Module child_launch 

Launching a delegated child as an operating-system process of the parent’s own runtime.

The daemon referees and hands back an approval; this is what turns that approval into a running capsule. The parent’s runtime composes a directory for the child beneath its own accessible workdir, builds the child’s environment from the child’s declaration rather than its own, and starts the mur binary as a subprocess. The child’s runtime registers with the daemon for itself (see crate::registration), so the parent never states what the child holds — it only names which artifact is running.

Three properties fall out of the child being a process rather than a thread:

• A daemon crash takes no child with it. Nothing the child needs to keep running lives in the daemon’s address space.
• Each child has its own process environment and working directory, so a subprocess started by one child inherits nothing a sibling shares.
• A child that declares the sealed containment floor enters a mount namespace of its own, because the containment machinery installs per process and the child is a process.

A child joins its parent’s formation; it never starts one. A parent session that belongs to a formation hands its id to every child as FORMATION_ID_ENV, beside the spawner handle and independent of it, so a launch that names no lineage still carries it. A parent in no formation hands none. Inheriting the id is not a grant: the child gets no formation channel, no formation token, no callee and no formation lifeline, so its door has no membership and refuses every formation token.

A child dies with the process that spawned it. Every child, in a formation or not, is handed a spawner lifeline of its own (crate::lifeline::ChildLifeline, named by SPAWNER_LIFELINE_ENV): the read end of a pipe whose only write end this process holds. When this process ends, by any means, the kernel closes the write end and the child winds down as a first SIGTERM would wind it down. A child that delegates hands its own children a lifeline of its own the same way, so a grandchild ends once its parent has. A launch whose lifeline cannot be created is refused rather than started without one.

The approval travels on the child’s standard input. Not on the argument vector and not in the environment: both are readable from /proc/<pid> by any process running as the same user, which is exactly what a sibling capsule’s shell tool is.

Structs

ChildLaunchRequest

What the parent’s runtime needs in order to start one approved child.

LaunchedChild

A running child capsule and the handles to end it.

ParentWorkdirSource

A parent’s work folder as launch_child_capsule copies it into a child’s.

Constants

CHILD_END_GRACE

How long a child sent SIGTERM on purpose is given to wind down before it is SIGKILLed.

CONTAINED_LAUNCH_FLAG

The hidden mur run flag every launch the runtime makes on the operator’s behalf carries: a delegated child, a plan capsule step, a contained roster member and a deployed capsule. A launch carrying it runs contained, whatever containment: unconfined the global config says, and refuses --unconfined (E-RUN-060), so the unconfined stance never spreads to a capsule the operator did not launch unconfined themselves.

MUR_BINARY_ENV

Environment variable naming the mur binary to launch children with.

PARENT_WORKDIR_SNAPSHOT_FLAG

The hidden mur run flag carrying, as WorkdirSnapshot JSON, what a delegating parent copied into the child’s --workdir before starting it. A report of what the parent did, never a grant: the child’s staging records it as session_start.effective_grants.parent_workdir and in MURMUR.md, and holds nothing more because of it.

READINESS_TOKENS_FLAG

The hidden mur run flag that puts every door token the session minted on its --json readiness line, under tokens. Passed only by a launcher reading that line on a pipe nothing else holds — a parent runtime launching a delegated child, and mur run --roster launching a peer — because it is the one mur run output that carries a token.

WORKDIR_IDENTITY_FLAG

The hidden mur run flag carrying <st_dev>:<st_ino> of the directory a delegating parent created for its child, which the child’s staging compares with the --workdir it opened before writing anything there (E-RUN-051 on a mismatch).

Functions

child_workdir_for

Where a child of this parent goes: <parent records dir>/children/<name>-<16 hex>.

format_workdir_identity

(st_dev, st_ino) in WORKDIR_IDENTITY_FLAG’s <dev>:<ino> form.

launch_child_capsule

Create the child’s directory, start mur on it, and wait for the child to report itself.

parse_workdir_identity

Parses WORKDIR_IDENTITY_FLAG’s <dev>:<ino> value.