Keep Linux daemon identity stable across clock changes

[wesm]

• Prevents Linux wall-clock corrections from making a live daemon look like a different process, which could remove its runtime record while its lifetime owner lock remains held.
• Defines the first Linux identity encoding from kernel boot identity, the target process's PID namespace inode, and monotonic start ticks. It remains available under hidepid and ProtectProc when the daemon can inspect itself but not PID 1, while distinguishing PID reuse and namespace restarts.
• Stores the new Linux identity in the versioned runtime-record field and leaves the legacy wall-clock field empty, so clients built from current main treat records they cannot understand as unknown rather than destructive mismatches.
• Validates the complete emitted identity format on every platform. Malformed, foreign, and unsupported versioned values fail closed; non-Linux behavior otherwise keeps its existing creation-time identity.

[roborev-ci]

roborev: Combined Review (7dbc465)

Review verdict: One medium-severity reliability issue should be addressed.

Medium

• daemon/process_identity_linux.go:42 — Every identity now depends on reading /proc/1/stat. Under hidepid or ProtectProc, an unprivileged daemon may inspect itself and same-user processes but not PID 1, causing ReadProcessIdentity to return false and NewRuntimeRecord to silently omit process identity. Derive the namespace component from an inspectable target-specific source such as /proc/<pid>/ns/pid, combined with the boot ID and target start ticks.

---

Reviewers: 2 done | Synthesis: codex, 10s | Total: 5m32s

[roborev-ci]

roborev: Combined Review (3418aee)

Potentially unsafe malformed process identities are not rejected fail-closed.

Medium

• daemon/process_identity_linux.go:23 — Compatibility checks only the linux-v2: prefix, so malformed or truncated identities are classified as ProcessIdentityMismatch instead of ProcessIdentityUnknown. Callers could interpret a mismatch as authorization for destructive replacement, violating the fail-closed identity contract. Validate the complete versioned encoding—including boot ID, namespace inode, and start ticks—before comparison, and return unknown for malformed values. Update the mismatch test to use a structurally valid identity with a changed component.

---

Reviewers: 2 done | Synthesis: codex, 15s | Total: 5m15s

[roborev-ci]

roborev: Combined Review (fe577d9)

Medium-severity issue found: non-Linux identity validation may fail open during mixed-version operation.

Medium

• daemon/process_identity_other.go:28 — Non-Linux platforms accept every identity encoding as compatible. Because CompareRuntimeProcessIdentity prioritizes ProcessIdentityV2, an unsupported future or foreign version is compared with the local decimal identity and reported as ProcessIdentityMismatch instead of ProcessIdentityUnknown, potentially authorizing destructive action. Validate identities as the currently emitted positive-decimal format and return unknown for unsupported ProcessIdentityV2 schemes.

---

Reviewers: 2 done | Synthesis: codex, 23s | Total: 7m13s

[roborev-ci]

roborev: Combined Review (6b8b8e3)

One medium-severity issue remains in Linux process identity validation.

Medium

• daemon/process_identity_linux.go:36 — Validation accepts noncanonical identities, including numeric fields with leading zeros or + signs and uppercase boot-ID hex. Because these encodings cannot match the canonical live identity, malformed input yields ProcessIdentityMismatch instead of failing closed as ProcessIdentityUnknown, potentially allowing destructive replacement or cleanup. Require numeric fields to exactly equal strconv.FormatUint(value, 10), require the boot ID’s canonical lowercase form, and add tests for alternate encodings.

---

Reviewers: 2 done | Synthesis: codex, 20s | Total: 3m7s

[roborev-ci]

roborev: Combined Review (3068aca)

One medium-severity issue found in process identity validation.

Medium

• daemon/process_identity_other.go:30 — Validation accepts unsigned values above math.MaxInt64, even though ReadProcessIdentity can only emit positive int64 values. An impossible identity such as 9223372036854775808 therefore yields ProcessIdentityMismatch instead of failing closed as ProcessIdentityUnknown.
  • Fix: Parse and canonicalize using strconv.ParseInt/strconv.FormatInt, and add a non-Linux test covering out-of-range values.

---

Reviewers: 2 done | Synthesis: codex, 10s | Total: 3m44s

[roborev-ci]

roborev: Combined Review (ce57250)

No issues found.

---

Reviewers: 2 done | Synthesis: codex | Total: 5m52s