{ "packages": [ { "line": 293, "id": "WP0.1", "title": "Rozhodnutí F0", "owner": "uživatel", "note": "6/8 rozhodnuto; otevřené F0.7 (rozsah integrací), F0.8 (min. konfigurace, výkonové cíle)", "state": "active", "phase": "F0", "deliverable": "Vyplněné [DECISIONS.md](DECISIONS.md)", "dependencies": "—", "definition_line": 51, "stream": "F0 — Rozhodnutí a základy (start okamžitě)" }, { "line": 294, "id": "WP0.2", "title": "Repo, dokumentace, coverage", "owner": "—", "note": "první commit", "state": "done", "phase": "F0", "deliverable": "Tento repozitář, GUIDE, COVERAGE", "dependencies": "—", "definition_line": 52, "stream": "F0 — Rozhodnutí a základy (start okamžitě)" }, { "line": 295, "id": "WP0.3", "title": "Společná sada sond", "owner": "—", "note": "`spikes/common`: `sanjbox-whoami`, `sanjbox-canary`, formát protokolu; 16 testů", "state": "done", "phase": "F0", "deliverable": "Swift knihovna + CLI `sanjbox-whoami`: ověření skutečného/efektivního UID/GID, skupin, audit session a bootstrap kontextu proti očekávání (nesoulad = neplatné měření); generátor syntetických kanárků; formát protokolu běhu", "dependencies": "WP0.2", "definition_line": 53, "stream": "F0 — Rozhodnutí a základy (start okamžitě)" }, { "line": 296, "id": "WP0.4", "title": "Nezávislá protistrana", "owner": "—", "note": "`sanjbox-counterpart`: TCP/UDP listener, log událostí, raw záchyt, kanárky vč. DNS labelů, `report` (neúplný běh = neplatné měření); 7 testů + 2 v sadě sond. ICMP a TLS obsah mimo rozsah (pcap na hostu)", "state": "done", "phase": "F0", "deliverable": "`spikes/common` (`sanjbox-counterpart`): listener na řízeném hostu, který nezávisle zaznamenává přijaté kanárky/bajty (pro S3, S5, S7)", "dependencies": "WP0.3 (formát)", "definition_line": 54, "stream": "F0 — Rozhodnutí a základy (start okamžitě)" }, { "line": 297, "id": "WP0.5", "title": "Metodika a laboratoř", "owner": "janfiedler / Codex + Astra", "note": "[LAB-v1](LAB.md): registr, sloty, předregistrace, návrhy prahů/statistik a šablony; neměnná historie běhů více autorů/strojů. Doplněn [M1 host protokol 3×5 s](evidence/s1/20261103T134131Z-janfiedler-LAB-janfiedler-01-r1-a8a26eeb/verdict.md). Čeká na P1–P6/F0.8; A2 vyžaduje další instrumentaci. S1 ani jiná brána tím neprošly. 2026-11-04: Codex/Astra dodal [read-only validátor publikovaných důkazů](../tools/lab_evidence/README.md) a syntetické testy bezpečného čtení, manifestů, odkazů a historie. Strukturální shoda není akceptace; metodika, historické běhy a F0.8 beze změny", "state": "active", "phase": "F0", "deliverable": "`docs/LAB.md`: registr testovacích strojů (model, čip, RAM, macOS + build, displeje, vlastník), minimální a referenční konfigurace, rezervace slotů per stroj, záloha před během, acceptance statistiky a délky testů (F0.8) zapsané **před** měřením", "dependencies": "WP0.1 (bod 8: minimální konfigurace a výkonové cíle)", "definition_line": 55, "stream": "F0 — Rozhodnutí a základy (start okamžitě)" }, { "line": 298, "id": "WP1.A1", "title": "S1 příprava", "owner": "—", "note": "`spikes/s1-session`: skripty s dry-runem a úklidem, sonda relace (credentials, displeje, Metal, offscreen render s ověřením, prezentace, RAM, Screen Recording), loopback forwarder místo SSH, WebGL stránka; 6 testů. Části s `--apply` (root) ověří až běh L1", "state": "done", "phase": "F1", "deliverable": "`spikes/s1-session/`: `create-users.sh` (3 skrytí uživatelé, `IsHidden`, skupina `sanjbox`, hesla do Klíčenky), `probe` (credentials, displeje, Metal, skutečný render, RAM), `observe.sh` (jen povolená metadata), `cleanup.sh`, README", "dependencies": "WP0.3", "definition_line": 68, "stream": "F1 — Spiky s branami" }, { "line": 299, "id": "WP1.A2", "title": "S1 běh (L1)", "owner": "janfiedler / Codex + Astra (navazující instrumentace)", "note": "Dodána [přípravná instrumentace](../spikes/s1-session/INSTRUMENTATION.md): presentation/RAM časové řady, přesné identity, fixed-window vyhodnocení a 17 fixture testů; [validace](../spikes/s1-session/VALIDATION.md): Release 23/23, CLI 25/25 a krátká host diagnostika. Navazující [doplněk](../spikes/s1-session/SUPPLEMENTARY.md): login markery, self-only procesní RAM, externí syntetický workload intake; native Release 43/43 + CLI 30/30 (2026-11-04), bez pozitivního živého nového collector běhu. A2/L1 zůstává rozpracované; automatické kalibrované login události, úplná procesní atribuce, skutečné aplikace/tři relace a další LAB důkazy chybí, bez verdiktu S1.", "state": "active", "phase": "F1", "deliverable": "Protokol + verdikt brány S1 v [spikes.md](spikes.md)", "dependencies": "WP1.A1, WP0.5", "definition_line": 69, "stream": "F1 — Spiky s branami" }, { "line": 300, "id": "WP1.A3", "title": "Průzkum RFB výběru relace", "owner": "janfiedler / Codex + Astra", "note": "Částečně: `spikes/s1-rfb` — primární zdroje k Apple auth/výběru relace, omezený offline Swift 6 RFB 3.8/Raw prototyp a mock testy. Apple auth, výběr relace a živý klient nejsou implementované/ověřené; zůstává uživatelská cesta Screen Sharing.app. Žádná změna bran.", "state": "active", "phase": "F1", "deliverable": "Poznámky k protokolu Apple auth + výběru relace; prototyp klienta, protože okno plochy oblasti je MVP displej (C-001) i fallback F0.6", "dependencies": "—", "definition_line": 70, "stream": "F1 — Spiky s branami" }, { "line": 301, "id": "WP1.A4", "title": "S0 příprava", "owner": "janfiedler / Codex + Astra", "note": "Částečná [s0-boundary](../spikes/s0-boundary/README.md): file/TCP/child fixtures, vlastní podpis a nově [skutečný embedded XPC service/client](../spikes/s0-boundary/XPC-FIXTURE.md) s OS cdhash a connection EUID/EGID/ASID; 46 Release XCTest + 12 runner regresí + 6 živých XPC případů a signed self-gate rejection (0 skips), nezávislý journal/exit/cleanup; zachovaný failure při cleanup chybě i raw diagnostika neplatného běhu. Peer auditUID/token nepodporované, TCC/capture a globální/cross-session důkazy chybí. Starší 36 testů/37 CLI výsledků zachované v VALIDATION; žádný S0/S8/akceptační verdict", "state": "active", "phase": "F1", "deliverable": "`spikes/s0-boundary/`: `xpc-probe`, `tcc-probe`, `capture-probe`, `host-read-probe`, `ingress-probe`, `signing-probe`, `lifecycle-probe`", "dependencies": "WP0.3", "definition_line": 71, "stream": "F1 — Spiky s branami" }, { "line": 302, "id": "WP1.A5", "title": "S0 běh (L2)", "owner": "uživatel + impl.", "note": "", "state": "todo", "phase": "F1", "deliverable": "Verdikt S0 mapovaný na R2/R3", "dependencies": "WP1.A2 (pass), WP1.A4", "definition_line": 72, "stream": "F1 — Spiky s branami" }, { "line": 303, "id": "WP1.A6", "title": "S8 příprava", "owner": "janfiedler / Codex + Astra", "note": "[Pokračování 2026-11-04](../spikes/s8-signing/SERVICES.md): compiled disposable app + tři service targets, typované user UI, bounded common-identity markers a conflict-refusing cleanup; Release 42 testů + 15 Python boundary testů, pouze statická/ad-hoc validace. Daemon mutace a cleanup přes restart UI/login/reboot jsou záměrně nedostupné bez host-only/provenance konstrukce; Personal Team/self-signed, attach oracle a skutečný XPC fuzzer (Contracts/Broker neexistují) chybějí. [Historie 2026-11-03](../spikes/s8-signing/VALIDATION.md): původní 28 testů, static fixtures/mock fuzzer/šest plánů zachovány. S8 a SG-01…11 Neověřeno", "state": "active", "phase": "F1", "deliverable": "`spikes/s8-signing/`: kontrola hardened runtime a absence `get-task-allow`, SMAppService s Personal Team, self-signed varianta, same-UID attach test, fuzzer XPC brokeru", "dependencies": "WP0.3", "definition_line": 73, "stream": "F1 — Spiky s branami" }, { "line": 304, "id": "WP1.A7", "title": "S8 běh (L2)", "owner": "uživatel + impl.", "note": "", "state": "todo", "phase": "F1", "deliverable": "Verdikt S8", "dependencies": "WP1.A2 (pass), WP1.A6", "definition_line": 74, "stream": "F1 — Spiky s branami" }, { "line": 305, "id": "WP1.B1", "title": "Audit hosta", "owner": "janfiedler / Codex + Astra", "note": "[metadata audit](../spikes/s4-host/README.md); 17 syntetických testů, S4/R2/R7 Neověřeno", "state": "done", "phase": "F1", "deliverable": "`spikes/s4-host/audit-host.sh`: kořeny, práva/ACL, sockety, mounty; report rozlišuje pokrytí, nepokryté cesty a drift", "dependencies": "WP0.3", "definition_line": 80, "stream": "F1 — Spiky s branami" }, { "line": 306, "id": "WP1.B2", "title": "Zpevnění a uninstall", "owner": "janfiedler / Codex + Astra", "note": "[Částečný mode-only hardening/uninstall](../spikes/s4-host/HARDENING.md): dry-run, trvalý