This commit is contained in:
parent
1cd890d871
commit
f773b5c101
19 changed files with 865 additions and 181 deletions
156
workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md
Normal file
156
workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md
Normal file
|
|
@ -0,0 +1,156 @@
|
|||
---
|
||||
id: GLAS-WP-0005
|
||||
type: workplan
|
||||
title: "Sandbox-boundary correction and runtime hardening"
|
||||
domain: infotech
|
||||
repo: glas-harness
|
||||
status: active
|
||||
owner: codex
|
||||
topic_slug: sandbox-boundary-runtime-hardening
|
||||
created: "2026-08-21"
|
||||
updated: "2026-08-21"
|
||||
---
|
||||
|
||||
# Sandbox-boundary correction and runtime hardening
|
||||
|
||||
## Context
|
||||
|
||||
The versioned profile path provisions and tears down sand-boxer instances, but
|
||||
the concrete rein adapters currently prefer the caller's original repository
|
||||
path and invoke their CLIs as ordinary local subprocesses. They do not enter a
|
||||
same-host bwrap namespace or cross the SSH reachability boundary for a remote
|
||||
sandbox. As a result, the existing lifecycle evidence does not prove that the
|
||||
agent process executed inside the selected sandbox, and the enabled remote
|
||||
profile is not executable through its declared transport.
|
||||
|
||||
The review also found persistent task-spec files in `/tmp`, no outer subprocess
|
||||
timeout, an undeclared direct `httpx` dependency, and a Forgejo workflow that
|
||||
only prints routing probes rather than running tests or catalog validation.
|
||||
|
||||
## Goal
|
||||
|
||||
Make every governed execution use the workspace and execution transport
|
||||
declared by the resolved sand-boxer reachability descriptor, fail closed when
|
||||
that descriptor is unsupported, and close the adjacent runtime/CI gaps without
|
||||
changing scheduling, rein credential ownership, or sand-boxer provisioning
|
||||
ownership.
|
||||
|
||||
## Task: Correct workspace and execution transport selection
|
||||
|
||||
```task
|
||||
id: GLAS-WP-0005-T01
|
||||
status: done
|
||||
priority: high
|
||||
```
|
||||
|
||||
Introduce one validated execution transport derived from `SandboxHandle`:
|
||||
|
||||
- same-host bwrap uses `workspace_dir` and enters the namespace identified by
|
||||
`pid` for the rein subprocess;
|
||||
- remote sandboxes use `remote_dir` and the declared SSH endpoint;
|
||||
- the caller's source checkout is never passed to the rein as its execution
|
||||
workspace after sandbox creation; and
|
||||
- missing, ambiguous, or unsupported reachability fails closed before the rein
|
||||
subprocess starts.
|
||||
|
||||
Add tests proving the original checkout is not selected, the expected transport
|
||||
argv is used, remote execution is represented honestly, and teardown still
|
||||
runs on every failure.
|
||||
|
||||
**Completed 2026-08-21:** added strict reachability-derived execution
|
||||
transports. Local descriptors require `pid` + `workspace_dir` and wrap commands
|
||||
with `nsenter`; remote descriptors require `ssh` + `remote_dir` and wrap
|
||||
commands over SSH. Mixed/incomplete descriptors fail closed. The gateway no
|
||||
longer passes the source checkout to a rein after provisioning, and tests cover
|
||||
transport argv, workspace selection, refusal, cleanup, and teardown.
|
||||
|
||||
## Task: Bound subprocesses and remove temporary task material
|
||||
|
||||
```task
|
||||
id: GLAS-WP-0005-T02
|
||||
status: done
|
||||
priority: high
|
||||
```
|
||||
|
||||
Enforce the profile timeout on the outer rein subprocess, normalize timeout
|
||||
failures, and remove generated task-spec files on success, ordinary failure,
|
||||
timeout, and interruption. Caller-supplied task files must not be deleted.
|
||||
Record and safely remove already-orphaned `glas-harness-task-*.json` files after
|
||||
their exact scope is verified.
