Broker Crossing Authority

This carrier is available in Ota v1.6.26 and later. Earlier Ota releases do not include this carrier.

The Unix authority_broker carrier gives a governed non-agent ota run or ota up one independently authorized, atomically consumed lease for one exact semantic work unit.

The repository still declares only governance.crossing_authority.authority_id. Broker location, verifier keys, descriptor delivery, attestation policy, and timing bounds stay in the administrator-owned fixed system store.

Broker attestation v1 remains compatible and proves only its challenge-bound launcher session. The additive v2 branch binds one exact protected-launcher runtime profile and never reinterprets v1 evidence.

• routine safe execution needs no crossing authority
• zero or multiple matching protected bindings refuse rather than guessing
• the broker lease is hidden from the caller and cannot be copied into repository configuration
• one successful consumption cannot authorize a second invocation
• ordinary workflow readiness timeout and runner-derived closure/effect/resource breadth are bound into the exact semantic scope
• grant-required runtime and lifecycle proof retain one proof-owned transaction across nested Ota execution, helpers, assertions, and cleanup; runner-private authority is removed before selected task code starts

The first carrier is Unix-only and reads one fixed Linux trust store. Repository files, environment variables, policy, workflow fields, and CLI flags cannot redirect it.

• the store and every canonical parent must be root-owned and not group/world writable
• symlinks, non-regular files, duplicate authority IDs, duplicate binding identities, malformed records, and unknown fields fail closed
• the binding fixes the inherited Unix descriptor, expected broker origin, protocol version, verifier keys, issuer/audience, message domains, and wait/lease limits
• the first profile requires required_administrator_claims: []; claim extensions refuse until Ota defines canonical validation semantics
• the launcher supplies an already-connected Unix stream; Ota verifies it and sets FD_CLOEXEC before sending a challenge
• v2 requires the exact profile identity, the v2 attestation response domain, a signed launcher-session binding identity, and attestor keys disjoint from broker authorization keys
• new v1 bindings use an explicit per-binding schema_version: 1; unversioned v1 remains compatibility-only for already-issued identities and archives

/etc/ota/  crossing-brokers.json    broker identity, verifier keys, launcher FD, attestation and timing policy

{  schema_version: 1,  bindings: [{    schema_version: 1,    identity: "sha256:<canonical binding digest>",    authority_id: "platform-release-authority",    broker_id: "platform-crossing-broker",    origin: "https://broker.example.internal",    server_name: "broker.example.internal",    protocol_version: "ota-crossing-broker/v1",    transport_authentication: {      kind: "mtls",      trust_bundle_identity: "sha256:<broker trust bundle>",      credential_source_identity: "launcher:workload-session/v1"    },    credential_delivery: {      kind: "launcher_session_fd",      descriptor: 3,      session_audience: "ota-crossing-broker"    },    broker_verifiers: [{      key_id: "broker-2026-01",      algorithm: "ed25519",      public_key: "<base64url public key>"    }],    attestation: {      issuer: "runner-launcher",      audience: "ota-crossing-broker",      trust_bundle_identity: "sha256:<launcher trust bundle>",      verifiers: [{        key_id: "launcher-2026-01",        algorithm: "ed25519",        public_key: "<base64url public key>"      }],      maximum_age_seconds: 180,      maximum_clock_skew_seconds: 5,      key_rotation_overlap_seconds: 300,      mandatory_protocol_claims: [        "binding_identity", "challenge_nonce_commitment", "invocation_id",        "work_unit_identity", "semantic_scope_identity", "runner_principal",        "channel_delivery", "authenticated_origin", "authority_mounts"      ],      required_administrator_claims: []    },    message_domains: {      challenge_request: "ota-crossing-broker/challenge-request/v1",      attestation_response: "ota-crossing-broker/attestation-response/v1",      authorization_request: "ota-crossing-broker/authorization-request/v1",      authorization_decision: "ota-crossing-broker/authorization-decision/v1",      lease_issuance: "ota-crossing-broker/lease-issuance/v1",      lease_consume: "ota-crossing-broker/lease-consume/v1",      lease_consume_response: "ota-crossing-broker/lease-consume-response/v1",      lease_consumption_query: "ota-crossing-broker/lease-consumption-query/v1",      lease_consumption_status: "ota-crossing-broker/lease-consumption-status/v1"    },    maximum_approval_wait_seconds: 120,    minimum_post_approval_freshness_seconds: 30,    maximum_lease_seconds: 300  }]}

