coulomb/glas-harness
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: execute local reins through the sandbox owner
Some checks failed
ci / validate (push) Has been cancelled
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb
This commit is contained in:
tegwick 2026-09-05 19:16:22 +02:00
parent 92392f75f1
commit 63a7f9f160
14 changed files with 463 additions and 81 deletions
Download patch file Download diff file Expand all files Collapse all files

16
docs/harness-contract.md
View file

@ -72,13 +72,27 @@ publish compact ExecutionEvidence
After sandbox creation, the caller's source checkout is no longer an execution
path. A same-host descriptor must contain `pid` plus `workspace_dir` and every
rein command is wrapped with `nsenter`; a remote descriptor must contain `ssh`
rein command uses the creating manager’s `execute` operation; a remote descriptor must contain `ssh`
plus `remote_dir` and every command crosses SSH. Incomplete, mixed, or unknown
reachability refuses at session start. The transport also bounds the outer rein
subprocess with the profile timeout. A host must make the selected rein command
and its dependencies available inside that transport; host-only installation is
not treated as sandbox availability.
The gateway binds local execution to the exact create-time consumer: actor,
project, and resolved request id as `run_id`. Every owner command forwards the
selected profile's value-free `credential_route_refs` and a timeout capped by
its limit. The binding is process-local and excluded from serialized handles.
An unbound local descriptor refuses execution; no consumer namespace entry or
host execution fallback exists. Owner timeouts and truncated output fail closed.
Generated task specs travel over stdin to an exclusive mode-0600 writer inside
`.git`; removal also crosses the owner boundary. Sand-boxer revision `b6655d8`
or a compatible implementation with bounded `stdin_text` is required.
Run `.venv/bin/python scripts/prove-owner-boundary.py` for a non-secret gateway
boundary proof. It injects deterministic dispatch in place of the agent loop
and does not establish production rein, credential, or egress readiness.
SSH reachability accepts only one non-option host or `user@host` target whose
components begin with an alphanumeric character. Glas also terminates SSH
option parsing with `--`; a reachability descriptor cannot reinterpret its