before/after deník, konflikty a syntetické testy; ACL hardening, host kompatibilita, poslední TOCTOU mezera a S4/RB-09/10 Neověřeno", "state": "active", "phase": "F1", "deliverable": "`harden-host.sh` (dry-run, záznam původního a nastaveného stavu), `uninstall.sh` (vrací jen vlastní nezměněné zásahy)", "dependencies": "WP1.B1", "definition_line": 81, "stream": "F1 — Spiky s branami" }, { "line": 307, "id": "WP1.B3", "title": "Manifest a topologie", "owner": "janfiedler / Codex + Astra", "note": "[návrhový manifest a validátor](../spikes/s4-state/README.md); 21 syntetických testů, skutečná topologie/kvóty/rollback a S4 Neověřeno", "state": "done", "phase": "F1", "deliverable": "Manifest zápisových kořenů (home, projekt, prefix, cache, TMP, později runtime), APFS topologie, mountpointy, kvóty", "dependencies": "WP0.3", "definition_line": 82, "stream": "F1 — Spiky s branami" }, { "line": 308, "id": "WP1.B4", "title": "Snapshot/rollback prototyp", "owner": "janfiedler / Codex + Astra", "note": "Částečně: [recovery protokol a file-backed mock](../spikes/s4-state/RECOVERY.md), durable deník, deny-start, 31 subprocess crash bodů; [42 Release testů včetně flush-error recovery](../spikes/s4-state/VALIDATION-B4.md). Native APFS a whole-UID lifecycle adaptér chybí; S4/RB-02…08 Neověřeno", "state": "active", "phase": "F1", "deliverable": "Postup snapshot → zapisovatelný obnovený stav → přepnutí, hostem vlastněný recovery záznam, testy pádu v každém kroku", "dependencies": "WP1.B3", "definition_line": 83, "stream": "F1 — Spiky s branami" }, { "line": 309, "id": "WP1.B5", "title": "S4 běh (L3)", "owner": "uživatel + impl.", "note": "", "state": "todo", "phase": "F1", "deliverable": "Verdikt S4 vč. průběžné ochrany, nových mountů, rollbacku a uninstallu", "dependencies": "WP1.A5 (pass), WP1.B2, WP1.B4", "definition_line": 84, "stream": "F1 — Spiky s branami" }, { "line": 310, "id": "WP1.C1", "title": "S3 příprava", "owner": "janfiedler / Codex + Astra", "note": "[Příprava, mock testy; S3/S3b neověřeno](../spikes/s3-pf/README.md)", "state": "done", "phase": "F1", "deliverable": "`spikes/s3-pf/`: šablona anchoru, `load.sh`/`unload.sh`, testy pod UID oblasti, scénáře failure modes (flush, `pfctl -F all`, disable, pád helperu/brány, sleep/wake, VPN, staré states)", "dependencies": "WP0.3, WP0.4", "definition_line": 90, "stream": "F1 — Spiky s branami" }, { "line": 311, "id": "WP1.C2", "title": "Ochrana nezávislá na pf", "owner": "janfiedler / Codex + Astra", "note": "[Rešerše a návrh](../spikes/s3-pf/research/wp1-c2-pf-independent/README.md): primární zdroje, připnuté OSS/SDK podklady, 12 návrhů L4 experimentů; úplný mechanismus nedoložen, blokátor otevřený. Bez runtime testů; S3/NET/R3 zůstávají Neověřeno", "state": "done", "phase": "F1", "deliverable": "Rešerše a návrh mechanismu, který při ztrátě rulesetu nepustí zakázaná data; pokud neexistuje, zapsat blokátor (ne polling)", "dependencies": "—", "definition_line": 91, "stream": "F1 — Spiky s branami" }, { "line": 312, "id": "WP1.C3", "title": "S3b příprava", "owner": "janfiedler / Codex + Astra", "note": "[Dílčí offline C1/common raw adapter](../spikes/s3-pf/ingress/ADAPTER.md): skutečný C1 object stream/common JSONL, exact dostupné tuple/canary/context/time vazby, explicitní producer mezery, oddělený packet import a zachované zero-byte findings. [Ověření](../spikes/s3-pf/ingress/VALIDATION.md): po review 50/50 release testů a 25/25 offline CLI kontrol (obousměrné one-to-one reconciliation); předchozí 44/44 + 17/17 a historických 21/21 fixtures a 24/24 nezávislých CLI zachováno. Bounded vlastní loopback smoke/matice 28 scénářů zůstává. C3 partial: producer nonce/identity/capture, bind policy a skutečný L4 zbývají; S3b/NET-10…12 Neověřeno.", "state": "active", "phase": "F1", "deliverable": "Ingress scénáře: wildcard listenery IPv4/IPv6, host/LAN/jiná oblast, port squatting, pozitivní same-zone server; návrh bind policy", "dependencies": "WP1.C1", "definition_line": 92, "stream": "F1 — Spiky s branami" }, { "line": 313, "id": "WP1.C4", "title": "S3/S3b běh (L4)", "owner": "uživatel + impl.", "note": "", "state": "todo", "phase": "F1", "deliverable": "Verdikt S3 a S3b s bajty na protistraně", "dependencies": "WP1.A2 (testovací uživatelé), WP1.C1, WP1.C3", "definition_line": 93, "stream": "F1 — Spiky s branami" }, { "line": 314, "id": "WP1.D1", "title": "Jádro brány", "owner": "janfiedler / Codex", "note": "`spikes/s5-gateway`: HTTP/1.1 + SSE, typed router, systémové DNS/interface snapshot, SSRF policy a připnutý TLS upstream; 45 unit/mock/lokálních testů; kontrakt pro D2/D3/D4 a limity v README. S5 zůstává Neověřeno", "state": "done", "phase": "F1", "deliverable": "`spikes/s5-gateway/`: Swift, Network.framework, bez závislostí; HTTP/1.1 + SSE, směrování typed endpointů, SSRF filtr (loopback, RFC1918, link-local, ULA, multicast, `100.64/10`, IP literál, ECH, non-TLS policy)", "dependencies": "WP0.3", "definition_line": 99, "stream": "F1 — Spiky s branami" }, { "line": 315, "id": "WP1.D2", "title": "npm typed", "owner": "janfiedler / Codex + Astra", "note": "`spikes/s5-gateway`: filtrované packumenty, přímé/scoped tarbally, čerstvá autorizace cache/redirectů, silné SRI a bounded audit transportu; 18 nových testů, celkem 63 debug prošlo bez skips včetně lokálního fixture `npm pack`; podmnožina a limity v NPM.md. Bez živých instalací; S5 zůstává Neověřeno", "state": "done", "phase": "F1", "deliverable": "Cooldown na úrovni artefaktu (packument i tarball, publish-time, hash, původ, cache, redirect), `PUT`/`DELETE` → 403, cizí `Authorization`, audit stažení", "dependencies": "WP1.D1", "definition_line": 100, "stream": "F1 — Spiky s branami" }, { "line": 316, "id": "WP1.D3", "title": "API modelů", "owner": "janfiedler / Codex + Astra", "note": "`spikes/s5-gateway`: úzký Anthropic text-SSE, pouze syntetický trusted klíč, rate/konečný lokální budget, bounded audit, lazy single-use producer, backpressure/cancellation a HTTPS s oddělenou test CA; 16 nových testů, celkem 61 debug prošlo bez skips. MODEL-API.md vymezuje podmnožinu; F0.7/SDK/live billing neověřené, S5 zůstává Neověřeno", "state": "done", "phase": "F1", "deliverable": "Vkládání klíče, SSE, odmítnutí cizího klíče, rate/budget; mock upstream s testovacím klíčem; per-zone CA pro SDK vyžadující HTTPS", "dependencies": "WP1.D1", "definition_line": 101, "stream": "F1 — Spiky s branami" }, { "line": 317, "id": "WP1.D4", "title": "Fixtures a mocky", "owner": "janfiedler / Codex + Astra", "note": "`spikes/s5-fixtures`: 8 syntetických artefaktů, 40 scénářů vydání, 15 OAuth mocků, 6 redirect fixtures; veřejné D1 API a 33 testů (včetně 3 opt-in skutečných npm testů). D2/D3 adaptéry a S5 integrace neověřené; žádný verdikt brány.", "state": "done", "phase": "F1", "deliverable": "Verze před/po hranici cooldownu, scoped packages, neznámé datum, lockfile/`npm ci`, redirect, DNS rebinding, mocky OAuth scopes", "dependencies": "WP1.D1", "definition_line": 102, "stream": "F1 — Spiky s branami" }, { "line": 318, "id": "WP1.D5", "title": "PyPI, Homebrew, git", "owner": "janfiedler / Codex + Astra", "note": "[Částečný typed prototyp](../spikes/s5-gateway/TYPED-REGISTRIES.md): PyPI per-file upload-time/hash/cooldown a audit, Git smart HTTP v0 jen projekt, Homebrew bez publication-time vždy odmítne. [Release 101/101](../spikes/s5-gateway/VALIDATION-D5.md), 0 skips; lokální pip download a git clone/push, opraven zděděný deadline race. Brew cooldown nesplněný, live/F0.7/D7 a S5/S6/GW zůstávají Neověřeno.", "state": "active", "phase": "F1", "deliverable": "PyPI simple index + `upload-time`; brew API/bottle domény; git smart HTTP **nebo** per-repo deploy key (rozhodnutí v balíku)", "dependencies": "WP1.D2", "definition_line": 103, "stream": "F1 — Spiky s branami" }, { "line": 319, "id": "WP1.D6", "title": "Matice kompatibility", "owner": "Codex / Astra", "note": "[Offline matice 50 řádků](../spikes/s5-compatibility/README.md): 25 klient/protokol podmnožin × typed/passthrough, 52 zdrojů, baseline oddělený od návrhu D5. 