Runtime isolation and fault containment

Isolated process for Logistics

Logistics runs as a separate OS process from core, communicating only through the contract

Depends on: ARCH-0001

Sandbox permissions for Logistics process

Least privilege: only its own data folder, network sockets it needs and sensors it uses

Depends on: ARCH-0001

Own working directory and data folder

Separate folders for DB, logs, cache and backups

Depends on: ARCH-0001

Crash containment

A Logistics crash is caught at the process boundary; core continues unchanged

Depends on: ARCH-0001, ARCH-0042

Core crash containment from Logistics side

Logistics keeps running in read-mostly mode if core is down and queues outbound events

Depends on: ARCH-0001

Watchdog supervisor

Small supervisor restarts a crashed or hung compartment with backoff

Depends on: ARCH-0001, ARCH-0042

Heartbeat between compartments

Periodic liveness signal over the contract channel

Depends on: ARCH-0001

Restart backoff and crash-loop breaker

Stop restarting after repeated crashes and show a clear status

Depends on: ARCH-0001

Resource limits (memory, CPU, disk)

Limits so Logistics cannot starve core

Depends on: ARCH-0001

Disk quota for Logistics data

Prevent board data from filling the disk used by core

Depends on: ARCH-0001

Outbound event queue (outbox) per side

Durable queue holds events while the other side is down

Depends on: ARCH-0001

Inbound event dedupe

Idempotent processing of replayed events

Depends on: ARCH-0001

Timeouts and circuit breaker on contract calls

Calls fail fast and circuit opens after repeated failures

Depends on: ARCH-0001

Graceful degradation: Logistics missing

Core hides overlay features and keeps all POS functions

Depends on: ARCH-0001

Graceful degradation: core missing or outdated

Logistics runs standalone with its own identity and offline features; integration features are disabled with clear messages

Depends on: ARCH-0001

Graceful degradation: contract mismatch

Fall back to the highest common contract version or disable integration only

Depends on: ARCH-0001

Read-only safe mode

Compartment can open data read-only when migration or integrity checks fail

Depends on: ARCH-0001

Integrity check on start (per compartment)

SQLite integrity_check and schema version check each start

Depends on: ARCH-0001

Panic-free error handling policy

No unhandled exceptions cross the boundary; errors become contract errors

Depends on: ARCH-0001

Memory-safe implementation requirement

Logistics core logic in a memory-safe language consistent with the stack recommendation

Depends on: ARCH-0001

Separate crash reports stored locally

Local crash dumps per compartment, never uploaded

Depends on: ARCH-0001

Compartment status panel

UI shows state, version, last heartbeat and last error of each compartment

Depends on: ARCH-0001

Restart compartment from UI

User can restart Logistics without restarting core

Depends on: ARCH-0001

Window isolation (UI)

Logistics window renders from its own process or isolated view; a UI crash does not close core windows

Depends on: ARCH-0001

Single login with scoped session

Core issues a scoped session token; Logistics cannot read core secrets

Depends on: ARCH-0001

Key separation (separate rating key)

Logistics keys are separate from core fiscal keys and certificates

Depends on: ARCH-0001