[Security] Scope orphan cleanup to Local Studio-owned processes

[fettpl]

Summary

Replace command-signature orphan cleanup with durable, fail-closed ownership proof. Local Studio records each native or Docker launch as a distinct generation and signals a process group or container only after revalidating that exact generation against live process identity.

Unrelated VLLM::Worker processes, PID or PGID reuse, stale ownership state, unreadable inventory, and ownership races therefore cannot authorize TERM or KILL.

Closes #228

Root cause

The prior cleanup path treated process shape as ownership: a PPID-1, non-zombie command containing VLLM::Worker could be selected for cleanup. That evidence does not identify which controller launched a process and is unsafe on shared hosts, after PID reuse, or alongside independently managed vLLM deployments.

Solution design

Durable launch ownership

• Persist a schema-validated launch generation beneath the controller data directory using owner-only directories/files and atomic writes.
• Record native launch identity, process group, launch marker, backend and recipe metadata, plus Docker daemon and canonical executable binding.
• Compare-and-delete only the exact generation that was proved and acted on.

Fail-closed live identity

• Extend process inventory with PGID and a stable start identity under a stable locale.
• Require durable generation data plus current live identity before native signaling; argv text alone is never authority.
• Treat malformed inventory, unreadable identity, marker loss, PID/PGID reuse, and ambiguous candidates as negative authorization.
• Revalidate the canonical Docker executable, daemon, launch label, and container identity before cleanup.

Race-safe lifecycle

• Serialize launch activation and proof-to-action with a private cross-process generation lock.
• Reclaim only demonstrably stale lock owners.
• Keep incomplete ownership state for later reconciliation and remove it only after the owned target is confirmed gone.
• Make startup reconciliation lazy, retryable after failure, and single-flight for concurrent callers.
• Clean Effect launch fibers and process resources on interruption and shutdown, including the retained Windows in-memory cleanup path.
• Integrate on exact dependency [CI/CD] Gate every release on the exact commit that passed CI #244 commit 3cdd3a6402308c1d7a25816205cdedd7e73688f6 and current main 08bcba27f137f9c3d0206ea811d0aa7548a2dfa6.

Acceptance criteria

• No argv substring is sufficient authority to signal a process.
• Native TERM/KILL requires an exact persisted generation plus revalidated live identity and launch marker.
• PID/PGID reuse, malformed state, stale records, unreadable inventory, and generation replacement fail closed.
• Verified native groups reconcile after controller or parent loss and support TERM-to-KILL escalation.
• Docker cleanup is bound to the persisted canonical executable, daemon, launch label, and container identity.
• Ownership persistence is atomic, owner-only, and compare-and-delete protected.
• Concurrent controllers and crash-recovered locks cannot widen cleanup authority.
• Tests assert no signal for unrelated, ambiguous, or replaced targets.

Validation

• Final independently reviewed commit: 1c0e7a11b5ae08dab3d08e5af9710aefce26c3fe; no P0/P1 blockers found.
• npm run check: passed, including contracts, repository structure, frontend quality/build, controller typechecks, lint, dead-code, duplication, dependency, and standards gates.
• Exact-head focused process suite: 48 tests, 194 assertions, 0 failures.
• Release workflow tests: 3 passed, 0 failed.
• git diff --check and dependency ancestry checks passed; the tracked worktree was clean before publication.
• Normal pre-push hooks passed on the published exact head, including the complete frontend quality/build gate; no hook was bypassed.
• The unique [Security] Scope orphan cleanup to Local Studio-owned processes #247 diff against exact [CI/CD] Gate every release on the exact commit that passed CI #244 is controller-only, with no frontend or desktop behavior delta.

The repository does not define npm --prefix frontend run test or root npm run test:integration; those unavailable commands are not represented as passing.

UI changes

None. Frontend package and workflow files are present only through the exact #244 dependency.

Risks and rollout notes

• Platform process metadata can be unavailable or malformed. Cleanup deliberately fails closed and retains ownership state instead of signaling an unproved target.
• A crash can leave a generation or lock behind. Stable process identity, bounded stale-lock recovery, and retryable reconciliation recover only when ownership can still be proved.
• A race can replace process or Docker identity between discovery and action. Proof, revalidation, action, settling, and compare-delete remain inside the same generation lock.
• Fail-closed behavior can leave an owned orphan running when the host cannot provide sufficient identity. That residue is preferable to terminating unrelated work and remains eligible for later verified reconciliation.

[fettpl]

@0xSero PR #247 is now mergeable at independently approved exact head 1c0e7a11b5ae08dab3d08e5af9710aefce26c3fe. Exact dependency ancestry, the full repository gate, 48 focused ownership/process tests, diff checks, and the normal pre-push quality/build hook all passed. Current-head CI and Security runs are action_required with no executable jobs, pending upstream workflow approval; no genuine CI failure is present. Please approve the runs and review when convenient.