coulomb/glas-harness
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: execute local reins through the sandbox owner
Some checks failed
ci / validate (push) Has been cancelled
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb
This commit is contained in:
tegwick 2026-09-05 19:16:22 +02:00
parent 92392f75f1
commit 63a7f9f160
14 changed files with 463 additions and 81 deletions
Download patch file Download diff file Expand all files Collapse all files

28
workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md
View file

@ -4,11 +4,11 @@ type: workplan
title: "Sandbox-boundary correction and runtime hardening"
domain: infotech
repo: glas-harness
status: blocked
status: finished
owner: codex
topic_slug: sandbox-boundary-runtime-hardening
created: "2026-08-21"
updated: "2026-08-23"
updated: "2026-09-05"
state_hub_workstream_id: "c8049700-73ca-549a-b250-1020de1cddc5"
---
@ -133,7 +133,7 @@ commit `994b2da`.
```task
id: GLAS-WP-0005-T05
status: wait
status: done
priority: high
state_hub_task_id: "a4be4d68-b0af-5273-978a-367bba414f0c"
```
@ -171,6 +171,28 @@ with child `CapEff=0`, but did not make direct namespace entry permissible.
This confirms that T05 needs sand-boxer-owned execution rather than another
consumer-side namespace workaround.
**Completed 2026-09-05:** reviewed sand-boxer `b6655d8` and replaced the stale
T01 direct-nsenter implementation with sandbox-owner execution. Create and exec
now preserve exact actor/project and resolved request id as `consumer.run_id`;
every command carries the profile's value-free credential route references and
a timeout capped by its limit. Task writes and removal both execute inside the
sandbox, with prompt content supplied only over bounded stdin. Unbound local
descriptors, owner refusals, timeouts, and truncated output fail closed.
The real non-secret gateway proof passed in sandbox `e3907e55`: source checkout
absent and mutation refused, a new commit only in the sandbox copy, exact child
identity, mode-0600 task removed before teardown, loopback-only networking,
unchanged host source, and destroyed/absent sandbox workspace. Full suite:
**81 passed**; catalog validation passes. Reproduction and limitations:
[owner boundary evidence](../docs/evidence/GLAS-WP-0005-owner-boundary-2026-09-05.md).
The production runtime/credential/explicit-egress requirements remain live in
registered residual `GLAS-IN-0002` (`01a02b76-f020-7d60-a3ce-12a34c13ebce`),
refreshed before closure with owner responsibilities and real-rein acceptance.
Both local profiles remain blocked and the remote profile unverified. This
closes T05's bounded boundary proof and residual handoff; it does not certify
production rein readiness. Decision: `6d927f9f-d37d-4234-ad97-bad562b31eaf`.
## Overall acceptance
1. No governed rein invocation operates on the caller's original checkout.