Crate cellos_host_cellos 

Proprietary CellOS host backend (L2).

Today this is a simulated runtime: in-memory cell records that must be removed on destroy so tests can falsify residue. When the real kernel/userspace ABI exists, replace the inner implementation with FFI/IPC while keeping the same CellBackend contract.

Subprocess spawn (E1-04)

spawn_isolated_workload is the only sanctioned way for this backend to materialise a child process. It enforces three FD-hygiene invariants on Unix:

1. No ambient env. The child gets env_clear() plus exactly the declared injection set — nothing inherited from the supervisor.
2. Stdio replaced with pipes. stdin / stdout / stderr are wired to fresh pipes whose parent ends drop before the caller can write or read, so a child cannot reach back into the supervisor’s terminal or log streams.
3. All FDs > 2 closed on exec. A pre_exec closure walks /proc/self/fd and sets FD_CLOEXEC on every fd > 2. The kernel atomically closes those at execve(2) so a workload never inherits NATS sockets, broker handles, or audit-log writers.

These guarantees are exercised by tests/fd_isolation.rs, which reads /proc/<child>/environ of a real child and asserts byte-for-byte equality with the declared injection set.

Re-exports

pub use memory_broker::MemorySecretBroker;

Modules

memory_broker

In-memory SecretBroker for development and residue tests — simulates TTL-bound injection and revoke on teardown.

Structs

ProprietaryCellBackend

Simulated proprietary host: tracks active cells; destroy removes all host-side state for that id.

SpawnedWorkload

Handle to a spawned workload child. Drops do not kill — caller wait()s.

WorkloadEnv

Declared environment injection set for spawn_isolated_workload.

Functions

spawn_isolated_workload

Spawn a workload subprocess with closed FD inheritance and a declared env injection set.