{"schema":"qp-receipt/1","taskId":"d6fbf70332","runPrefix":"qp","nonce":"8dc93a5cfe059323e2d42ebc","startedAt":"2026-11-04T17:26:45.868Z","finishedAt":"2026-11-04T17:27:10.317Z","status":"completed","verdict":"install","rulesFired":[],"package":{"requested":"fastify@5.12.4","source":"registry","name":"fastify","version":"5.12.4"},"limits":{"downloadSeconds":120,"downloadMaxBytes":52428800,"downloadMaxPackages":300,"sandboxSeconds":60,"pids":64,"memoryBytes":268435456,"cpus":0.5,"tmpfsWorkBytes":134217728,"tmpfsTmpBytes":67108864,"tmpfsHomeBytes":16777216},"images":{"tag":"s1-1aba83a3","sandbox":"qp-sandbox:s1-1aba83a3","sinkhole":"qp-sinkhole:s1-1aba83a3"},"download":{"container":"ar-qp-download-d6fbf70332","hardening":{"container":"ar-qp-download-d6fbf70332","id":"8bdc1c9f466bbeec481298109f37e658e6cea294881fd97bef60263ca9acbe04","image":"qp-sandbox:s1-1aba83a3","imageId":"sha256:3c6a223b5c22a3a5d0ee2aa0a9cc22e049172d60af9998d26d7a27abc6dfbc85","User":"10001:10001","ReadonlyRootfs":true,"Privileged":false,"CapDrop":["ALL"],"CapAdd":null,"SecurityOpt":["no-new-privileges"],"PidsLimit":64,"Memory":268435456,"MemorySwap":268435456,"NanoCpus":500000000,"Tmpfs":{"/home/qp":"rw,exec,nosuid,nodev,size=268435456,uid=10001,gid=10001,mode=0700","/tmp":"rw,exec,nosuid,nodev,size=268435456,uid=10001,gid=10001,mode=0700"},"Binds":["ar-qp-vol-d6fbf70332:/out"],"Mounts":[{"Type":"volume","Name":"ar-qp-vol-d6fbf70332","Destination":"/out","RW":true}],"NetworkMode":"bridge","PidMode":"","IpcMode":"private","UsernsMode":"","AutoRemove":true},"seconds":10.057,"exitCode":0,"precheck":{"ok":true,"reason":null,"stage":"tree","visited":50,"manifestsFetched":50,"nonRegistry":[]},"lockcheck":{"ok":true,"packageCount":48,"nonRegistry":[]},"inventory":{"name":"fastify","version":"5.12.4","packageCount":48,"unpackedBytes":8339553,"nonRegistry":[],"installScripts":[]},"output":"\n\nup to date in 3s\nQP-RC lock 0\n\n\nadded 48 packages in 4s\nQP-RC install 0\n\nWARNING: Error loading config file: open /home/qp/.docker/config.json: permission denied\n"},"sandbox":{"container":"ar-qp-sandbox-d6fbf70332","round":1,"fresh":true,"containerId":"9ab2f47590ac2c6d53991cf1362f2b111be18061f5addc45df78519d5f9746e6","seconds":9.092,"exitCode":0,"endedBy":"exit","limitsHit":[],"hardening":{"container":"ar-qp-sandbox-d6fbf70332","id":"9ab2f47590ac2c6d53991cf1362f2b111be18061f5addc45df78519d5f9746e6","image":"qp-sandbox:s1-1aba83a3","imageId":"sha256:3c6a223b5c22a3a5d0ee2aa0a9cc22e049172d60af9998d26d7a27abc6dfbc85","User":"10001:10001","ReadonlyRootfs":true,"Privileged":false,"CapDrop":["ALL"],"CapAdd":null,"SecurityOpt":["no-new-privileges"],"PidsLimit":64,"Memory":268435456,"MemorySwap":268435456,"NanoCpus":500000000,"Tmpfs":{"/home/qp":"rw,exec,nosuid,nodev,size=16777216,uid=10001,gid=10001,mode=0700","/tmp":"rw,exec,nosuid,nodev,size=67108864,uid=10001,gid=10001,mode=0700","/work":"rw,exec,nosuid,nodev,size=134217728,uid=10001,gid=10001,mode=0700"},"Binds":["ar-qp-vol-d6fbf70332:/in:ro"],"Mounts":[{"Type":"volume","Name":"ar-qp-vol-d6fbf70332","Destination":"/in","RW":false}],"NetworkMode":"container:d05845f5adba55d5e42acfbe30856ddf670bd7b3969dbf580de82c02bfd1055e","PidMode":"","IpcMode":"private","UsernsMode":"","AutoRemove":true},"tracer":{"container":"ar-qp-tracer-d6fbf70332","hardening":{"container":"ar-qp-tracer-d6fbf70332","id":"95fd59e5c322154701e1a5213cfe65524117051c45dc6751ba15609c531a5734