9 testů včetně 28 negativních fixtures; žádný klient/SDK spuštěn D6. Zděděná lokální pozorování nejsou živá integrace; S5/GW-19/R8 Neověřeno", "state": "done", "phase": "F1", "deliverable": "Matice nástroj × protokol × policy (npm, pnpm, yarn, bun, pip, uv, brew, git, Cargo, Go, Gradle/Maven, NuGet, Conda, RubyGems, SDK, OpenCode, Claude Code, Codex, WebSocket/SSE); nepodporované = nepodporované", "dependencies": "WP1.D2", "definition_line": 104, "stream": "F1 — Spiky s branami" }, { "line": 320, "id": "WP1.D7", "title": "S5 integrace (L5)", "owner": "uživatel + impl.", "note": "", "state": "todo", "phase": "F1", "deliverable": "Brána přes pf cestu z oblasti, režie ≤ 1,1× dle metodiky, verdikt S5", "dependencies": "WP1.C4 (pass), WP1.D2–D6", "definition_line": 105, "stream": "F1 — Spiky s branami" }, { "line": 321, "id": "WP1.E1", "title": "S6 příprava", "owner": "janfiedler / Codex + Astra", "note": "`spikes/s6-brew`: pinned top 200 + vzorek 20 testů, offline plán instalací/casků, receipt report, unknown-publication refusal, dry-run prefix scaffold a konzervativní úklid; 46 native Python tests. Příprava hotová, E2 měření neprovedeno; HB-01…07/S6 zůstávají Neověřeno. Viz [VALIDATION](../spikes/s6-brew/VALIDATION.md).", "state": "done", "phase": "F1", "deliverable": "`spikes/s6-brew/`: instalační skript prefixu `/opt/snj/t001` (spouští uživatel), seznam top 200 formulí, sběr poměru bottle/kompilace, vzorek `brew test`, casky do `~/Applications`, ověření dat publikace pro cooldown", "dependencies": "WP1.B3", "definition_line": 111, "stream": "F1 — Spiky s branami" }, { "line": 322, "id": "WP1.E2", "title": "S6 běh (L6)", "owner": "uživatel + impl.", "note": "", "state": "todo", "phase": "F1", "deliverable": "Verdikt S6 (stahování schvaluje uživatel konkrétním příkazem)", "dependencies": "WP1.B5 (pass), WP1.E1", "definition_line": 112, "stream": "F1 — Spiky s branami" }, { "line": 323, "id": "WP1.F1", "title": "S2-A výzkumný prototyp", "owner": "", "note": "TCC grant od uživatele", "state": "todo", "phase": "F1", "deliverable": "Ve tvé relaci, bez rootu, jen syntetická okna (TextEdit apod.): ScreenCaptureKit → samostatná proxy okna přes IOSurface, vstup, menu přes AX; více oken, překryvy, skrytá okna, resize, vazba popupů", "dependencies": "WP0.3", "definition_line": 121, "stream": "F1 — Spiky s branami" }, { "line": 324, "id": "WP1.F2", "title": "S2-B (L7)", "owner": "uživatel + impl.", "note": "", "state": "todo", "phase": "F1", "deliverable": "Agent v relaci, IOSurface přes Mach port brokerem, měření tří souběžných oblastí, input-to-photon, supported subset", "dependencies": "WP1.A5, WP1.A7 (pass), WP1.F1", "definition_line": 122, "stream": "F1 — Spiky s branami" }, { "line": 325, "id": "WP1.G1", "title": "Rešerše Docker runtime", "owner": "Codex / Astra", "note": "[Připnutá rešerše runtime](../spikes/s7-docker/research/wp1-g1-runtime/README.md), manifest primárních zdrojů a G2/L8 plán DK-01…10; žádný stock kandidát neprokazuje celý kontrakt. Bez runtime měření; S7/DK Neověřeno, F0.8 budget otevřený, mimo MVP (C-002)", "state": "done", "phase": "F1", "deliverable": "Apple `container` vs. Colima/Lima s instancí per oblast vs. vlastní mikro-jádro; budget start/stop (rozhodnutí F0.8 před S7)", "dependencies": "WP0.1", "definition_line": 130, "stream": "F1 — Spiky s branami" }, { "line": 326, "id": "WP1.G2", "title": "S7 příprava", "owner": "janfiedler / Codex + Astra", "note": "[Částečná offline příprava](../spikes/s7-docker/README.md): bounded manifest/planner, 64 scénářů × 3 oblasti, syntetické oracle, registry/toy-frame mocky a vlastní fixture cleanup; 63 native Python tests. Runtime/VM/Engine/bridge a S5 integrace chybí; F0.8 otevřeno, S7/DK-01…10 Neověřeno, Docker mimo MVP. [Validace](../spikes/s7-docker/VALIDATION.md).", "state": "active", "phase": "F1", "deliverable": "`spikes/s7-docker/`: testy `run`/`build`, `-v /:/host`, změna mount konfigurace z oblasti, socket, síť přes bránu, registry auth, published ports, vsock, failure modes", "dependencies": "WP1.G1, WP1.D1", "definition_line": 131, "stream": "F1 — Spiky s branami" }, { "line": 327, "id": "WP1.G3", "title": "S7 běh (L8)", "owner": "uživatel + impl.", "note": "", "state": "todo", "phase": "F1", "deliverable": "Verdikt S7", "dependencies": "WP1.D7 (pass), WP1.G2", "definition_line": 132, "stream": "F1 — Spiky s branami" }, { "line": 328, "id": "WP2.0", "title": "Kontrakty", "owner": "", "note": "čeká na vstup F2", "state": "todo", "phase": "F2", "deliverable": "`Contracts/`: XPC schéma helperu a brokeru (pevné, úzké), stavový automat oblasti (vytvořeno → zapínání → běží → pauza → vypínání → vypnuto → úklid), formát politiky sítě a bran, manifest stavu, formát audit logu", "dependencies": "brána F2", "definition_line": 147, "stream": "F2 — Jádro (po bráně vstupu do F2)" }, { "line": 329, "id": "WP2.1", "title": "Helper", "owner": "", "note": "", "state": "todo", "phase": "F2", "deliverable": "`Helper/`: uživatelé, APFS svazky, ACL, pf anchory, NATLOOK, autentizace klientů (audit token, podpis, session)", "dependencies": "WP2.0", "definition_line": 148, "stream": "F2 — Jádro (po bráně vstupu do F2)" }, { "line": 330, "id": "WP2.2", "title": "Životní cyklus", "owner": "", "note": "", "state": "todo", "phase": "F2", "deliverable": "Zapnutí (ochrany před loginem), bezpečná pauza celého UID, vypnutí (nula procesů, neúspěšný restart), crash recovery, zákaz reuse UID před úklidem", "dependencies": "WP2.0", "definition_line": 149, "stream": "F2 — Jádro (po bráně vstupu do F2)" }, { "line": 331, "id": "WP2.3", "title": "Stav a rollback", "owner": "", "note": "", "state": "todo", "phase": "F2", "deliverable": "Manifest, snapshot, obnova s recovery záznamem, rollback oblasti vs. rollback projektu", "dependencies": "WP2.0", "definition_line": 150, "stream": "F2 — Jádro (po bráně vstupu do F2)" }, { "line": 332, "id": "WP2.4", "title": "Síť", "owner": "", "note": "", "state": "todo", "phase": "F2", "deliverable": "pf anchory, resolver, brána, hlídač (detektor), změna politiky a obnova (staré states, tunely), ochrana nezávislá na pf dle S3", "dependencies": "WP2.0", "definition_line": 151, "stream": "F2 — Jádro (po bráně vstupu do F2)" }, { "line": 333, "id": "WP2.5", "title": "Typované brány", "owner": "", "note": "", "state": "todo", "phase": "F2", "deliverable": "Produkční npm/PyPI/brew/git/API modelů, vkládání klíčů z Klíčenky, schvalování svázané s oblastí a operací", "dependencies": "WP2.0, WP2.4 (rozhraní)", "definition_line": 152, "stream": "F2 — Jádro (po bráně vstupu do F2)" }, { "line": 334, "id": "WP2.6", "title": "Sanjbox.app", "owner": "", "note": "", "state": "todo", "phase": "F2", "deliverable": "`Sanjbox/`: menu bar, schvalování s Touch ID, průvodce zpevněním, audit driftu, uninstall", "dependencies": "WP2.0", "definition_line": 153, "stream": "F2 — Jádro (po bráně vstupu do F2)" }, { "line": 335, "id": "WP2.7", "title": "CLI", "owner": "", "note": "", "state": "todo", "phase": "F2", "deliverable": "`shell`, `run`, `pause`, `snapshot`, `rollback` přes XPC", "dependencies": "WP2.0", "definition_line": 154, "stream": "F2 — Jádro (po bráně vstupu do F2)" }, { "line": 336, "id": "WP2.8", "title": "Únikový test suite", "owner": "", "note": "", "state": "todo", "phase": "F2", "deliverable": "`Tests/Escape/`: automatizace kapitol 1–4 a 7–11 z PLAN §Verifikace, běh ve třech souběžných oblastech", "dependencies": "WP2.0", "definition_line": 155, "stream": "F2 — Jádro (po bráně vstupu do F2)" }, { "line": 337, "id": "WP2.10", "title": "Okno plochy oblasti (MVP displej)", "owner": "", "note": "C-001", "state": "todo", "phase": "F2", "deliverable": "Okno s plochou relace oblasti (vlastní RFB klient z WP1.A3, záloha Screen Sharing.app), jednoznačně označené oblastí; schránka jen řízeným mostem (preview + potvrzení), žádná automatická synchronizace", "dependencies": "WP2.0, WP1.A3", "definition_line": 156, "stream": "F2 — Jádro (po bráně vstupu do F2)" }, { "line": 338, "id": "WP2.11", "title": "Řízený export", "owner": "", "note": "F0.3", "state": "todo", "phase": "F2", "deliverable": "Jediná cesta dat z oblasti na host (F0.3): výběr souborů, preview, karanténa (`com.apple.quarantine`), audit; host nemá ACL ke svazku oblasti", "dependencies": "WP2.0, WP2.3", "definition_line": 157, "stream": "F2 — Jádro (po bráně vstupu do F2)" }, { "line": 339, "id": "WP2.9", "title": "Integrace a brána F2 (MVP)", "owner": "", "note": "", "state": "todo", "phase": "F2", "deliverable": "Sestavení, běh test suite, verdikt MVP v rozsahu C-001/C-002", "dependencies": "2.1–2.8, 2.10, 2.11", "definition_line": 158, "stream": "F2 — Jádro (po bráně vstupu do F2)" }, { "line": 340, "id": "WP3.1", "title": "Agent relace", "owner": "", "note": "", "state": "todo", "phase": "F3", "deliverable": "`SessionAgent/`: capture oken, AX menu, vstup, hlášení procesů a portů; hardened runtime, bez `get-task-allow`", "dependencies": "WP2.0, S2", "definition_line": 164, "stream": "F3 — Coherence (po F2 a S2)" }, { "line": 341, "id": "WP3.2", "title": "Broker", "owner": "", "note": "", "state": "todo", "phase": "F3", "deliverable": "`Broker/`: Mach port IOSurface, autentizace, fuzzing", "dependencies": "WP2.0", "definition_line": 165, "stream": "F3 — Coherence (po F2 a S2)" }, { "line": 342, "id": "WP3.3", "title": "Proxy appky v Docku", "owner": "", "note": "", "state": "todo", "phase": "F3", "deliverable": "Bundle per appka a oblast s odznakem, okna, zrcadlení menu do menu baru", "dependencies": "WP3.1, WP3.2 (rozhraní)", "definition_line": 166, "stream": "F3 — Coherence (po F2 a S2)" }, { "line": 343, "id": "WP3.4", "title": "Most schránky", "owner": "", "note": "", "state": "todo", "phase": "F3", "deliverable": "Preview + potvrzení, karanténa, žádná automatická synchronizace", "dependencies": "WP3.1", "definition_line": 167, "stream": "F3 — Coherence (po F2 a S2)" }, { "line": 344, "id": "WP3.5", "title": "Rozšířené interakce", "owner": "", "note": "", "state": "todo", "phase": "F3", "deliverable": "Samostatné návrhy: notifikace, file open/save, drag & drop, secure input, tisk, audio", "dependencies": "WP3.1", "definition_line": 168, "stream": "F3 — Coherence (po F2 a S2)" }, { "line": 345, "id": "WP3.6", "title": "Brána F3", "owner": "", "note": "", "state": "todo", "phase": "F3", "deliverable": "Escape kapitoly 2 a 8, výkon dle design card, tři instance stejné appky", "dependencies": "3.1–3.5", "definition_line": 169, "stream": "F3 — Coherence (po F2 a S2)" }, { "line": 346, "id": "WP4.1", "title": "Docker runtime", "owner": "", "note": "", "state": "todo", "phase": "F4", "deliverable": "`Docker/` dle verdiktu S7", "dependencies": "S7, WP2.4", "definition_line": 175, "stream": "F4 — Docker, zařízení, git (po F2/F3)" }, { "line": 347, "id": "WP4.2", "title": "Zařízení", "owner": "", "note": "", "state": "todo", "phase": "F4", "deliverable": "iOS (usbmuxd) a Android (adb, vlastní port per oblast) jen s výslovným oprávněním oblasti", "dependencies": "WP2.1", "definition_line": 176, "stream": "F4 — Docker, zařízení, git (po F2/F3)" }, { "line": 348, "id": "WP4.3", "title": "Git identita", "owner": "", "note": "", "state": "todo", "phase": "F4", "deliverable": "Per-repo deploy key v oblasti, nebo SE klíč držený bránou (dle WP1.D5)", "dependencies": "WP2.5", "definition_line": 177, "stream": "F4 — Docker, zařízení, git (po F2/F3)" }, { "line": 349, "id": "WP4.4", "title": "Brána F4", "owner": "", "note": "", "state": "todo", "phase": "F4", "deliverable": "Escape kapitola 5, pozitivní testy kapitoly 6", "dependencies": "4.1–4.3", "definition_line": 178, "stream": "F4 — Docker, zařízení, git (po F2/F3)" } ], "requirements": [ { "line": 43, "id": "R1", "title": "X oblastí, agenti, nástroje, Xcode, Android, Docker", "dependencies": "S1, S6, S7, F2", "state": "unverified", "note": "Neověřeno" }, { "line": 44, "id": "R2", "title": "Žádný přístup k host datům, identitě, jiným oblastem; nepřežije vypnutí", "dependencies": "S0, S4, S8, F2", "state": "unverified", "note": "Neověřeno; blokátory otevřené" }, { "line": 45, "id": "R3", "title": "Žádný nekontrolovaný únik do sítě", "dependencies": "S3, S3b, S5, F2", "state": "unverified", "note": "Neověřeno; blokátory otevřené" }, { "line": 46, "id": "R4", "title": "Docker bez únikové cesty", "dependencies": "S7, F4", "state": "unverified", "note": "Neověřeno; mimo MVP (C-002)" }, { "line": 47, "id": "R5", "title": "Nativní výkon, bez desktopové VM, rychlé zapnutí/vypnutí", "dependencies": "S1, S2, F2", "state": "unverified", "note": "Neověřeno" }, { "line": 48, "id": "R6", "title": "Jednotlivá okna v Docku, rozlišitelná oblast", "dependencies": "S2, F3", "state": "unverified", "note": "Neověřeno; mimo MVP (C-001), MVP: POS-08" }, { "line": 49, "id": "R7", "title": "Práce s projektem, řízený import, testování, obnova", "dependencies": "S4, F2", "state": "unverified", "note": "Neověřeno" }, { "line": 50, "id": "R8", "title": "Agnostičnost bez bezpečnostního bypassu", "dependencies": "S5, S6", "state": "unverified", "note": "Neověřeno" } ], "gates": [ { "line": 57, "id": "S1", "title": "Neviditelné relace", "dependencies": "F0, WP0.3", "state": "unverified", "evidence": "—" }, { "line": 58, "id": "S0", "title": "Hranice a attack surface", "dependencies": "S1", "state": "unverified", "evidence": "—" }, { "line": 59, "id": "S8", "title": "Signing, TCC, broker", "dependencies": "S1", "state": "unverified", "evidence": "—" }, { "line": 60, "id": "S4", "title": "Zpevnění, mounty, rollback", "dependencies": "S0", "state": "unverified", "evidence": "—" }, { "line": 61, "id": "S3", "title": "pf a failure modes", "dependencies": "S0", "state": "unverified", "evidence": "—" }, { "line": 62, "id": "S3b", "title": "Ingress a loopback", "dependencies": "S0", "state": "unverified", "evidence": "—" }, { "line": 63, "id": "S5", "title": "Typované brány", "dependencies": "S3 (integrace)", "state": "unverified", "evidence": "—" }, { "line": 64, "id": "S6", "title": "Homebrew per oblast", "dependencies": "S4", "state": "unverified", "evidence": "—" }, { "line": 65, "id": "S2", "title": "Coherence (mimo MVP, C-001)", "dependencies": "S0, S8", "state": "unverified", "evidence": "—" }, { "line": 66, "id": "S7", "title": "Docker (mimo MVP, C-002)", "dependencies": "S5, budget F0.8", "state": "unverified", "evidence": "—" }, { "line": 67, "id": "Vstup F2", "title": "S0, S1, S3, S3b, S4, S5, S6, S8 prošly", "dependencies": "—", "state": "unverified", "evidence": "—" }, { "line": 68, "id": "F2", "title": "Jádro = MVP v rozsahu C-001/C-002", "dependencies": "Vstup F2", "state": "unverified", "evidence": "—" }, { "line": 69, "id": "F3", "title": "Coherence produkčně", "dependencies": "F2, S2", "state": "unverified", "evidence": "—" }, { "line": 70, "id": "F4", "title": "Docker, zařízení, git", "dependencies": "F3, S7", "state": "unverified", "evidence": "—" } ], "tests": [ { "line": 81, "id": "GUI-01", "title": "Relace oblasti vznikne souběžně s host konzolí (ne fast user switching)", "requirements": "R1, R5", "gates": "S1", "state": "unverified", "evidence": "", "group": "3.1 GUI — relace a Coherence (S1, S2)" }, { "line": 82, "id": "GUI-02", "title": "Relace přežije 10 min bez klienta (bez keeperu / s keeperem zvlášť)", "requirements": "R1", "gates": "S1", "state": "unverified", "evidence": "", "group": "3.1 GUI — relace a Coherence (S1, S2)" }, { "line": 83, "id": "GUI-03", "title": "Tři relace současně vedle funkční host konzole", "requirements": "R1", "gates": "S1", "state": "unverified", "evidence": "", "group": "3.1 GUI — relace a Coherence (S1, S2)" }, { "line": 84, "id": "GUI-04", "title": "Ověření limitu High Performance Screen Sharing; tři relace bez spoléhání na HP", "requirements": "R1", "gates": "S1", "state": "unverified", "evidence": "", "group": "3.1 GUI — relace a Coherence (S1, S2)" }, { "line": 85, "id": "GUI-05", "title": "Skutečně akcelerované renderování v každé relaci (ne jen výčet Metal zařízení)", "requirements": "R1, R5", "gates": "S1", "state": "unverified", "evidence": "", "group": "3.1 GUI — relace a Coherence (S1, S2)" }, { "line": 86, "id": "GUI-06", "title": "Xcode + Simulator v relaci; CoreSimulatorService pod UID oblasti", "requirements": "R1", "gates": "S1", "state": "unverified", "evidence": "", "group": "3.1 GUI — relace a Coherence (S1, S2)" }, { "line": 87, "id": "GUI-07", "title": "Android Studio + emulátor v relaci", "requirements": "R1", "gates": "S1", "state": "unverified", "evidence": "", "group": "3.1 GUI — relace a Coherence (S1, S2)" }, { "line": 88, "id": "GUI-08", "title": "Electron appka v relaci", "requirements": "R1", "gates": "S1", "state": "unverified", "evidence": "", "group": "3.1 GUI — relace a Coherence (S1, S2)" }, { "line": 89, "id": "GUI-09", "title": "Safari v relaci", "requirements": "R1", "gates": "S1", "state": "unverified", "evidence": "", "group": "3.1 GUI — relace a Coherence (S1, S2)" }, { "line": 90, "id": "GUI-10", "title": "TCC prompt viditelný a potvrditelný; granty přetrvají po odpojení klienta", "requirements": "R1, R6", "gates": "S1", "state": "unverified", "evidence": "", "group": "3.1 GUI — relace a Coherence (S1, S2)" }, { "line": 91, "id": "GUI-11", "title": "UID/GID, skupiny a session sond odpovídají očekávání ve všech měřeních", "requirements": "R2", "gates": "S1", "state": "unverified", "evidence": "", "group": "3.1 GUI — relace a Coherence (S1, S2)" }, { "line": 92, "id": "GUI-12", "title": "Čas přihlášení cold/warm, RAM na relaci proti