Host-runner service owner package

This package is a source/build/install package for a Darwin owner with an existing legitimate root-service authority. It is not authority to change a provider setting, publish a runner, or activate any other host.

The daemon is reachable only through the declared LaunchDaemon Mach service. It creates its own resident primary, records and rechecks its audit token, birth time, direct daemon-parent relation, held executable digest and csops strict code identity, then keeps that record private. It admits only the reviewed signed client identity. Its signed-client requirement is generated by the installer from the actual signed client candidate and stored root-only; it is not a repository-selected team, certificate, CDHash, or broad identifier. For each accepted job, the daemon creates a fresh root-owned output leaf and inventory parent from the held primary and client image identities plus its nonce. It retains their descriptors and identity/digest evidence, and rechecks those same descriptors for the expected parent and leaf plus their fixed parent envelope relation on completion. It records issuance and every terminal transition in its root-only journal before replying. It issues a write-only pipe capability and opaque nonce itself, binds both to the XPC peer audit identity, expires them after sixty seconds, consumes them once, and revokes peer grants on disconnect, expiry, identity mismatch and completion. A client never supplies the daemon's executable, PID, image digest, state path, expected object, or readable bearer capability.

On the designated Darwin host, after root approval, build and sign in the owner-controlled pipeline, then install the checksum-bound binary:

export SERVICE_LASSO_HOST_RUNNER_SIGNING_IDENTITY='Developer ID Application: owner identity'
scripts/host-runner-service/darwin/build.sh /absolute/output/service-lasso-host-runner
sudo scripts/host-runner-service/darwin/install.sh /absolute/output/service-lasso-host-runner /absolute/output/service-lasso-host-runner.sha256 /absolute/output/service-lasso-host-runner-client /absolute/output/service-lasso-host-runner-client.sha256
sudo scripts/host-runner-service/darwin/verify.sh

The installer accepts only canonical fixed service paths, validates every ancestor and leaf against links, root ownership and restrictive modes, plus SHA-256 and a strict code signature before staging a replacement. It snapshots the binary, plist, and prior loaded state; a failed bootstrap restores all three and reactivates a previously loaded prior service. Temporary staging and backup files are root-owned and are torn down only after the replacement is read back. Uninstall fails if unload fails and only then removes program files. Both uninstall and failed-install rollback retain the private state directory for owner review.

Retain the private receipt containing only service identity, launchd state, FD/capability expiry and revocation events, primary identity fields, and result classes. Do not put capability contents, caller paths, command lines, secrets, or provider tokens in it. Roll back with sudo scripts/host-runner-service/darwin/uninstall.sh.

node scripts/host-runner-service/qualification.mjs compiles the platform validator where its native toolchain is present. It is source/build evidence, not activation evidence. Native acceptance remains unavailable until an authorised owner performs the Darwin install and retains its private receipt.

The handover surface is host-runner contract v3. The owner build emits a checksum manifest and a provenance JSON record that binds service-lasso.host-runner.v3, source SHA-256 and both signed candidate SHA-256 values. The package includes the reviewed native Core client for the daemon contract; the Node Core runtime has no ambient fallback or caller-selected host-runner path. A fresh consumer must pin the daemon/client provenance and prove its Core-to-client invocation separately before a cross-repository acceptance claim is possible.