{  schema_version: 2,  attestation: {    protocol_version: "ota-runtime-boundary-attestation/v2",    profile_id: "ota.runtime-boundary.protected-launcher/v1",    profile_identity: "sha256:8a0c2b279b90840a038525f841f896016030a9f61a054fb759da4bb197faf4e8",    attestor_kind: "protected_launcher",    adapter: "launcher_session_peer/v1",    launcher_session_binding_identity: "sha256:<protected launcher-session binding>",    issuer: "runner-launcher",    audience: "ota-crossing-broker",    trust_bundle_identity: "sha256:<launcher attestation trust bundle>",    verifiers: [{      key_id: "attestor-2026-01",      algorithm: "ed25519",      public_key: "<base64url public key distinct from broker keys>"    }],    maximum_age_seconds: 180,    maximum_clock_skew_seconds: 5,    key_rotation_overlap_seconds: 300  }}

• dry-run returns authority_carrier: authority_broker and decision: requires_live_authorization; it creates no transaction and consumes no lease
• routine execution automatically uses the one protected binding matching authority_id
• optional --grant platform-release-authority only confirms or disambiguates that non-secret label; it never supplies a lease or approval token
• agent refusal remains authoritative and cannot be bypassed by broker authority

governance:  crossing_authority:    authority_id: platform-release-authority

ota run publish --dry-run --json

ota run publishota up --workflow release

• task processes and child commands do not inherit the launcher descriptor
• deterministic admission failures refuse before broker consumption; provisioning belongs to the authorized work unit and starts only after lease consumption
• denial, timeout, interruption, stale attestation, changed scope, revocation, expiry, replay, or ambiguous consume outcome refuses before selected work
• a later approval cannot revive a locally cancelled request
• the broker consume response is bound to the exact pending transaction identity
• an uncertain consume acknowledgement is re-queried only after fresh launcher attestation; every verified recovery status closes the abandoned transaction as incomplete and never resumes work
• a signed recovery status is durable, so restart can complete local finalization without a second broker query
• immutable Linux/x64 PID 1 run 31664495937 proves completed, failed, interrupted, replay-refused, and crash-recovered selected execution; Core completion remains separate from launcher cleanup, which persists the exact completion before removing the child, scope, cgroup, and active slot

derive exact semantic work unit  -> verify protected binding and launcher channel  -> send nonce-bound challenge  -> verify launcher attestation  -> verify signed authorization and prepared lease  -> durably create pending crossing transaction  -> atomically consume lease for that transaction  -> start selected work  -> finalize and archive terminal evidence

V2 does not accept a launcher saying only that it is hardened. The protected binding selects one immutable protocol-published profile and Ota verifies its complete ordered observation set before broker authorization.

• the base ota.runtime-boundary.protected-launcher/v1 profile has 11 required observations covering principal, authority and attestor state, credentials, descriptor lifetime, host-control access, privilege posture, and launcher/configuration identity
• the image profile adds exact runner-image and hardening-profile identities; those claims are absent from the base profile rather than guessed
• missing, duplicate, reordered, failed, unknown, downgraded, or substituted observations refuse before authorization or selected work
• complete v2 evidence emits protected_launcher_attested_one_use; immutable v1 evidence retains launcher_attested_one_use
• archive verification re-derives the original profile and identity-domain branch; it never upgrades v1 by injecting v2 defaults

Successful receipts use transaction schema v2 and retain the carrier-specific evidence needed to re-verify the crossing later.