cílům design card", "requirements": "R5", "gates": "S1", "state": "unverified", "evidence": "", "group": "3.1 GUI — relace a Coherence (S1, S2)" }, { "line": 93, "id": "GUI-13", "title": "Keeper (pokud je nutný): režie, souběh, chování po pádu klienta", "requirements": "R1", "gates": "S1", "state": "unverified", "evidence": "", "group": "3.1 GUI — relace a Coherence (S1, S2)" }, { "line": 94, "id": "GUI-14", "title": "Samostatná proxy okna: více oken, překryvy, skrytá okna, přesun, resize", "requirements": "R6", "gates": "S2", "state": "unverified", "evidence": "", "group": "3.1 GUI — relace a Coherence (S1, S2)" }, { "line": 95, "id": "GUI-15", "title": "Menu a popovery navázané na správné okno", "requirements": "R6", "gates": "S2", "state": "unverified", "evidence": "", "group": "3.1 GUI — relace a Coherence (S1, S2)" }, { "line": 96, "id": "GUI-16", "title": "IME a routing klávesových zkratek", "requirements": "R6", "gates": "S2", "state": "unverified", "evidence": "", "group": "3.1 GUI — relace a Coherence (S1, S2)" }, { "line": 97, "id": "GUI-17", "title": "Input-to-photon 30–50 ms při 60 fps ve třech souběžných oblastech", "requirements": "R5, R6", "gates": "S2", "state": "unverified", "evidence": "", "group": "3.1 GUI — relace a Coherence (S1, S2)" }, { "line": 98, "id": "GUI-18", "title": "3× stejná appka ze 3 oblastí jako 3 položky v Docku s odznakem", "requirements": "R6", "gates": "S2/F3", "state": "unverified", "evidence": "", "group": "3.1 GUI — relace a Coherence (S1, S2)" }, { "line": 99, "id": "GUI-19", "title": "Secure input (samostatný test, ne gate)", "requirements": "R6", "gates": "S2", "state": "unverified", "evidence": "", "group": "3.1 GUI — relace a Coherence (S1, S2)" }, { "line": 100, "id": "GUI-20", "title": "Notifikace (samostatný test, ne gate)", "requirements": "R6", "gates": "S2/F3", "state": "unverified", "evidence": "", "group": "3.1 GUI — relace a Coherence (S1, S2)" }, { "line": 101, "id": "GUI-21", "title": "File open/save dialogy (samostatný test, ne gate)", "requirements": "R6", "gates": "S2/F3", "state": "unverified", "evidence": "", "group": "3.1 GUI — relace a Coherence (S1, S2)" }, { "line": 102, "id": "GUI-22", "title": "Drag & drop (samostatný test, ne gate)", "requirements": "R6", "gates": "F3", "state": "unverified", "evidence": "", "group": "3.1 GUI — relace a Coherence (S1, S2)" }, { "line": 103, "id": "GUI-23", "title": "Tisk a audio (samostatný test, ne gate)", "requirements": "R6", "gates": "F3", "state": "unverified", "evidence": "", "group": "3.1 GUI — relace a Coherence (S1, S2)" }, { "line": 104, "id": "GUI-24", "title": "Retina a rozlišení podle host monitoru", "requirements": "R6", "gates": "S2", "state": "unverified", "evidence": "", "group": "3.1 GUI — relace a Coherence (S1, S2)" }, { "line": 110, "id": "FS-01", "title": "Kanárek v chráněném home nečitelný z oblasti", "requirements": "R2", "gates": "S0/S4", "state": "unverified", "evidence": "", "group": "3.2 FS — soubory (S0, S4)" }, { "line": 111, "id": "FS-02", "title": "Kanárek v pracovním kořeni (`~/Work` apod.) nečitelný", "requirements": "R2", "gates": "S0/S4", "state": "unverified", "evidence": "", "group": "3.2 FS — soubory (S0, S4)" }, { "line": 112, "id": "FS-03", "title": "Sdílené cesty (`/Users/Shared`, `/tmp`, `/Library/Caches`): kanárky a zákaz zápisu", "requirements": "R2", "gates": "S0/S4", "state": "unverified", "evidence": "", "group": "3.2 FS — soubory (S0, S4)" }, { "line": 113, "id": "FS-04", "title": "Testovací externí disk (APFS, exFAT/FAT) a Time Machine nedostupné, i odemčené", "requirements": "R2", "gates": "S4", "state": "unverified", "evidence": "", "group": "3.2 FS — soubory (S0, S4)" }, { "line": 114, "id": "FS-05", "title": "Kanárek v jiné oblasti nečitelný", "requirements": "R2", "gates": "S0", "state": "unverified", "evidence": "", "group": "3.2 FS — soubory (S0, S4)" }, { "line": 115, "id": "FS-06", "title": "Zákaz zápisu do host nástrojů a startup kořenů (`/opt/homebrew`, LaunchAgents, …)", "requirements": "R2", "gates": "S0/S4", "state": "unverified", "evidence": "", "group": "3.2 FS — soubory (S0, S4)" }, { "line": 116, "id": "FS-07", "title": "Hardlink na chráněný kanárek nejde vytvořit/zneužít", "requirements": "R2", "gates": "S0/S4", "state": "unverified", "evidence": "", "group": "3.2 FS — soubory (S0, S4)" }, { "line": 117, "id": "FS-08", "title": "Symlink zpracovaný helperem nevede mimo ověřený kořen", "requirements": "R2", "gates": "S4/S8", "state": "unverified", "evidence": "", "group": "3.2 FS — soubory (S0, S4)" }, { "line": 118, "id": "FS-09", "title": "Metadata služeb (`ps`, `mdfind`, `log show`, `netstat`, `system_profiler`/`ioreg`, `dscl`) nevydají testovací host data", "requirements": "R2", "gates": "S0", "state": "unverified", "evidence": "", "group": "3.2 FS — soubory (S0, S4)" }, { "line": 119, "id": "FS-10", "title": "Průběžná ochrana: vytvoření/přesun/obnova kanárku za běhu oblasti bez okna přístupu", "requirements": "R2, R7", "gates": "S4", "state": "unverified", "evidence": "", "group": "3.2 FS — soubory (S0, S4)" }, { "line": 120, "id": "FS-11", "title": "Nový install a nový/odemčený mount za běhu nezavedou přístupnou cestu", "requirements": "R2, R7", "gates": "S4", "state": "unverified", "evidence": "", "group": "3.2 FS — soubory (S0, S4)" }, { "line": 121, "id": "FS-12", "title": "Host nemá ACL ani jiný přímý přístup ke svazku oblasti; data ven jen exportem (F0.3)", "requirements": "R2, R7", "gates": "S4/F2", "state": "unverified", "evidence": "", "group": "3.2 FS — soubory (S0, S4)" }, { "line": 127, "id": "ID-01", "title": "Klíčenka: mock + oddělení login keychainu (uživatelský důkaz pro reálné oddělení)", "requirements": "R2", "gates": "S0", "state": "unverified", "evidence": "", "group": "3.3 ID — identita, IPC, TCC (S0)" }, { "line": 128, "id": "ID-02", "title": "Host schránka s kanárkem nečitelná", "requirements": "R2", "gates": "S0", "state": "unverified", "evidence": "", "group": "3.3 ID — identita, IPC, TCC (S0)" }, { "line": 129, "id": "ID-03", "title": "Host obrazovka s kanárkem: SCK a `CGWindowListCopyWindowInfo` cross-session", "requirements": "R2", "gates": "S0", "state": "unverified", "evidence": "", "group": "3.3 ID — identita, IPC, TCC (S0)" }, { "line": 130, "id": "ID-04", "title": "Události do host relace: `CGEventPostToPid`, `AXUIElementCreateSystemWide`", "requirements": "R2", "gates": "S0", "state": "unverified", "evidence": "", "group": "3.3 ID — identita, IPC, TCC (S0)" }, { "line": 131, "id": "ID-05", "title": "`ptrace` / attach na host procesy a agenta", "requirements": "R2", "gates": "S0/S8", "state": "unverified", "evidence": "", "group": "3.3 ID — identita, IPC, TCC (S0)" }, { "line": 132, "id": "ID-06", "title": "`open -a Terminal` spustí jen v relaci oblasti", "requirements": "R2", "gates": "S0", "state": "unverified", "evidence": "", "group": "3.3 ID — identita, IPC, TCC (S0)" }, { "line": 133, "id": "ID-07", "title": "Inventura globálních XPC/Mach služeb; žádná známá neoprávněná operace", "requirements": "R2", "gates": "S0", "state": "unverified", "evidence": "", "group": "3.3 ID — identita, IPC, TCC (S0)" }, { "line": 134, "id": "ID-08", "title": "TCC Accessibility a Screen Recording působí jen v relaci oblasti", "requirements": "R2", "gates": "S0", "state": "unverified", "evidence": "", "group": "3.3 ID — identita, IPC, TCC (S0)" }, { "line": 135, "id": "ID-09", "title": "TCC Input Monitoring, mikrofon, kamera, Bluetooth: test + politika", "requirements": "R2", "gates": "S0", "state": "unverified", "evidence": "", "group": "3.3 ID — identita, IPC, TCC (S0)" }, { "line": 136, "id": "ID-10", "title": "AppleEvents a notifikace směrem do host relace", "requirements": "R2", "gates": "S0", "state": "unverified", "evidence": "", "group": "3.3 ID — identita, IPC, TCC (S0)" }, { "line": 137, "id": "ID-11", "title": "Testovací agent/socket hosta (ssh-agent styl) nedostupný", "requirements": "R2", "gates": "S0", "state": "unverified", "evidence": "", "group": "3.3 ID — identita, IPC, TCC (S0)" }, { "line": 143, "id": "LC-01", "title": "LaunchAgent oblasti po vypnutí neběží", "requirements": "R2", "gates": "S0", "state": "unverified", "evidence": "", "group": "3.4 LC — životní cyklus a perzistence (S0, F2)" }, { "line": 144, "id": "LC-02", "title": "cron/at úlohy oblasti po vypnutí neběží (deny soubory s uživatelskými jmény)", "requirements": "R2", "gates": "S0", "state": "unverified", "evidence": "", "group": "3.4 LC — životní cyklus a perzistence (S0, F2)" }, { "line": 145, "id": "LC-03", "title": "Login item / SMAppService agent oblasti neobejde životní cyklus", "requirements": "R2", "gates": "S0/S8", "state": "unverified", "evidence": "", "group": "3.4 LC — životní cyklus a perzistence (S0, F2)" }, { "line": 146, "id": "LC-04", "title": "Job v `user/` doméně po vypnutí neběží", "requirements": "R2", "gates": "S0", "state": "unverified", "evidence": "", "group": "3.4 LC — životní cyklus a perzistence (S0, F2)" }, { "line": 147, "id": "LC-05", "title": "Odpojený CLI proces po vypnutí neběží; vypnuto = nula procesů UID", "requirements": "R2", "gates": "S0", "state": "unverified", "evidence": "", "group": "3.4 LC — životní cyklus a perzistence (S0, F2)" }, { "line": 148, "id": "LC-06", "title": "Start během vypínání i po něm neprojde", "requirements": "R2", "gates": "S0", "state": "unverified", "evidence": "", "group": "3.4 LC — životní cyklus a perzistence (S0, F2)" }, { "line": 149, "id": "LC-07", "title": "Fork/job race při pauze: stabilní quiescence celého UID", "requirements": "R2", "gates": "S0/S4", "state": "unverified", "evidence": "", "group": "3.4 LC — životní cyklus a perzistence (S0, F2)" }, { "line": 150, "id": "LC-08", "title": "Pád helperu/řídicí komponenty neobejde vypnutý stav", "requirements": "R2", "gates": "S0", "state": "unverified", "evidence": "", "group": "3.4 LC — životní cyklus a perzistence (S0, F2)" }, { "line": 151, "id": "LC-09", "title": "Přihlášení přes SSH/Screen Sharing do vypnuté oblasti neprojde", "requirements": "R2", "gates": "S0", "state": "unverified", "evidence": "", "group": "3.4 LC — životní cyklus a perzistence (S0, F2)" }, { "line": 152, "id": "LC-10", "title": "Privilegovaný LaunchDaemon nejde autorizovat z oblasti", "requirements": "R2", "gates": "S0/S8", "state": "unverified", "evidence": "", "group": "3.4 LC — životní cyklus a perzistence (S0, F2)" }, { "line": 153, "id": "LC-11", "title": "UID se nepřidělí znovu před dokončením úklidu", "requirements": "R2", "gates": "F2", "state": "unverified", "evidence": "", "group": "3.4 LC — životní cyklus a perzistence (S0, F2)" }, { "line": 159, "id": "NET-01", "title": "LAN cíl: nula bajtů na protistraně", "requirements": "R3", "gates": "S3", "state": "unverified", "evidence": "", "group": "3.5 NET — síť (S3, S3b)" }, { "line": 160, "id": "NET-02", "title": "Host localhost služba nedosažitelná", "requirements": "R2, R3", "gates": "S3", "state": "unverified", "evidence": "", "group": "3.5 NET — síť (S3, S3b)" }, { "line": 161, "id": "NET-03", "title": "Jiná oblast nedosažitelná", "requirements": "R2, R3", "gates": "S3", "state": "unverified", "evidence": "", "group": "3.5 NET — síť (S3, S3b)" }, { "line": 162, "id": "NET-04", "title": "Nepovolená doména", "requirements": "R3", "gates": "S3", "state": "unverified", "evidence": "", "group": "3.5 NET — síť (S3, S3b)" }, { "line": 163, "id": "NET-05", "title": "Raw IP / IP literál", "requirements": "R3", "gates": "S3", "state": "unverified", "evidence": "", "group": "3.5 NET — síť (S3, S3b)" }, { "line": 164, "id": "NET-06", "title": "SNI s cizí IP", "requirements": "R3", "gates": "S3", "state": "unverified", "evidence": "", "group": "3.5 NET — síť (S3, S3b)" }, { "line": 165, "id": "NET-07", "title": "Přímé TLS na vázanou doménu mimo bránu", "requirements": "R3", "gates": "S3", "state": "unverified", "evidence": "", "group": "3.5 NET — síť (S3, S3b)" }, { "line": 166, "id": "NET-08", "title": "`route-to` + `tag` → `rdr tagged`; tag přežije `lo0`", "requirements": "R3", "gates": "S3", "state": "unverified", "evidence": "", "group": "3.5 NET — síť (S3, S3b)" }, { "line": 167, "id": "NET-09", "title": "`DIOCNATLOOK` přes úzkou službu helperu", "requirements": "R3", "gates": "S3", "state": "unverified", "evidence": "", "group": "3.5 NET — síť (S3, S3b)" }, { "line": 168, "id": "NET-10", "title": "Ingress na wildcard listener IPv4/IPv6 z hosta, LAN a jiné oblasti", "requirements": "R2, R3", "gates": "S3b", "state": "unverified", "evidence": "", "group": "3.5 NET — síť (S3, S3b)" }, { "line": 169, "id": "NET-11", "title": "Port squatting na host port", "requirements": "R2, R3", "gates": "S3b", "state": "unverified", "evidence": "", "group": "3.5 NET — síť (S3, S3b)" }, { "line": 170, "id": "NET-12", "title": "Pozitivní same-zone dev server bez přístupu k cizím listenerům", "requirements": "R3, R7", "gates": "S3b", "state": "unverified", "evidence": "", "group": "3.5 NET — síť (S3, S3b)" }, { "line": 171, "id": "NET-13", "title": "SSRF / DNS rebinding na loopback, RFC1918, link-local", "requirements": "R3", "gates": "S3/S5", "state": "unverified", "evidence": "", "group": "3.5 NET — síť (S3, S3b)" }, { "line": 172, "id": "NET-14", "title": "ECH fail-closed", "requirements": "R3", "gates": "S3/S5", "state": "unverified", "evidence": "", "group": "3.5 NET — síť (S3, S3b)" }, { "line": 173, "id": "NET-15", "title": "Non-TLS provoz podle explicitní policy", "requirements": "R3", "gates": "S3/S5", "state": "unverified", "evidence": "", "group": "3.5 NET — síť (S3, S3b)" }, { "line": 174, "id": "NET-16", "title": "DNS přes systémový resolver a mDNS: žádný kanárek na protistraně", "requirements": "R3", "gates": "S3", "state": "unverified", "evidence": "", "group": "3.5 NET — síť (S3, S3b)" }, { "line": 175, "id": "NET-17", "title": "ICMP datový kanál", "requirements": "R3", "gates": "S3", "state": "unverified", "evidence": "", "group": "3.5 NET — síť (S3, S3b)" }, { "line": 176, "id": "NET-18", "title": "AirDrop / APNs kanály", "requirements": "R3", "gates": "S3", "state": "unverified", "evidence": "", "group": "3.5 NET — síť (S3, S3b)" }, { "line": 177, "id": "NET-19", "title": "QUIC / UDP 443 blokované", "requirements": "R3", "gates": "S3", "state": "unverified", "evidence": "", "group": "3.5 NET — síť (S3, S3b)" }, { "line": 178, "id": "NET-20", "title": "Flush anchoru/pravidel/states: nula zakázaných bajtů", "requirements": "R3", "gates": "S3", "state": "unverified", "evidence": "", "group": "3.5 NET — síť (S3, S3b)" }, { "line": 179, "id": "NET-21", "title": "`pfctl -F all`: nula zakázaných bajtů", "requirements": "R3", "gates": "S3", "state": "unverified", "evidence": "", "group": "3.5 NET — síť (S3, S3b)" }, { "line": 180, "id": "NET-22", "title": "Vypnutí pf: nula zakázaných bajtů (ochrana nezávislá na rulesetu)", "requirements": "R3", "gates": "S3", "state": "unverified", "evidence": "", "group": "3.5 NET — síť (S3, S3b)" }, { "line": 181, "id": "NET-23", "title": "Pád helperu / brány", "requirements": "R3", "gates": "S3", "state": "unverified", "evidence": "", "group": "3.5 NET — síť (S3, S3b)" }, { "line": 182, "id": "NET-24", "title": "Sleep/wake, VPN, změna sítě", "requirements": "R3", "gates": "S3", "state": "unverified", "evidence": "", "group": "3.5 NET — síť (S3, S3b)" }, { "line": 183, "id": "NET-25", "title": "Staré states, send buffery, tunely brány po odvolání", "requirements": "R3", "gates": "S3", "state": "unverified", "evidence": "", "group": "3.5 NET — síť (S3, S3b)" }, { "line": 184, "id": "NET-26", "title": "Revokace operace a opětovný start: starý průchod nepřežije", "requirements": "R3", "gates": "S3", "state": "unverified", "evidence": "", "group": "3.5 NET — síť (S3, S3b)" }, { "line": 185, "id": "NET-27", "title": "IPv6 link-local/ULA, `awdl0`/`llw0`", "requirements": "R3", "gates": "S3", "state": "unverified", "evidence": "", "group": "3.5 NET — síť (S3, S3b)" }, { "line": 191, "id": "GW-01", "title": "Cooldown filtru packumentu (verze před/po hranici)", "requirements": "R3", "gates": "S5", "state": "unverified", "evidence": "", "group": "3.6 GW — typované brány a artefakty (S5)" }, { "line": 192, "id": "GW-02", "title": "Přímá tarball URL bez předchozího packumentu", "requirements": "R3", "gates": "S5", "state": "unverified", "evidence": "", "group": "3.6 GW — typované brány a artefakty (S5)" }, { "line": 193, "id": "GW-03", "title": "Lockfile / `npm ci` s verzí v cooldownu", "requirements": "R3", "gates": "S5", "state": "unverified", "evidence": "", "group": "3.6 GW — typované brány a artefakty (S5)" }, { "line": 194, "id": "GW-04", "title": "Redirect na CDN", "requirements": "R3", "gates": "S5", "state": "unverified", "evidence": "", "group": "3.6 GW — typované brány a artefakty (S5)" }, { "line": 195, "id": "GW-05", "title": "Vydání z cache brány znovu kontrolované", "requirements": "R3", "gates": "S5", "state": "unverified", "evidence": "", "group": "3.6 GW — typované brány a artefakty (S5)" }, { "line": 