coulomb/glas-harness
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: record production namespace boundary proof
All checks were successful
ci / validate (push) Successful in 1m12s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0233b-178d-7162-b92f-31a31ea8ca9b
This commit is contained in:
tegwick 2026-08-23 01:52:26 +02:00
parent 4061ce860f
commit 5bfc4a6a7d
2 changed files with 21 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

9
docs/intakes/residuals.md
View file

@ -68,6 +68,15 @@ description: |
identity, and network contract needed by both local profiles. Do not restore identity, and network contract needed by both local profiles. Do not restore
host-side execution as a workaround. host-side execution as a workaround.
A production retry on 2026-08-23 removed the upstream actor mismatch and
reached the same boundary with governed actor agt. Glas created sandbox
d750cd5c, then failed closed at session_start before dispatch or commit
because direct nsenter remained Operation not permitted. The sandbox was
destroyed and its workspace removed. Loading Ubuntu's bwrap user-namespace
AppArmor profile kept bwrap alive with child CapEff=0 but did not grant the
consumer namespace-entry authority. This strengthens the owner-exec need; it
does not justify widening host execution.
Done when a non-secret probe and one real rein command execute inside the Done when a non-secret probe and one real rein command execute inside the
namespace, the source checkout is not visible/mutable, required egress is namespace, the source checkout is not visible/mutable, required egress is
explicit, and teardown removes the sandbox workspace. explicit, and teardown removes the sandbox workspace.

13
workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md
View file

@ -8,7 +8,7 @@ status: blocked
owner: codex owner: codex
topic_slug: sandbox-boundary-runtime-hardening topic_slug: sandbox-boundary-runtime-hardening
created: "2026-08-21" created: "2026-08-21"
updated: "2026-08-22" updated: "2026-08-23"
state_hub_workstream_id: "c8049700-73ca-549a-b250-1020de1cddc5" state_hub_workstream_id: "c8049700-73ca-549a-b250-1020de1cddc5"
--- ---
@ -160,6 +160,17 @@ the registered residual was re-sent to sand-boxer in message
`2e203700-6a2c-4d86-8eed-5dea72e69994`. T05 remains `wait`; no unsafe host `2e203700-6a2c-4d86-8eed-5dea72e69994`. T05 remains `wait`; no unsafe host
fallback was introduced. fallback was introduced.
**2026-08-23 production evidence:** rein-aharness deployed the corrected
`worker_id`/`actor` mapping and ran ops run
`ededc939-266f-473c-8386-ffd3f027f5f0` with governed actor `agt`. Glas resolved
the local profile, created sandbox `d750cd5c`, and failed closed at
`session_start` before dispatch or commit because consumer `nsenter` could not
join the bwrap namespaces. The sandbox reached `destroyed` and its workspace is
absent. Loading Ubuntu's bwrap user-namespace AppArmor profile kept bwrap alive
with child `CapEff=0`, but did not make direct namespace entry permissible.
This confirms that T05 needs sand-boxer-owned execution rather than another
consumer-side namespace workaround.
## Overall acceptance ## Overall acceptance
1. No governed rein invocation operates on the caller's original checkout. 1. No governed rein invocation operates on the caller's original checkout.