• binding, attestation, nonce, work-unit, signed decision, prepared lease, and broker revision identities
• signed consume request/response and consume time
• exact contract, semantic scope, crossing family/classification, and bounded actor mode
• selected workflow instance and ordered prerequisite-instance closure, plus scope breadth with closure node/edge counts, effect categories, and hashed resource identities/counts; archive verification re-derives them
• the archived binding is a public verification snapshot and never contains the protected live launcher descriptor
• signed protocol payloads use bounded public-safe invocation, principal, and authority-mount labels; raw paths, descriptors, credentials, and secret provider material are excluded
• pending and terminal transaction identities, state, and outcome
• ota receipt --history --json rejects missing consumption, carrier substitution, replay, scope drift, altered signatures, and incomplete Core transaction evidence
• the portable-finalization carrier binds launcher-owned transaction schema v3 into the signed consume exchange; broker-archive schema v2 then requires atomic durable Core archive publication, execution-principal-owned 0700 archive directories, protected post-cleanup recovery, root-launcher verification and atomic sidecar publication, identity-bound terminal acknowledgement, and producer-signed cleanup plus the exact archive association, while the job principal never reads the private archive and historical transaction v2 evidence is not upgraded
• immutable Linux/x64 PID 1 run 31758094819 proves the pressure-only portable-finalization and crash-recovery path: all 21 terminal boundaries have zero active slots, finalization journals, and scopes; positive execution and three terminal crash-recovery points each retain one valid archive and zero invalid archives; completion-crash recovery proves schema-v2 child absence without claiming an observed exit or child reaping

The production systemd client attaches a verified terminal crossing archive to Launcher-owned protected history before the execution principal can remove or rewrite the evidence. A separate least-privilege operator reads that history through one fixed socket; it does not read /var/lib/ota directly.

This is an explicit source, not a silent replacement for local history. Core remains the semantic verifier and never falls back to .ota/receipts when the protected service refuses.

• Launcher freezes and publishes three content-addressed objects for every catalog entry: the receipt archive, its immutable contract snapshot, and the signed launcher-finalization sidecar
• the response binds the protected repository mapping, catalog namespace and snapshot, exact archive/catalog identities, admitted non-agent operator profile, and live operator peer
• the first operator profile requires a non-root principal with no effective, permitted, inheritable, or ambient capabilities, NoNewPrivileges=1, and no membership in launcher, execution, attestor, or broker groups
• path arguments, --file, OTA_FILE, protected storage paths, arbitrary filenames, and latest selectors cannot redirect the protected source
• an omitted archive identity requests one complete bounded catalog snapshot; an oversized selection refuses and must be retried with one exact content identity
• Launcher verifies protected storage and signatures, then Core independently re-verifies the archived contract, semantic scope, authority, transaction, cleanup, and archive association from the returned bytes
• local ota receipt --history remains available and reports local_archive_directory_observed; only the protected source reports complete_selected_catalog_snapshot

ota receipt --history --source systemd_protected_launcher --json

ota receipt --history --source systemd_protected_launcher --archive-identity sha256:<archive> --json

/etc/ota/  authority-history.json        administrator-owned repository and operator binding /var/lib/ota/authority-launcher/history/  blobs/                        root-owned mode-0600 content-addressed objects  catalog/<namespace>/          root-owned mode-0600 catalog entries /run/ota/  authority-launcher.sock       governed execution client endpoint  authority-history.sock        least-privilege read-only history endpoint

• launcher_attested_one_use means Ota verified the v1 signed launcher protocol and atomic broker consumption, without a structured runtime-separation profile
• protected_launcher_attested_one_use means every observation in one exact v2 protected-launcher profile verified; it proves no provider or host fact outside that signed profile
• the first adapter supports Unix launcher-session delivery only, not direct task-accessible mTLS keys or provider tokens
• governed runtime and lifecycle proof retain one proof-owned terminal transaction across their complete invocation and cleanup sets; terminal archives re-derive the exact carrier admission
• bounded protected-launcher v2, execution-disabled systemd V3, and selected systemd execution pressure are green; run 31664495937 binds the immutable Core, Launcher, and Protocol revisions
• immutable Linux/x64 PID 1 run 31823037642 proves the installed production client and protected-history source against exact Protocol, clean source-built Core, and Launcher revisions: one valid and zero invalid protected archive, one catalog entry, three content-addressed objects, exact cleanup, unchanged refusal worktrees, and no private signing material
• independently administered Linux/x64 PID 1 run 31939777636 proves the consumer-only positive hardened-launcher path; run 31953535665 separately proves administrator-driven execution-completion, finalization-intent, and terminal-recorded reboot recovery with three valid protected archives, zero invalid or legacy archives, unchanged repository state, and complete cleanup; those runs satisfy the bounded V11.7 OSS slice, while provider-attested authority remains optional stronger hardening
• Ota does not operate the broker, issue approvals, own organization signing keys, or prevent raw-shell bypass outside adopted Ota execution chokepoints