|
||||
|
||||
**Completed 2026-08-21:** the profile timeout now bounds the outer transport
|
||||
subprocess. Generated task specs are mode-0600 files inside the sandbox
|
||||
workspace and the gateway calls rein cleanup before sandbox teardown on every
|
||||
terminal path; caller-owned task files are preserved. Verified all 22 legacy
|
||||
`/tmp/glas-harness-task-*.json` files were owned by the current user, mode 0600,
|
||||
and valid Glas task specs with no active rein process, then securely removed
|
||||
those exact files.
|
||||
|
||||
## Task: Repair package dependency metadata
|
||||
|
||||
```task
|
||||
id: GLAS-WP-0005-T03
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Declare direct runtime dependencies directly, build the wheel, install it in an
|
||||
isolated environment with the sandbox extra, and validate that packaged profile
|
||||
and rein data resolve without relying on the source checkout.
|
||||
|
||||
**Completed 2026-08-21:** declared `httpx>=0.27` directly. Built the wheel with
|
||||
uv, installed it outside the checkout, resolved all three profiles from packaged
|
||||
data, verified both rein descriptors are present, and inspected wheel metadata
|
||||
for direct and optional dependencies.
|
||||
|
||||
## Task: Replace routing-only CI with executable validation
|
||||
|
||||
```task
|
||||
id: GLAS-WP-0005-T04
|
||||
status: progress
|
||||
priority: high
|
||||
```
|
||||
|
||||
Make Forgejo CI check out the repository, install the project and its test
|
||||
dependencies, run the full unit suite, and run `glas-harness profiles`. Retain
|
||||
only routing probes that still provide operational value.
|
||||
|
||||
**Implemented 2026-08-21:** replaced the two echo-only jobs with the estate's
|
||||
archive-checkout pattern, explicit Python/sand-boxer/project installation, the
|
||||
full test suite, and packaged catalog validation. Closure waits on the first
|
||||
post-push Forgejo run.
|
||||
|
||||
## Task: Re-prove the sandbox boundary and close evidence
|
||||
|
||||
```task
|
||||
id: GLAS-WP-0005-T05
|
||||
status: wait
|
||||
priority: high
|
||||
```
|
||||
|
||||
Run offline boundary tests and, where the already-approved local runtime permits
|
||||
it, a bounded non-secret bwrap proof showing that execution targets the sandbox
|
||||
copy and cannot mutate the source checkout. Correct prior evidence claims rather
|
||||
than silently treating lifecycle-only proof as isolation proof. Run the full
|
||||
suite and catalog validation, synchronize work records, and hand off any live
|
||||
residual before finishing the workplan.
|
||||
|
||||
**2026-08-21 boundary recheck:** offline transport/package tests pass and the
|
||||
prior GLAS-WP-0004 evidence now explicitly withdraws its isolation implication.
|
||||
A real managed-agent bwrap probe failed closed: direct `nsenter` was denied on
|
||||
the reported namespace and neither rein command is mounted inside the bwrap
|
||||
root. The source checkout is no longer used as a fallback. Runtime mounting,
|
||||
owner-exec, network, and credential delivery are handed off as residual
|
||||
`GLAS-IN-0002`; live positive proof waits on that owner contract.
|
||||
|
||||
## Overall acceptance
|
||||
|
||||
1. No governed rein invocation operates on the caller's original checkout.
|
||||
2. The selected process crosses the declared local namespace or remote SSH
|
||||
boundary, or fails closed without execution.
|
||||
3. Profile timeouts bound the outer subprocess and generated task files do not
|
||||
survive any terminal path.
|
||||
4. Package metadata names every direct dependency and the built artifact carries
|
||||
the executable profile/rein catalog.
|
||||
5. Forgejo CI executes tests plus catalog validation.
|
||||
6. Evidence distinguishes sandbox lifecycle from verified sandbox execution.
|
||||
Loading…
Add table
Add a link
Reference in a new issue