Raised by the security re-review of PR #36's delta 3938c1b. The reviewer correctly declined to pin it on that delta — it is a property of the reader's whole cursor-resume design, not of the change under review. Filing it so it isn't lost.
The question
Every --after-cursor call in journald.py assumes that "the first matching entry after cursor X" is deterministic. That assumption underpins:
- the primary
_stream() resume path (ADR-0065's load-bearing guarantee: resume "neither duplicates nor skips")
_peek_cursor_after's claim to return the oversized entry's own cursor
journald merges multiple journal files (system + user journals), and flush-skew between them is real. If that merge can reorder entries relative to a cursor position, the assumption is not universally true.
Why it matters
The failure mode is the worst-shaped one available here: the cursor advances past unread records, silently. No error, no duplicate, just missing events — and an attacker who could influence it would have a detection-evasion primitive.
Note this is NOT hypothetical-only: ADR-0065's cursor-resume guarantee is stated absolutely ("neither duplicates nor skips"). If merge ordering can violate it, the ADR overstates what the design delivers, and that's worth knowing before #2 and #3 build on top of it.
Scope
This is a question, not a defect. Nobody has demonstrated reordering. The honest state is: the guarantee is asserted, the mechanism is not verified against the multi-file merge case, and the cost of being wrong is silent data loss.
Per the house rule (verify against the industry standard — never assume), this should be settled against systemd's actual documented cursor semantics and, ideally, a live test with system+user journals under flush skew — not reasoned from first principles.
Possible outcomes
Suggested owner
Architect. This is an ADR-accuracy question about a settled decision's premise, not an implementation task.
Out of scope
Provenance
Security re-review of #36 delta 3938c1b, 2026-07-15, non-blocking observation 5. Architect's ADR-0065 ruling on the (None, cursor) shape (2026-07-15) cites the same cursor-resume guarantee as load-bearing.
Raised by the security re-review of PR #36's delta
3938c1b. The reviewer correctly declined to pin it on that delta — it is a property of the reader's whole cursor-resume design, not of the change under review. Filing it so it isn't lost.The question
Every
--after-cursorcall injournald.pyassumes that "the first matching entry after cursor X" is deterministic. That assumption underpins:_stream()resume path (ADR-0065's load-bearing guarantee: resume "neither duplicates nor skips")_peek_cursor_after's claim to return the oversized entry's own cursorjournald merges multiple journal files (system + user journals), and flush-skew between them is real. If that merge can reorder entries relative to a cursor position, the assumption is not universally true.
Why it matters
The failure mode is the worst-shaped one available here: the cursor advances past unread records, silently. No error, no duplicate, just missing events — and an attacker who could influence it would have a detection-evasion primitive.
Note this is NOT hypothetical-only: ADR-0065's cursor-resume guarantee is stated absolutely ("neither duplicates nor skips"). If merge ordering can violate it, the ADR overstates what the design delivers, and that's worth knowing before #2 and #3 build on top of it.
Scope
This is a question, not a defect. Nobody has demonstrated reordering. The honest state is: the guarantee is asserted, the mechanism is not verified against the multi-file merge case, and the cost of being wrong is silent data loss.
Per the house rule (verify against the industry standard — never assume), this should be settled against systemd's actual documented cursor semantics and, ideally, a live test with system+user journals under flush skew — not reasoned from first principles.
Possible outcomes
clamav) — local mode #2/Source: Linux auth & intrusion signals (linux_auth) — local mode #3 depend on it.Suggested owner
Architect. This is an ADR-accuracy question about a settled decision's premise, not an implementation task.
Out of scope
Provenance
Security re-review of #36 delta
3938c1b, 2026-07-15, non-blocking observation 5. Architect's ADR-0065 ruling on the(None, cursor)shape (2026-07-15) cites the same cursor-resume guarantee as load-bearing.