--- name: reap-root-needs-authenticated-ancestry description: "A kill set rooted on a blank command line plus a one-second start-time coincidence is the unauthenticated-kill defect, rig side; and a catch that prints one string for already-exited and access-denied cannot answer whether you did damage." metadata: node_type: memory type: feedback originSessionId: afca0d6d-6b47-4604-aff2-c6e8141b5483 modified: 2026-08-02T17:09:03.839Z --- Reaping my own stopped build on hfenduleam (2026-08-02, BAROMETER golden rerun window) I took pid 52048 to be my prebuild cargo because its command line was EMPTY and it started one second from mine, made it a ROOT of the kill set, and issued Stop-Process against it and its descendants. It was the CI runner's cargo for the Windows n1-gate leg of the rerun in flight — ancestry `RunnerService -> Runner.Listener -> Runner.Worker -> pwsh -> rustup -> cargo`. One `ParentProcessId` walk, which I ran only AFTER the kill, would have refused it. **Why:** this is the exact shape of the product defect the same milestone was fixing — killing on a bare identifier with no authentication of the target. A blank `CommandLine` is not weak evidence of ownership, it is NO evidence: it is what you get for any process whose cmdline you cannot read, and on a shared box the CI account's processes are precisely the ones that read blank. Start-time proximity is coincidence, not identity — the same class as pid reuse. On a box that is also a CI runner and a live-daemon host, "probably mine" has a wrong-answer cost measured in a voided golden roll. Second half, sharper: my kill loop wrapped `Stop-Process` in a `catch` that printed `gone ` for every failure. Already-exited and access-denied rendered identically, so afterwards I could not say whether four short-lived children died by my hand or on their own — the only question that mattered. Deployah gated it from outside instead: the compile CONCLUDED GREEN, and a build-script/rustc/cl killed mid-flight fails the compile, so the green was the discriminator my instrument could not be. **How to apply:** authenticate every reap root by ancestry before killing — walk `ParentProcessId` to a process you own, and refuse any root whose chain reaches a service, a runner, or an account that is not mine. Blank cmdline plus close start time is a REFUSAL, not a match. Never collapse distinct failure modes into one message in a reaping loop: report exit-already / access-denied / killed separately, because the post-hoc question is always "did I do damage", and a probe that cannot separate those answers it in the flattering direction by default. When it happens anyway, self-report the ambiguity rather than guessing — that is what made it gateable in ten minutes. Related: [[rig-ownership-reap-only-your-own]], [[live-agents-lock-target-debug-spt-exe]], [[pid-reuse-across-reboot]], [[instrument-soundness-guards]], [[start-event-is-not-proof-nothing-ran]].