196, "id": "GW-06", "title": "Neznámé datum publikace = odmítnuto", "requirements": "R3", "gates": "S5", "state": "unverified", "evidence": "", "group": "3.6 GW — typované brány a artefakty (S5)" }, { "line": 197, "id": "GW-07", "title": "Scoped packages", "requirements": "R3, R8", "gates": "S5", "state": "unverified", "evidence": "", "group": "3.6 GW — typované brány a artefakty (S5)" }, { "line": 198, "id": "GW-08", "title": "`PUT`/`DELETE` (publish) → 403", "requirements": "R3", "gates": "S5", "state": "unverified", "evidence": "", "group": "3.6 GW — typované brány a artefakty (S5)" }, { "line": 199, "id": "GW-09", "title": "Cizí `Authorization` u typed operací odmítnuta", "requirements": "R3", "gates": "S5", "state": "unverified", "evidence": "", "group": "3.6 GW — typované brány a artefakty (S5)" }, { "line": 200, "id": "GW-10", "title": "Vložení klíče a SSE; klíč nikdy v oblasti (mock upstream)", "requirements": "R2, R3", "gates": "S5", "state": "unverified", "evidence": "", "group": "3.6 GW — typované brány a artefakty (S5)" }, { "line": 201, "id": "GW-11", "title": "Rate a budget limity", "requirements": "R3", "gates": "S5", "state": "unverified", "evidence": "", "group": "3.6 GW — typované brány a artefakty (S5)" }, { "line": 202, "id": "GW-12", "title": "Typed vs passthrough na stejném hostname (OAuth/API) bez bypassu", "requirements": "R3, R8", "gates": "S5", "state": "unverified", "evidence": "", "group": "3.6 GW — typované brány a artefakty (S5)" }, { "line": 203, "id": "GW-13", "title": "OAuth/API scopes: mocky + uživatelský důkaz před podporou integrace", "requirements": "R3, R8", "gates": "S5", "state": "unverified", "evidence": "", "group": "3.6 GW — typované brány a artefakty (S5)" }, { "line": 204, "id": "GW-14", "title": "HTTP vs HTTPS base URL per SDK; per-zone CA a explicitní trust store", "requirements": "R8", "gates": "S5", "state": "unverified", "evidence": "", "group": "3.6 GW — typované brány a artefakty (S5)" }, { "line": 205, "id": "GW-15", "title": "Audit stažení odděleně od neautoritativního přehledu instalací; hranice cooldownu u lokální cache/importu", "requirements": "R3, R7", "gates": "S5", "state": "unverified", "evidence": "", "group": "3.6 GW — typované brány a artefakty (S5)" }, { "line": 206, "id": "GW-16", "title": "PyPI simple index + `upload-time` cooldown", "requirements": "R3, R8", "gates": "S5", "state": "unverified", "evidence": "", "group": "3.6 GW — typované brány a artefakty (S5)" }, { "line": 207, "id": "GW-17", "title": "Homebrew API/bottles: cooldown metadata", "requirements": "R3, R8", "gates": "S5/S6", "state": "unverified", "evidence": "", "group": "3.6 GW — typované brány a artefakty (S5)" }, { "line": 208, "id": "GW-18", "title": "Git: push jen do repa projektu (smart HTTP nebo deploy key)", "requirements": "R3", "gates": "S5", "state": "unverified", "evidence": "", "group": "3.6 GW — typované brány a artefakty (S5)" }, { "line": 209, "id": "GW-19", "title": "Matice kompatibility nástroj × protokol × policy", "requirements": "R8", "gates": "S5", "state": "unverified", "evidence": "", "group": "3.6 GW — typované brány a artefakty (S5)" }, { "line": 210, "id": "GW-20", "title": "Režie ≤ 1,1× nativně podle předem určeného měření", "requirements": "R5", "gates": "S5", "state": "unverified", "evidence": "", "group": "3.6 GW — typované brány a artefakty (S5)" }, { "line": 216, "id": "RB-01", "title": "Manifest vyjmenovává všechny zápisové kořeny; stav mimo ně neposkytuje perzistenci", "requirements": "R2, R7", "gates": "S4", "state": "unverified", "evidence": "", "group": "3.7 RB — stav, rollback, zpevnění (S4)" }, { "line": 217, "id": "RB-02", "title": "Snapshot až po ověřeném quiescence celého UID", "requirements": "R7", "gates": "S4", "state": "unverified", "evidence": "", "group": "3.7 RB — stav, rollback, zpevnění (S4)" }, { "line": 218, "id": "RB-03", "title": "Startup/job kanárek v home odstraněn plným rollbackem", "requirements": "R2, R7", "gates": "S4", "state": "unverified", "evidence": "", "group": "3.7 RB — stav, rollback, zpevnění (S4)" }, { "line": 219, "id": "RB-04", "title": "Změny projektu, prefixu a cache vráceny", "requirements": "R7", "gates": "S4", "state": "unverified", "evidence": "", "group": "3.7 RB — stav, rollback, zpevnění (S4)" }, { "line": 220, "id": "RB-05", "title": "Uzavřené fd/mappingy před obnovou", "requirements": "R7", "gates": "S4", "state": "unverified", "evidence": "", "group": "3.7 RB — stav, rollback, zpevnění (S4)" }, { "line": 221, "id": "RB-06", "title": "Pád v každé fázi obnovy", "requirements": "R7", "gates": "S4", "state": "unverified", "evidence": "", "group": "3.7 RB — stav, rollback, zpevnění (S4)" }, { "line": 222, "id": "RB-07", "title": "Neúplně obnovená oblast se nespustí", "requirements": "R2, R7", "gates": "S4", "state": "unverified", "evidence": "", "group": "3.7 RB — stav, rollback, zpevnění (S4)" }, { "line": 223, "id": "RB-08", "title": "Hostem vlastněná ochranná politika se ze snapshotu neobnovuje", "requirements": "R2", "gates": "S4", "state": "unverified", "evidence": "", "group": "3.7 RB — stav, rollback, zpevnění (S4)" }, { "line": 224, "id": "RB-09", "title": "Uninstall nepřepíše následnou legitimní změnu práv", "requirements": "R2", "gates": "S4", "state": "unverified", "evidence": "", "group": "3.7 RB — stav, rollback, zpevnění (S4)" }, { "line": 225, "id": "RB-10", "title": "Rollback zpevnění vrací jen vlastní změny; `chmod 700 ~` nerozbije host nástroje", "requirements": "R2, R7", "gates": "S4", "state": "unverified", "evidence": "", "group": "3.7 RB — stav, rollback, zpevnění (S4)" }, { "line": 231, "id": "SG-01", "title": "Hardened runtime u agenta, sond a helperu", "requirements": "R2", "gates": "S8", "state": "unverified", "evidence": "", "group": "3.8 SG — signing, TCC, broker (S8)" }, { "line": 232, "id": "SG-02", "title": "Absence `get-task-allow`", "requirements": "R2", "gates": "S8", "state": "unverified", "evidence": "", "group": "3.8 SG — signing, TCC, broker (S8)" }, { "line": 233, "id": "SG-03", "title": "Stabilní identita pro TCC přes rebuild", "requirements": "R6", "gates": "S8", "state": "unverified", "evidence": "", "group": "3.8 SG — signing, TCC, broker (S8)" }, { "line": 234, "id": "SG-04", "title": "SMAppService s Personal Team (LoginItem, LaunchAgent, LaunchDaemon zvlášť)", "requirements": "R2", "gates": "S8", "state": "unverified", "evidence": "", "group": "3.8 SG — signing, TCC, broker (S8)" }, { "line": 235, "id": "SG-05", "title": "Self-signed varianta (jen pokud SG-04 neprojde)", "requirements": "R2", "gates": "S8", "state": "unverified", "evidence": "", "group": "3.8 SG — signing, TCC, broker (S8)" }, { "line": 236, "id": "SG-06", "title": "Same-UID proces neattachne agenta a nezíská jeho TCC granty", "requirements": "R2", "gates": "S8", "state": "unverified", "evidence": "", "group": "3.8 SG — signing, TCC, broker (S8)" }, { "line": 237, "id": "SG-07", "title": "Modifikace bundle neudrží TCC granty", "requirements": "R2", "gates": "S8", "state": "unverified", "evidence": "", "group": "3.8 SG — signing, TCC, broker (S8)" }, { "line": 238, "id": "SG-08", "title": "Broker ověřuje audit token, code signature a session", "requirements": "R2", "gates": "S8", "state": "unverified", "evidence": "", "group": "3.8 SG — signing, TCC, broker (S8)" }, { "line": 239, "id": "SG-09", "title": "Fuzzing XPC: neplatné zprávy a velikosti", "requirements": "R2", "gates": "S8", "state": "unverified", "evidence": "", "group": "3.8 SG — signing, TCC, broker (S8)" }, { "line": 240, "id": "SG-10", "title": "IOSurface jen přes Mach port, ne globální ID", "requirements": "R2", "gates": "S8", "state": "unverified", "evidence": "", "group": "3.8 SG — signing, TCC, broker (S8)" }, { "line": 241, "id": "SG-11", "title": "Path traversal a TOCTOU v helperu", "requirements": "R2", "gates": "S8", "state": "unverified", "evidence": "", "group": "3.8 SG — signing, TCC, broker (S8)" }, { "line": 247, "id": "HB-01", "title": "Top 200 formulí: známý poměr bottle/kompilace v krátkém prefixu", "requirements": "R1, R8", "gates": "S6", "state": "unverified", "evidence": "", "group": "3.9 HB — Homebrew per oblast (S6)" }, { "line": 248, "id": "HB-02", "title": "Vzorek `brew test` projde", "requirements": "R1", "gates": "S6", "state": "unverified", "evidence": "", "group": "3.9 HB — Homebrew per oblast (S6)" }, { "line": 249, "id": "HB-03", "title": "Casky do `~/Applications` oblasti", "requirements": "R1", "gates": "S6", "state": "unverified", "evidence": "", "group": "3.9 