptyStr, String, Int, Port }
+import std.measure { Mebibyte, mebibyte_count }
 import extdeps.version { VersionConstraint }
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.uri { Uri, Https }
@@ -53,3 +54,25 @@ fn busybox_tftpd_over_udpsvd_command(busybox_bin: NonEmptyStr, document_root: No
     ],
   )
 }
+
+// count=0 AND seek=N CREATES A SPARSE FILE OF N BLOCKS WITHOUT WRITING ZEROS. busybox dd treats
+// `bs=1M` as the block size, so the seek count is a Mebibyte magnitude rendered here rather than
+// a bare integer at the call site. `of=` is the image path; the file is then formatted by a
+// different tool (mke2fs_format_command). This is the host-init workspace create X already runs.
+fn busybox_dd_sparse_image_command(
+  busybox_bin: NonEmptyStr,
+  image_path: String,
+  size: Mebibyte,
+) -> ArgvCommand {
+  argv_command(
+    program: busybox_bin,
+    arguments: [
+      "dd",
+      "if=/dev/zero",
+      concat("of=", image_path),
+      "bs=1M",
+      "count=0",
+      concat("seek=", to_string(mebibyte_count(m: size))),
+    ],
+  )
+}

dag/extdeps/tools/e2fsprogs.dag

@@ -41,6 +41,18 @@ fn ext_filesystem_type_wire(fs: Ext2FilesystemType) -> String {
   }
 }
 
+// FORMAT AN EXISTING IMAGE FILE, WITH NO SOURCE DIRECTORY AND NO SIZE OPERAND. A workspace that
+// must be empty of any prior tenant is created as a sparse file (busybox_dd_sparse_image_command)
+// and then formatted; `-d` would populate from a tree and that is a different operation
+// (mke2fs_populate_command). There is no `m` size suffix here because the file already has a
+// length; this builder must not steal the size-operand annotation that belongs to populate.
+fn mke2fs_format_command(fs: Ext2FilesystemType, image_path: String) -> ArgvCommand {
+  argv_command(
+    program: mke2fs_program,
+    arguments: ["-t", ext_filesystem_type_wire(fs: fs), "-F", "-q", image_path],
+  )
+}
+
 // `-d` IS WHAT MAKES A ROOT FILESYSTEM BUILDABLE WITHOUT MOUNTING ONE, and that is the reason this
 // builder exists rather than a mount-copy-unmount sequence. mke2fs populates the new filesystem from
 // a directory tree in userspace, so the image is produced by one process with no loop device, no

dag/extdeps/virtualization/firecracker.dag

@@ -233,3 +233,60 @@ fn firecracker_run_config_command(binary: String, config_path: String) -> ArgvCo
     arguments: ["--no-api", "--config-file", config_path],
   )
 }
+
+// `--cgroup-version` SELECTS AN IMPLEMENTATION, IT DOES NOT PLACE A PROCESS. Upstream documents
+// the flag; a live run showed the VMM still at cgroup 0::/ when the supervisor never joined a
+// leaf. Treating the flag as placement would re-author the unbounded-attempt defect.
+data firecracker_jailer_cgroup_version_2: String = "2"
+
+// THE `--` IS THE BOUNDARY BETWEEN JAILER FLAGS AND VMM FLAGS. Everything after it is what
+// Firecracker would have taken on a direct exec, including `--no-api` (without which the VMM
+// binds its API socket and waits). Config paths here are INSIDE the jail after pivot: a host
+// path would fail open as a missing artifact rather than as the containment boundary working.
+fn firecracker_jailer_run_command(
+  jailer_binary: String,
+  jailer_id: String,
+  exec_file: String,
+  uid: Int,
+  gid: Int,
+  chroot_base_dir: String,
+  config_path_in_jail: String,
+) -> ArgvCommand {
+  argv_command(
+    program: jailer_binary as NonEmptyStr,
+    arguments: [
+      "--id", jailer_id,
+      "--exec-file", exec_file,
+      "--uid", to_string(uid),
+      "--gid", to_string(gid),
+      "--chroot-base-dir", chroot_base_dir,
+      "--cgroup-version", firecracker_jailer_cgroup_version_2,
+      "--",
+      "--no-api",
+      "--config-file", config_path_in_jail,
+    ],
+  )
+}
+
+// THE JAILER'S CHROOT ROOT ON THE HOST is `<chroot-base-dir>/<exec-file-basename>/<id>/root`.
+// Upstream creates that tree and pivots into `root`; config `path_on_host` values are then
+// names inside that root (`/work.img`), while the supervisor still has to CREATE the files
+// at the host path below. The basename is the last `/`-separated segment of `--exec-file`.
+fn firecracker_jailer_exec_file_basename(exec_file: String) -> String {
+  fold(split(s: exec_file, delimiter: "/"), init: "", f: (acc, seg) => if seg == "" { acc } else { seg })
+}
+
+fn firecracker_jailer_chroot_root(
+  chroot_base_dir: String,
+  exec_file: String,
+  jailer_id: String,
+) -> String {
+  join([
+    chroot_base_dir,
+    "/",
+    firecracker_jailer_exec_file_basename(exec_file: exec_file),
+    "/",
+    jailer_id,
+    "/root",
+  ], "")
+}

dag/gunbc/product/fabric/grant_issue.dag

@@ -518,15 +518,11 @@ fn issue_grant<P, Q, S>(
   }
 }
 
-// DECLARED FRONTIER (DESIGN 3c). grant_authorizes_reservation has NO production consumer in this
-// change: its only caller is test.claim.fabric_grant_authorization_witness, which exercises it
-// rather than asserting it exists. NAMED CONSUMER: the FCI-3 executor, whose exit predicate in
-// gunbc.fabric_ci_program is that a persistent executor re-reads the committed Grant before
-// starting and that an absent, corrupt or expired Grant yields zero target processes -- this rule
-// is the agreement half of that re-read. TRIGGER, stated because a frontier without one is a
-// dangling declaration: the rule stays uncalled until FCI-3 lands an executor that re-reads a
-// committed grant. It is homed here, beside issue_grant, so that consumer imports one fabric
-// module rather than reaching into a runner-layer module for fabric vocabulary.
+// DECLARED FRONTIER (DESIGN 3c). grant_authorizes_reservation is consumed by
+// gunbc.runner_attempt_launch plan_attempt_launch, which is the agreement half of FCI-3's
+// re-read: an absent, corrupt, or disagreeing Grant yields zero jailer argv. The durable
+// re-read from fabric_allocation_store remains a frontier of that same launch until the store
+// carries grant facts; this rule stays the agreement counterpart of issue_grant.
 
 // THE AGREEMENT COUNTERPART OF issue_grant, HOMED BESIDE THE ISSUER RATHER THAN AT A CONSUMER.
 // A grant that fences money proves the money; it proves nothing about WHICH execution was