glas-harness/workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated
GLAS-WP-0005	workplan	Sandbox-boundary correction and runtime hardening	infotech	glas-harness	blocked	codex	sandbox-boundary-runtime-hardening	2026-08-21	2026-08-21

Sandbox-boundary correction and runtime hardening

Context

The versioned profile path provisions and tears down sand-boxer instances, but the concrete rein adapters currently prefer the caller's original repository path and invoke their CLIs as ordinary local subprocesses. They do not enter a same-host bwrap namespace or cross the SSH reachability boundary for a remote sandbox. As a result, the existing lifecycle evidence does not prove that the agent process executed inside the selected sandbox, and the enabled remote profile is not executable through its declared transport.

The review also found persistent task-spec files in /tmp, no outer subprocess timeout, an undeclared direct httpx dependency, and a Forgejo workflow that only prints routing probes rather than running tests or catalog validation.

Goal

Make every governed execution use the workspace and execution transport declared by the resolved sand-boxer reachability descriptor, fail closed when that descriptor is unsupported, and close the adjacent runtime/CI gaps without changing scheduling, rein credential ownership, or sand-boxer provisioning ownership.

Task: Correct workspace and execution transport selection

id: GLAS-WP-0005-T01
status: done
priority: high

Introduce one validated execution transport derived from SandboxHandle:

• same-host bwrap uses workspace_dir and enters the namespace identified by pid for the rein subprocess;
• remote sandboxes use remote_dir and the declared SSH endpoint;
• the caller's source checkout is never passed to the rein as its execution workspace after sandbox creation; and
• missing, ambiguous, or unsupported reachability fails closed before the rein subprocess starts.

Add tests proving the original checkout is not selected, the expected transport argv is used, remote execution is represented honestly, and teardown still runs on every failure.

Completed 2026-08-21: added strict reachability-derived execution transports. Local descriptors require pid + workspace_dir and wrap commands with nsenter; remote descriptors require ssh + remote_dir and wrap commands over SSH. Mixed/incomplete descriptors fail closed. The gateway no longer passes the source checkout to a rein after provisioning, and tests cover transport argv, workspace selection, refusal, cleanup, and teardown.

Task: Bound subprocesses and remove temporary task material

id: GLAS-WP-0005-T02
status: done
priority: high

Enforce the profile timeout on the outer rein subprocess, normalize timeout failures, and remove generated task-spec files on success, ordinary failure, timeout, and interruption. Caller-supplied task files must not be deleted. Record and safely remove already-orphaned glas-harness-task-*.json files after their exact scope is verified.

Completed 2026-08-21: the profile timeout now bounds the outer transport subprocess. Generated task specs are mode-0600 files inside the sandbox workspace and the gateway calls rein cleanup before sandbox teardown on every terminal path; caller-owned task files are preserved. Verified all 22 legacy /tmp/glas-harness-task-*.json files were owned by the current user, mode 0600, and valid Glas task specs with no active rein process, then securely removed those exact files.

Task: Repair package dependency metadata

id: GLAS-WP-0005-T03
status: done
priority: medium

Declare direct runtime dependencies directly, build the wheel, install it in an isolated environment with the sandbox extra, and validate that packaged profile and rein data resolve without relying on the source checkout.

Completed 2026-08-21: declared httpx>=0.27 directly. Built the wheel with uv, installed it outside the checkout, resolved all three profiles from packaged data, verified both rein descriptors are present, and inspected wheel metadata for direct and optional dependencies.

Task: Replace routing-only CI with executable validation

id: GLAS-WP-0005-T04
status: done
priority: high

Make Forgejo CI check out the repository, install the project and its test dependencies, run the full unit suite, and run glas-harness profiles. Retain only routing probes that still provide operational value.

Completed 2026-08-21: replaced the two echo-only jobs with the estate's archive-checkout pattern, explicit Python/sand-boxer/project installation, the full test suite, and packaged catalog validation. Run #45 was superseded and canceled; run #46 exposed five tests that incorrectly relied on the host's global Git author identity. The same job reproduced this cleanly in the runner's node:20-bookworm image, and the test repositories now configure a local, non-deliverable test identity. Forgejo Actions run #47 passed on published commit 994b2da.

Task: Re-prove the sandbox boundary and close evidence

id: GLAS-WP-0005-T05
status: wait
priority: high

Run offline boundary tests and, where the already-approved local runtime permits it, a bounded non-secret bwrap proof showing that execution targets the sandbox copy and cannot mutate the source checkout. Correct prior evidence claims rather than silently treating lifecycle-only proof as isolation proof. Run the full suite and catalog validation, synchronize work records, and hand off any live residual before finishing the workplan.

2026-08-21 boundary recheck: offline transport/package tests pass and the prior GLAS-WP-0004 evidence now explicitly withdraws its isolation implication. A real managed-agent bwrap probe failed closed: direct nsenter was denied on the reported namespace and neither rein command is mounted inside the bwrap root. The source checkout is no longer used as a fallback. Runtime mounting, owner-exec, network, and credential delivery are handed off as residual GLAS-IN-0002; live positive proof waits on that owner contract.

Overall acceptance

1. No governed rein invocation operates on the caller's original checkout.
2. The selected process crosses the declared local namespace or remote SSH boundary, or fails closed without execution.
3. Profile timeouts bound the outer subprocess and generated task files do not survive any terminal path.
4. Package metadata names every direct dependency and the built artifact carries the executable profile/rein catalog.
5. Forgejo CI executes tests plus catalog validation.
6. Evidence distinguishes sandbox lifecycle from verified sandbox execution.