[GraciousGazelles]

The launcher installer now accepts only package inputs staged as a direct root-owned child of /run, with regular no-follow files and safe ownership/modes. This prevents an unprivileged writable parent from replacing a checked package directory. The fixed target remains atomic, keeps the exact previous binary in root-only rollback storage, and does not start or reload the unit.

The hosted Linux smoke rejects user-owned staging and a root-owned stage under a user-writable parent, then verifies installed and rollback hashes/modes. The existing artifact download path is documented to verify repository, run, source commit, artifact identity, and the API-reported digest before copying the exact package members into protected /run staging; the package checksum is treated as internal consistency only.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-22T10:25:43.668634Z	74061c8	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[gemini-code-assist]

Code Review

This pull request introduces a secure installer script install_runtime_proof_launcher for the runtime-proof launcher, implementing strict validation of staging paths, ownership, permissions, and checksums. It also updates the launcher's parent directory validation in Rust to ensure parent directories are traversable, accompanied by new unit tests and updated documentation. The review feedback suggests improving the robustness of the installer script by using numeric/arithmetic comparisons instead of string comparisons when validating octal file permissions.