HB — Homebrew per oblast (S6)" }, { "line": 250, "id": "HB-04", "title": "Datum publikace v metadatech pro cooldown pokrývá vydávaný artefakt", "requirements": "R3", "gates": "S6", "state": "unverified", "evidence": "", "group": "3.9 HB — Homebrew per oblast (S6)" }, { "line": 251, "id": "HB-05", "title": "Host `/opt/homebrew` beze změny po všech instalacích", "requirements": "R2", "gates": "S6", "state": "unverified", "evidence": "", "group": "3.9 HB — Homebrew per oblast (S6)" }, { "line": 252, "id": "HB-06", "title": "Žádná podporovaná instalace nevyžaduje root z oblasti", "requirements": "R2", "gates": "S6", "state": "unverified", "evidence": "", "group": "3.9 HB — Homebrew per oblast (S6)" }, { "line": 253, "id": "HB-07", "title": "Prefix je v APFS topologii a rollbacku", "requirements": "R7", "gates": "S6", "state": "unverified", "evidence": "", "group": "3.9 HB — Homebrew per oblast (S6)" }, { "line": 259, "id": "DK-01", "title": "`docker run` a `docker build`", "requirements": "R1, R4", "gates": "S7", "state": "unverified", "evidence": "", "group": "3.10 DK — Docker (S7)" }, { "line": 260, "id": "DK-02", "title": "`docker run -v /:/host` nezpřístupní Mac ani jinou oblast", "requirements": "R4", "gates": "S7", "state": "unverified", "evidence": "", "group": "3.10 DK — Docker (S7)" }, { "line": 261, "id": "DK-03", "title": "Změna mount konfigurace runtime z oblasti nezpřístupní host", "requirements": "R4", "gates": "S7", "state": "unverified", "evidence": "", "group": "3.10 DK — Docker (S7)" }, { "line": 262, "id": "DK-04", "title": "Vlastní daemon/socket per oblast", "requirements": "R4", "gates": "S7", "state": "unverified", "evidence": "", "group": "3.10 DK — Docker (S7)" }, { "line": 263, "id": "DK-05", "title": "Síť kontejneru jen přes bránu oblasti", "requirements": "R3, R4", "gates": "S7", "state": "unverified", "evidence": "", "group": "3.10 DK — Docker (S7)" }, { "line": 264, "id": "DK-06", "title": "Registry auth", "requirements": "R4, R8", "gates": "S7", "state": "unverified", "evidence": "", "group": "3.10 DK — Docker (S7)" }, { "line": 265, "id": "DK-07", "title": "Published ports nevystaví kontejner do LAN/hosta mimo policy", "requirements": "R3, R4", "gates": "S7", "state": "unverified", "evidence": "", "group": "3.10 DK — Docker (S7)" }, { "line": 266, "id": "DK-08", "title": "vsock proxy", "requirements": "R4", "gates": "S7", "state": "unverified", "evidence": "", "group": "3.10 DK — Docker (S7)" }, { "line": 267, "id": "DK-09", "title": "Síťové failure modes jako NET-20…26", "requirements": "R3, R4", "gates": "S7", "state": "unverified", "evidence": "", "group": "3.10 DK — Docker (S7)" }, { "line": 268, "id": "DK-10", "title": "Start/stop v budgetu stanoveném před S7", "requirements": "R5", "gates": "S7", "state": "unverified", "evidence": "", "group": "3.10 DK — Docker (S7)" }, { "line": 274, "id": "POS-01", "title": "`npm`/`pip`/`brew install` v oblasti", "requirements": "R1", "gates": "S5/S6", "state": "unverified", "evidence": "", "group": "3.11 POS — pozitivní a výkonové (napříč branami)" }, { "line": 275, "id": "POS-02", "title": "Cargo, Go, Gradle, NuGet v oblasti", "requirements": "R1, R8", "gates": "S5", "state": "unverified", "evidence": "", "group": "3.11 POS — pozitivní a výkonové (napříč branami)" }, { "line": 276, "id": "POS-03", "title": "OpenCode CLI a alespoň jeden další agent v oblasti", "requirements": "R1, R8", "gates": "F2", "state": "unverified", "evidence": "", "group": "3.11 POS — pozitivní a výkonové (napříč branami)" }, { "line": 277, "id": "POS-04", "title": "`sanjbox shell` v libovolném terminálu: UID a doména oblasti", "requirements": "R1", "gates": "F2", "state": "unverified", "evidence": "", "group": "3.11 POS — pozitivní a výkonové (napříč branami)" }, { "line": 278, "id": "POS-05", "title": "Bezpečná pauza celého UID odděleně od pauzy aplikací", "requirements": "R5", "gates": "F2", "state": "unverified", "evidence": "", "group": "3.11 POS — pozitivní a výkonové (napříč branami)" }, { "line": 279, "id": "POS-06", "title": "Most schránky: preview, potvrzení, karanténa", "requirements": "R2, R6", "gates": "F3", "state": "unverified", "evidence": "", "group": "3.11 POS — pozitivní a výkonové (napříč branami)" }, { "line": 280, "id": "POS-07", "title": "Proxy okna: Xcode, Simulator, Electron, Safari použitelné", "requirements": "R6", "gates": "F3", "state": "unverified", "evidence": "", "group": "3.11 POS — pozitivní a výkonové (napříč branami)" }, { "line": 281, "id": "POS-08", "title": "MVP okno plochy oblasti: jednoznačně označené, schránka jen řízeným mostem (C-001)", "requirements": "R2, R6", "gates": "F2", "state": "unverified", "evidence": "", "group": "3.11 POS — pozitivní a výkonové (napříč branami)" }, { "line": 282, "id": "POS-09", "title": "Řízený export: výběr, preview, karanténa, audit; jiná cesta ven neexistuje (F0.3)", "requirements": "R2, R7", "gates": "F2", "state": "unverified", "evidence": "", "group": "3.11 POS — pozitivní a výkonové (napříč branami)" }, { "line": 283, "id": "PERF-01", "title": "`npm install`/build v oblasti vs. srovnatelně nativně", "requirements": "R5", "gates": "F2", "state": "unverified", "evidence": "", "group": "3.11 POS — pozitivní a výkonové (napříč branami)" }, { "line": 284, "id": "PERF-02", "title": "Detekce a reakce hlídače (detektor, ne gate R3)", "requirements": "R3", "gates": "S3", "state": "unverified", "evidence": "", "group": "3.11 POS — pozitivní a výkonové (napříč branami)" }, { "line": 285, "id": "PERF-03", "title": "Cold/warm login a resume proti cílům design card", "requirements": "R5", "gates": "F2", "state": "unverified", "evidence": "", "group": "3.11 POS — pozitivní a výkonové (napříč branami)" } ], "blockers": [ { "line": 355, "id": "B01", "title": "Ochrana nových dat, přesunů, obnov a mountů", "requirements": "R2", "resolves": "S0, S4 (FS-04, FS-10, FS-11)", "state": "open" }, { "line": 356, "id": "B02", "title": "Zákaz nového spuštění a zánik všech procesů UID; rozsah rollbacku a crash recovery", "requirements": "R2", "resolves": "S0, S4, S8 (LC, RB)", "state": "open" }, { "line": 357, "id": "B03", "title": "Resolver, mDNS, ICMP, AirDrop/APNs", "requirements": "R3", "resolves": "S3 (NET-16…18); bez Network Extension (F0.5)", "state": "open" }, { "line": 358, "id": "B04", "title": "Výpadek pf: ochrana nezávislá na rulesetu, staré states", "requirements": "R3", "resolves": "S3, WP1.C2 (NET-20…25)", "state": "open" }, { "line": 359, "id": "B05", "title": "Ingress a loopback, port squatting", "requirements": "R2, R3", "resolves": "S3b (NET-10…12)", "state": "open" }, { "line": 360, "id": "B06", "title": "Autorizace, scopes a passthrough", "requirements": "R2, R3, R8", "resolves": "S5, S8 (GW-12…13)", "state": "open" }, { "line": 361, "id": "B07", "title": "Cooldown jako kontrola artefaktů; metadata brew/tapů", "requirements": "R3", "resolves": "S5, S6 (GW-01…06, HB-04)", "state": "open" }, { "line": 362, "id": "B08", "title": "Tři akcelerované relace vedle host konzole, HP limit, keeper", "requirements": "R1, R5, R6", "resolves": "S1, S2 (GUI-01…05, GUI-13); fallback F0.6 nepokrývá nemožnost souběžných relací", "state": "open" }, { "line": 363, "id": "B09", "title": "Signing bez placeného účtu: S8 nemá náhradní cestu", "requirements": "R2", "resolves": "S8 (SG-04…05); F0.5", "state": "open" } ], "summary": { "packages": { "total": 57, "done": 15, "percent": 26.32, "states": { "active": 11, "done": 15, "todo": 31 } }, "tests": { "total": 155, "done": 0, "percent": 0.0, "states": { "unverified": 155 } }, "requirements": { "total": 8, "done": 0, "percent": 0.0, "states": { "unverified": 8 } }, "gates": { "total": 10, "done": 0, "percent": 0.0, "states": { "unverified": 10 } }, "blockers": { "total": 9, "done": 0, "percent": 0.0, "states": { "open": 9 } }, "phases": { "F0": { "total": 5, "done": 3, "percent": 60.0, "states": { "active": 2, "done": 3 } }, "F1": { "total": 30, "done": 12, "percent": 40.0, "states": { "done": 12, "active": 9, "todo": 9 } }, "F2": { "total": 12, "done": 0, "percent": 0.0, "states": { "todo": 12 } }, "F3": { "total": 6, "done": 0, "percent": 0.0, "states": { "todo": 6 } }, "F4": { "total": 4, "done": 0, "percent": 0.0, "states": { "todo": 4 } } } }, "schema_version": 1, "commit": "396e3f1bb77797fc7fafd6d3174046b548e5fbb5", "working_tree": false, "repository": "Fir3st/sanjbox", "history_ref": "396e3f1bb77797fc7fafd6d3174046b548e5fbb5", "counting_rules": "docs/PROGRESS.md" }