","image":"qp-sandbox:s1-1aba83a3","imageId":"sha256:3c6a223b5c22a3a5d0ee2aa0a9cc22e049172d60af9998d26d7a27abc6dfbc85","User":"0:0","ReadonlyRootfs":true,"Privileged":false,"CapDrop":["ALL"],"CapAdd":["CAP_SYS_PTRACE"],"SecurityOpt":["no-new-privileges"],"PidsLimit":16,"Memory":268435456,"MemorySwap":268435456,"NanoCpus":500000000,"Binds":null,"Mounts":[],"NetworkMode":"none","PidMode":"container:9ab2f47590ac2c6d53991cf1362f2b111be18061f5addc45df78519d5f9746e6","IpcMode":"private","UsernsMode":"","AutoRemove":true},"traceBytes":4950414,"truncated":false},"sinkhole":{"container":"ar-qp-sinkhole-d6fbf70332","ip":"172.18.0.2","hardening":{"container":"ar-qp-sinkhole-d6fbf70332","id":"d05845f5adba55d5e42acfbe30856ddf670bd7b3969dbf580de82c02bfd1055e","image":"qp-sinkhole:s1-1aba83a3","imageId":"sha256:75195ea4538d1fe039d75b314829dae7593fe25a78daad4573c10478783d3184","User":"","ReadonlyRootfs":true,"Privileged":false,"CapDrop":["ALL"],"CapAdd":["CAP_NET_ADMIN"],"SecurityOpt":["no-new-privileges"],"PidsLimit":256,"Memory":536870912,"MemorySwap":536870912,"NanoCpus":500000000,"Tmpfs":{"/run":"size=1m","/tmp":"size=8m"},"Binds":null,"Mounts":[],"NetworkMode":"ar-qp-net-d6fbf70332","PidMode":"","IpcMode":"private","UsernsMode":"","AutoRemove":true},"records":0,"controlRecords":0,"flushed":true},"network":{"name":"ar-qp-net-d6fbf70332","internal":true,"subnet":"172.18.0.0/16","enableIPv6":false},"roles":{"stagePid":25,"npmPid":33,"harnessPid":45,"scanPid":26},"allowedAreaWrites":{"total":0,"omitted":0},"preloadForeignRecords":0},"harness":{"mode":"require, then the model harness when one is staged (S2)","loaded":true,"detail":{"mode":"fallback-require","error":null,"resolved":"node_modules/fastify/fastify.js"},"model":{"staged":true,"ran":true,"ok":true,"error":null,"fallback":null}},"explanation":{"label":"explanation","source":"model mimo-v2.6-pro","text":"Fastify is a well-known HTTP server framework whose entry point only sets up in-memory routing, logging and server objects when instantiated. Registering a route and using the built-in light-my-request inject() performs an in-process simulated request with no sockets, no filesystem writes, and no child processes.","note":"The verdict is computed by deterministic rules from the observations; this explanation never changes it."},"model":{"status":"ok","missing":[],"attempts":[{"purpose":"prediction","model":"mimo-v2.6-pro","status":"ok","latencyMs":2200,"httpStatus":null,"usage":{"prompt_tokens":3651,"completion_tokens":294,"total_tokens":3945},"detail":null}],"model":"mimo-v2.6-pro","prediction":{"network":{"expected":false,"hosts":[]},"filesOutsidePackage":{"expected":false,"paths":[]},"childProcesses":{"expected":false,"commands":[]}},"explanation":"Fastify is a well-known HTTP server framework whose entry point only sets up in-memory routing, logging and server objects when instantiated. Registering a route and using the built-in light-my-request inject() performs an in-process simulated request with no sockets, no filesystem writes, and no child