160 lines
6.6 KiB
Markdown
160 lines
6.6 KiB
Markdown
---
|
|
id: GLAS-WP-0005
|
|
type: workplan
|
|
title: "Sandbox-boundary correction and runtime hardening"
|
|
domain: infotech
|
|
repo: glas-harness
|
|
status: blocked
|
|
owner: codex
|
|
topic_slug: sandbox-boundary-runtime-hardening
|
|
created: "2026-08-21"
|
|
updated: "2026-08-21"
|
|
---
|
|
|
|
# Sandbox-boundary correction and runtime hardening
|
|
|
|
## Context
|
|
|
|
The versioned profile path provisions and tears down sand-boxer instances, but
|
|
the concrete rein adapters currently prefer the caller's original repository
|
|
path and invoke their CLIs as ordinary local subprocesses. They do not enter a
|
|
same-host bwrap namespace or cross the SSH reachability boundary for a remote
|
|
sandbox. As a result, the existing lifecycle evidence does not prove that the
|
|
agent process executed inside the selected sandbox, and the enabled remote
|
|
profile is not executable through its declared transport.
|
|
|
|
The review also found persistent task-spec files in `/tmp`, no outer subprocess
|
|
timeout, an undeclared direct `httpx` dependency, and a Forgejo workflow that
|
|
only prints routing probes rather than running tests or catalog validation.
|
|
|
|
## Goal
|
|
|
|
Make every governed execution use the workspace and execution transport
|
|
declared by the resolved sand-boxer reachability descriptor, fail closed when
|
|
that descriptor is unsupported, and close the adjacent runtime/CI gaps without
|
|
changing scheduling, rein credential ownership, or sand-boxer provisioning
|
|
ownership.
|
|
|
|
## Task: Correct workspace and execution transport selection
|
|
|
|
```task
|
|
id: GLAS-WP-0005-T01
|
|
status: done
|
|
priority: high
|
|
```
|
|
|
|
Introduce one validated execution transport derived from `SandboxHandle`:
|
|
|
|
- same-host bwrap uses `workspace_dir` and enters the namespace identified by
|
|
`pid` for the rein subprocess;
|
|
- remote sandboxes use `remote_dir` and the declared SSH endpoint;
|
|
- the caller's source checkout is never passed to the rein as its execution
|
|
workspace after sandbox creation; and
|
|
- missing, ambiguous, or unsupported reachability fails closed before the rein
|
|
subprocess starts.
|
|
|
|
Add tests proving the original checkout is not selected, the expected transport
|
|
argv is used, remote execution is represented honestly, and teardown still
|
|
runs on every failure.
|
|
|
|
**Completed 2026-08-21:** added strict reachability-derived execution
|
|
transports. Local descriptors require `pid` + `workspace_dir` and wrap commands
|
|
with `nsenter`; remote descriptors require `ssh` + `remote_dir` and wrap
|
|
commands over SSH. Mixed/incomplete descriptors fail closed. The gateway no
|
|
longer passes the source checkout to a rein after provisioning, and tests cover
|
|
transport argv, workspace selection, refusal, cleanup, and teardown.
|
|
|
|
## Task: Bound subprocesses and remove temporary task material
|
|
|
|
```task
|
|
id: GLAS-WP-0005-T02
|
|
status: done
|
|
priority: high
|
|
```
|
|
|
|
Enforce the profile timeout on the outer rein subprocess, normalize timeout
|
|
failures, and remove generated task-spec files on success, ordinary failure,
|
|
timeout, and interruption. Caller-supplied task files must not be deleted.
|
|
Record and safely remove already-orphaned `glas-harness-task-*.json` files after
|
|
their exact scope is verified.
|
|
|
|
**Completed 2026-08-21:** the profile timeout now bounds the outer transport
|
|
subprocess. Generated task specs are mode-0600 files inside the sandbox
|
|
workspace and the gateway calls rein cleanup before sandbox teardown on every
|
|
terminal path; caller-owned task files are preserved. Verified all 22 legacy
|
|
`/tmp/glas-harness-task-*.json` files were owned by the current user, mode 0600,
|
|
and valid Glas task specs with no active rein process, then securely removed
|
|
those exact files.
|
|
|
|
## Task: Repair package dependency metadata
|
|
|
|
```task
|
|
id: GLAS-WP-0005-T03
|
|
status: done
|
|
priority: medium
|
|
```
|
|
|
|
Declare direct runtime dependencies directly, build the wheel, install it in an
|
|
isolated environment with the sandbox extra, and validate that packaged profile
|
|
and rein data resolve without relying on the source checkout.
|
|
|
|
**Completed 2026-08-21:** declared `httpx>=0.27` directly. Built the wheel with
|
|
uv, installed it outside the checkout, resolved all three profiles from packaged
|
|
data, verified both rein descriptors are present, and inspected wheel metadata
|
|
for direct and optional dependencies.
|
|
|
|
## Task: Replace routing-only CI with executable validation
|
|
|
|
```task
|
|
id: GLAS-WP-0005-T04
|
|
status: done
|
|
priority: high
|
|
```
|
|
|
|
Make Forgejo CI check out the repository, install the project and its test
|
|
dependencies, run the full unit suite, and run `glas-harness profiles`. Retain
|
|
only routing probes that still provide operational value.
|
|
|
|
**Completed 2026-08-21:** replaced the two echo-only jobs with the estate's
|
|
archive-checkout pattern, explicit Python/sand-boxer/project installation, the
|
|
full test suite, and packaged catalog validation. Run `#45` was superseded and
|
|
canceled; run `#46` exposed five tests that incorrectly relied on the host's
|
|
global Git author identity. The same job reproduced this cleanly in the runner's
|
|
`node:20-bookworm` image, and the test repositories now configure a local,
|
|
non-deliverable test identity. Forgejo Actions run `#47` passed on published
|
|
commit `994b2da`.
|
|
|
|
## Task: Re-prove the sandbox boundary and close evidence
|
|
|
|
```task
|
|
id: GLAS-WP-0005-T05
|
|
status: wait
|
|
priority: high
|
|
```
|
|
|
|
Run offline boundary tests and, where the already-approved local runtime permits
|
|
it, a bounded non-secret bwrap proof showing that execution targets the sandbox
|
|
copy and cannot mutate the source checkout. Correct prior evidence claims rather
|
|
than silently treating lifecycle-only proof as isolation proof. Run the full
|
|
suite and catalog validation, synchronize work records, and hand off any live
|
|
residual before finishing the workplan.
|
|
|
|
**2026-08-21 boundary recheck:** offline transport/package tests pass and the
|
|
prior GLAS-WP-0004 evidence now explicitly withdraws its isolation implication.
|
|
A real managed-agent bwrap probe failed closed: direct `nsenter` was denied on
|
|
the reported namespace and neither rein command is mounted inside the bwrap
|
|
root. The source checkout is no longer used as a fallback. Runtime mounting,
|
|
owner-exec, network, and credential delivery are handed off as residual
|
|
`GLAS-IN-0002`; live positive proof waits on that owner contract.
|
|
|
|
## Overall acceptance
|
|
|
|
1. No governed rein invocation operates on the caller's original checkout.
|
|
2. The selected process crosses the declared local namespace or remote SSH
|
|
boundary, or fails closed without execution.
|
|
3. Profile timeouts bound the outer subprocess and generated task files do not
|
|
survive any terminal path.
|
|
4. Package metadata names every direct dependency and the built artifact carries
|
|
the executable profile/rein catalog.
|
|
5. Forgejo CI executes tests plus catalog validation.
|
|
6. Evidence distinguishes sandbox lifecycle from verified sandbox execution.
|