Authority: Normative summary · Status: Local-fixture proof implemented; sealed public-egress candidate implemented but disabled and unactivated · Applies to: E3.1–E3.2 · Verified against: current checkout · Source: spec/atlas/OBSERVATORY_WORKER_0_1.md, ADR 007, egress JSON schemas, and deploy/egress
Purpose
The Atlas control plane has no HTTP client. The Observatory worker is a
separate command whose current executable profile accepts only one robots job
at a literal 127.0.0.1 fixture URL. It cannot contact the selected Atlas
origins.
The demonstration starts the controlled fixture, retrieves its robots
representation, writes content-addressed evidence, evaluates a target, stops
the fixture, and verifies the decision offline.
Evidence order
Invalid UTF-8 or another parser failure leaves the observation evidence in
place and publishes no successful result. The worker has no registry or canon
write path.
Failure behavior
The job decoder rejects duplicate keys, unknown fields, trailing data,
symlinks, public and private destinations, hostnames, credentials, queries,
fragments, redirects, and bodies above 500 KiB. Offline verification recomputes
the evidence digests and the robots decision without constructing a client.
Security status
The repository includes an unactivated systemd candidate that denies every
address except loopback. This is configuration for review, not deployment
evidence. Public-origin observation still requires explicit allow policy,
controlled DNS and redirect behavior, network-level egress enforcement,
dedicated credentials, quotas, monitoring, revocation, and disposable workers.
The fixture result is not evidence for the live twirx.org robots
representation and does not change its pending, uncertain policy state.
Sealed public-egress pilot
The E3.2 worker is a separate executable. It accepts only a work-order ID:
There is no URL argument. A root-owned work order binds the exact HTTPS route,
admitted hosts, policy and human-decision digests, approval reference,
validity interval, and bounded redirects, bytes, timeouts, failures, and
cooldown. profile_only cannot authorize an observation.
A separate policy_evidence_collection authority breaks the robots-review
cycle without opening general access. It accepts only the exact
/robots.txt route of a human-admitted origin under pending + uncertain
policy. It cannot profile or observe content. Every broader route requires a
completed retrieval-permitting policy.
Every connection resolves DNS again and denies private, loopback, link-local,
metadata, multicast, documentation, benchmark, and reserved IPv4 and IPv6
ranges. Redirects repeat those checks. Numeric address encodings, embedded
credentials, non-HTTP schemes, and unexpected ports fail before retrieval.
The worker preserves the sealed work order, content-addressed body, canonical
observation, JSON view, and result. It writes the manifest last. Offline
admission rehashes every manifest entry and checks the result, observation,
and CAS body agree:
Deployment status
deploy/egress/twirx-egress-worker@.service is an uninstalled review
candidate. It adds a dedicated account, read-only work orders, hidden control
plane and secret paths, a cgroup-scoped private-range firewall, a one-worker
process lease, and CPU, memory, task, file, and time limits. The committed
control artifact is disabled with the emergency stop active. Repository tests
do not install, enable, start, or deploy it.
No real-origin retrieval may start until the founder approves the individual
policy decision, the exact work order, and target-host verification.Last modified on August 11, 2026