processes.","harness":{"source":"model","retries":0,"firstError":null,"finalError":null}},"predictionVsObserved":[{"dimension":"network","predicted":false,"predictedDetail":[],"observed":false,"observedDetail":[],"observationIds":[],"status":"match","package":"fastify"},{"dimension":"filesOutsidePackage","predicted":false,"predictedDetail":[],"observed":false,"observedDetail":[],"observationIds":[],"status":"match","package":"fastify"},{"dimension":"childProcesses","predicted":false,"predictedDetail":[],"observed":false,"observedDetail":[],"observationIds":[],"status":"match","package":"fastify"}],"completeness":{"instrumentation-heartbeat":{"ok":true,"runs":[{"round":1,"ok":true,"detail":{"nodeProcesses":3,"missing":[],"reasons":{}}}]},"paths-resolved":{"ok":true,"runs":[{"round":1,"ok":true,"detail":{"unresolved":[]}}]},"kernel-trace":{"ok":true,"runs":[{"round":1,"ok":true,"detail":{"syscalls":29553,"state":"complete"}}]},"sinkhole-log":{"ok":true,"runs":[{"round":1,"ok":true,"detail":{"ready":true,"unmatchedObservationIds":[],"rule":"every traced package TCP connect / DNS query that reached the redirect has a sinkhole record (AF-4)"}}]},"ended-normally":{"ok":true,"runs":[{"round":1,"ok":true,"detail":{}}]},"harness-ran":{"ok":true,"runs":[{"round":1,"ok":true,"detail":{}}]}},"observations":[{"id":"o1","kind":"load","actor":"harness","pid":45,"exe":null,"dest":null,"orig_dest":null,"port":null,"sni":null,"proto":null,"blocked":null,"payload":null,"path":null,"nonce":"8dc93a5cfe059323e2d42ebc","ok":true,"mode":"fallback-require","error":null,"resolved":"node_modules/fastify/fastify.js"},{"id":"o2","kind":"completeness","actor":null,"pid":null,"exe":null,"dest":null,"orig_dest":null,"port":null,"sni":null,"proto":null,"blocked":null,"payload":null,"path":null,"nonce":"8dc93a5cfe059323e2d42ebc","marker":"instrumentation-heartbeat","ok":true,"detail":{"nodeProcesses":3,"missing":[],"reasons":{}}},{"id":"o3","kind":"completeness","actor":null,"pid":null,"exe":null,"dest":null,"orig_dest":null,"port":null,"sni":null,"proto":null,"blocked":null,"payload":null,"path":null,"nonce":"8dc93a5cfe059323e2d42ebc","marker":"paths-resolved","ok":true,"detail":{"unresolved":[]}},{"id":"o4","kind":"completeness","actor":null,"pid":null,"exe":null,"dest":null,"orig_dest":null,"port":null,"sni":null,"proto":null,"blocked":null,"payload":null,"path":null,"nonce":"8dc93a5cfe059323e2d42ebc","marker":"kernel-trace","ok":true,"detail":{"syscalls":29553,"state":"complete"}},{"id":"o5","kind":"completeness","actor":null,"pid":null,"exe":null,"dest":null,"orig_dest":null,"port":null,"sni":null,"proto":null,"blocked":null,"payload":null,"path":null,"nonce":"8dc93a5cfe059323e2d42ebc","marker":"sinkhole-log","ok":true,"detail":{"ready":true,"unmatchedObservationIds":[],"rule":"every traced package TCP connect / DNS query that reached the redirect has a sinkhole record (AF-4)"}},{"id":"o6","kind":"completeness","actor":null,"pid":null,"exe":null,"dest":null,"orig_dest":null,"port":null,"sni":null,"proto":null,"blocked":null,"payload":null,"path":null,"nonce":"8dc93a5cfe059323e2d42ebc","marker":"ended-normally","ok":true,"detail":{}},{"id":"o7","kind":"completeness","actor":null,"pid":null,"exe":null,"dest":null,"orig_dest":null,"port":null,"sni":null,"proto":null,"blocked":null,"payload":null,"path":null,"nonce":"8dc93a5cfe059323e2d42ebc","marker":"harness-ran","ok":true,"detail":{}}],"network":{"sinkholeLog":[]},"secretScan":{"sandbox":{"keyLikeEnvNames":[],"ignoredImageVars":["GPG_KEY"],"dockerSockPresent":[],"mounts":[{"mountPoint":"/","fsType":"overlay","readOnly":true},{"mountPoint":"/proc","fsType":"proc","readOnly":false},{"mountPoint":"/dev","fsType":"tmpfs","readOnly":false},{"mountPoint":"/dev/pts","fsType":"devpts","readOnly":false},{"mountPoint":"/sys","fsType":"sysfs","readOnly":true},{"mountPoint":"/sys/fs/cgroup","fsType":"cgroup2","readOnly":true},{"mountPoint":"/dev/mqueue","fsType":"mqueue","readOnly":false},{"mountPoint":"/dev/shm","fsType":"tmpfs","readOnly":false},{"mountPoint":"/in","fsType":"ext4","readOnly":true},{"mountPoint":"/tmp","fsType":"tmpfs","readOnly":false},{"mountPoint":"/work","fsType":"tmpfs","readOnly":false},{"mountPoint":"/etc/hostname","fsType":"ext4","readOnly":true},{"mountPoint":"/etc/hosts","fsType":"ext4","readOnly":true},{"mountPoint":"/etc/resolv.conf","fsType":"ext4","readOnly":true},{"mountPoint":"/home/qp","fsType":"tmpfs","readOnly":false},{"mountPoint":"/proc/bus","fsType":"proc","readOnly":true},{"mountPoint":"/proc/fs","fsType":"proc","readOnly":true},{"mountPoint":"/proc/irq","fsType":"proc","readOnly":true},{"mountPoint":"/proc/sys","fsType":"proc","readOnly":true},{"mountPoint":"/proc/sysrq-trigger","fsType":"proc","readOnly":true},{"mountPoint":"/proc/acpi","fsType":"tmpfs","readOnly":true},{"mountPoint":"/proc/asound","fsType":"tmpfs","readOnly":true},{"mountPoint":"/proc/interrupts","fsType":"tmpfs","readOnly":false},{"mountPoint":"/proc/kcore","fsType":"tmpfs","readOnly":false},{"mountPoint":"/proc/keys","fsType":"tmpfs","readOnly":false},{"mountPoint":"/proc/latency_stats","fsType":"tmpfs","readOnly":false},{"mountPoint":"/proc/scsi","fsType":"tmpfs","readOnly":true},{"mountPoint":"/proc/timer_list","fsType":"tmpfs","readOnly":false},{"mountPoint":"/sys/firmware","fsType":"tmpfs","readOnly":true}],"envNamesScanned":12,"pass":true},"receipt":{"pass":true,"hits":[]}},"hostProbe":null,"teardown":{"removed":{"containers":["ar-qp-sinkhole-d6fbf70332"],"networks":["ar-qp-net-d6fbf70332"],"volumes":["ar-qp-vol-d6fbf70332"]},"leftoversForTask":[],"hostTempDirs":[]},"knownLimitations":["L-4: ICMP is out of scope: the sandbox has no capability to open raw sockets, and unprivileged ICMP is not logged.","L-4: TLS bodies are not inspected: the sinkhole records the SNI from the ClientHello and refuses the handshake.","UDP other than DNS is logged as an attempt; its original destination comes from the kernel trace when the socket names it.","DNS over TCP is logged as a TCP attempt to port 53 (query name not parsed).","Env-var reads are seen by the in-process preload only; a package can bypass or forge it in its own process. Forged preload records can only add observations; trace-derived completeness markers come from the tracer stream.","Inside the harness process every rule-relevant syscall is attributed to the package (the harness itself performs none).","Paths written through fchdir-relative or unknown directory fds are reported as unresolved and treated as outside the allowed areas.","Side channels inside the kernel (timing, /proc enumeration) are not observed.","L-4: Evasion: in the shared pid namespace a package can see that it is traced (TracerPid, the strace process) and behave benignly; S1 does not hide the tracer.","npm CLI processes do not get the env-read preload (npm fails with a wrapped process.env); an npm started by package code is therefore reported as incomplete instrumentation (review).","L-1: Shell expansion of env variables (e.g. $NPM_TOKEN inside a lifecycle sh) and env reads by sh itself (perl and awk are removed from the image since S2, X10) are invisible to both the kernel trace and the preload (DEC-11r5; their file, network and