Confine managed mount setup to subordinate authority

cmd/reploy/main.go

@@ -8,6 +8,9 @@ import (
 )
 
 func main() {
+	if code, handled := dockerdeploy.RunManagedMountSetupChildV1(os.Args[1:], os.Stderr); handled {
+		os.Exit(code)
+	}
 	if code, handled := dockerdeploy.RunControlledSessionWatchdogChild(os.Args[1:], os.Stderr); handled {
 		os.Exit(code)
 	}

internal/deploy/identity_mapping_effects.go

@@ -22,7 +22,7 @@ func (ops IdentityMappingOperationsV1) ObserveEffects(ctx context.Context, expec
 	}
 	state := status.State
 	m := state.IdentityMapping
-	if state.Current == nil || m == nil || m.PendingOperation == nil || m.PendingOperation.Phase != "effects-pending" {
+	if state.Current == nil || m == nil || m.Revoked || m.PendingOperation == nil || m.PendingOperation.Phase != "effects-pending" {
 		return StateV1{}, fmt.Errorf("mapped create requires its recorded effects-pending operation")
 	}
 	canonical, err := identitymapping.ValidateGeometry(active)

internal/deploy/identity_mapping_effects_test.go

@@ -11,6 +11,32 @@ import (
 	"github.com/omry/reploy/internal/identitymapping"
 )
 
+func TestMappingObserveEffectsRefusesRevokedPreparationV1(t *testing.T) {
+	path, ops, state, _ := operationFixtureV1(t, false, true)
+	active := operationGeometryV1(100000)
+	intent, err := ops.Configure(t.Context(), state, active, "revoked-setup")
+	if err != nil {
+		t.Fatal(err)
+	}
+	pending, err := ops.BeginEffects(t.Context(), intent, "revoked-setup")
+	if err != nil {
+		t.Fatal(err)
+	}
+	pending.IdentityMapping.Revoked = true
+	writeMappingFixtureV1(t, path, pending)
+	before, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := ops.ObserveEffects(t.Context(), pending, active, "revoked-setup"); err == nil {
+		t.Fatal("revoked mapping authorized preparation")
+	}
+	after, err := os.ReadFile(path)
+	if err != nil || !reflect.DeepEqual(before, after) {
+		t.Fatal("refused preparation changed the retained journal", err)
+	}
+}
+
 func TestMappingObserveEffectsBindsExactPendingAuthorityV1(t *testing.T) {
 	for _, installed := range []bool{false, true} {
 		t.Run(map[bool]string{false: "staged", true: "installed"}[installed], func(t *testing.T) {

internal/dockerdeploy/managed_mount_setup.go

@@ -0,0 +1,23 @@
+package dockerdeploy
+
+import (
+	"fmt"
+	"io"
+)
+
+const managedMountSetupArgumentV1 = "__reploy-managed-mount-setup-v1"
+
+// RunManagedMountSetupChildV1 handles only the fixed private setup operation.
+// Its complete input comes from sealed and inherited descriptors, never argv.
+func RunManagedMountSetupChildV1(args []string, stderr io.Writer) (int, bool) {
+	if len(args) != 1 || args[0] != managedMountSetupArgumentV1 {
+		return 0, false
+	}
+	if err := runManagedMountSetupChildV1(); err != nil {
+		if stderr != nil {
+			_, _ = fmt.Fprintf(stderr, "managed mount setup: %v\n", err)
+		}
+		return 1, true
+	}
+	return 0, true
+}