Phase 05 · Process tree & execution

Process tree and execution control

Execution authority for contained processes, where the containment session follows descendants through shells, interpreters and exec replacement.

Permanent ruleLaunching a helper process may never be treated as escaping the originating containment policy.

If containment applied to one process, every agent would escape it in one line. The whole point of Phase 5 is that the process tree is part of the boundary.

The operation model

ExecutionOperation normalises execution into executeBinary, executeScript, invokeInterpreter, invokeShell, launchApplication, execReplace, and unknown.

execReplace is there deliberately. A process that replaces its own image is not a new process from the kernel’s point of view, and treating it as one is how lineage tracking quietly breaks. unknown is denied and cannot become authority through uncertainty.

Target identity

An execution target is not a command string. ExecutionTargetIdentity keeps these fields distinct:

  • the requested command string, as supplied
  • the resolved executable path and the canonical executable path
  • executable identity from the Phase 1 identity services
  • code-signing identity and signing status
  • executable hash and filesystem identity where available
  • target type, execution operation and execution mode
  • script identity, interpreter identity and shebang identity where applicable
  • argument evidence and environment evidence

The shebang line matters: ./deploy.sh is a script whose real interpreter is named inside the file, and a policy that reasons about the filename has reasoned about the wrong thing.

Inheritance

A contained subject that spawns bash, which spawns python3, which spawns curl, produces four process instances in one containment session. The fourth is governed by the policy the first was given. There is no hop count at which the session lapses and no interpreter that resets it.

This covers the tools agents actually reach for: shells, curl, ssh, Python, Node, package managers, AppleScript and other automation, Docker, and arbitrary helper binaries. None of them is a category of software that gets its own authority; each is an execution target with an identity, evaluated against the session’s policy.

Three facts, kept separate

As in every other domain:

  • observation — an execution attempt was seen or submitted for evaluation
  • policy — a deterministic allow, deny, or not-governed decision
  • enforcement — macOS actually allowed or denied it

blocked means the third. A policy-only denial reads “Observed — Policy Would Deny”.

Enforcement boundary

The Endpoint Security execution adapter is built against AUTH_EXEC and the policy path is proven. Production runtime denial depends on Apple’s restricted Endpoint Security entitlement — submitted and in review — plus a signed, installed system extension and user approval. Until that chain is complete, the operating-system denial is not claimed. See Trust.