process activity is still traced and judged).","L-2: DEC-11r4: a package lifecycle that executes a script directly from /work, /tmp or HOME (e.g. \"./install.sh\" rather than \"sh ./install.sh\" or \"node x.js\") fails the instrumentation marker and gets review (i): the trace cannot tell a script from an ELF binary there (fail closed; narrowed in S2, X8).","L-3: Download phase: a non-registry spec in the root manifest aborts before any network request; one deeper in the tree is rejected before it is fetched, but registry metadata of the dependencies visited before it has been fetched. Download-container egress is not limited to the registry host in S1.","L-4: execveat is handled (envp never trusted, SR-3) but is covered by unit tests only, not by a runtime fixture.","L-4: image builds are not byte-reproducible: the bases are pinned by digest, but distribution packages (strace, iptables, tcpdump) are installed at build time.","L-6b: relative file operations of a child process printed before the clone return of its parent have no inherited cwd: they are unresolved, so a write gives (a) and a read gives review (fail closed).","L-8: a chdir by a thread not yet attributed to any process that overlaps an unrelated fork marks that fork raced: relative paths of the child are unresolved (over-condemnation, never install).","L-8b: a benign multi-threaded package whose non-forking thread ever changes directory (e.g. main thread process.chdir while a worker spawns) gets the relative paths of its children unresolved: relative writes give do-not-install (a), relative reads give review. Fail closed by design (dispatch 3).","L-9: a chdir whose outcome is unknown (killed mid-call, \"= ?\", or never resumed before the trace ends) is treated as applied: the cwd of the thread group and of overlapping or later children become unresolved (fail closed).","L-10: a process cloned with CLONE_FS but not CLONE_THREAD shares its working directory with its parent; both sides get an unresolved cwd for the whole trace (fail closed). Only native code issues such a clone; node, dash and perl do not.","L-11: io_uring is not traced. Node 22 / libuv in the sandbox never issues io_uring_setup (checked with UV_USE_IO_URING=1), and native io_uring is denied by the default Docker seccomp profile the sandbox runs under; native code from a writable mount gives review anyway (L-2).","L-13: a native addon (.node) that the package loads can read env in-process with getenv(); there is no exec and no preload record, so only the intent signal (c1) is lost. Same class as L-1: the sandbox env holds no secret value (C7) and any exfiltration still fires (d)/(f).","Sinkhole memory bound: when more than 128 MB is buffered across open connections, the connection holding the most is recorded early with what it sent so far; later bytes on it are not counted.","UDP payloads are logged but, per DEC-2r1, UDP attempts are rated review (f), never do-not-install by payload."],"logs":{"sandboxOutput":"QP-TRACER-ATTACHED\nQP-PHASE copy\nQP-RC copy 0\nQP-PHASE scan\nQP-PHASE rebuild\nrebuilt dependencies successfully\nQP-RC rebuild 0\nQP-PHASE harness\nQP-RC harness 0\nQP-PHASE done\n"},"runs":[{"round":1,"harness":"model","mode":"fallback-require","modelHarness":{"ok":true,"error":null},"container":"ar-qp-sandbox-d6fbf70332","seconds":9.092,"exitCode":0,"endedBy":"exit","limitsHit":[],"observations":7,"traceFile":null}]}