tegwick
0c3d8e1a88
All checks were successful
ci / validate (push) Successful in 3m12s
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb
25 lines
1.5 KiB
Markdown
25 lines
1.5 KiB
Markdown
# Local provider egress acceptance
|
|
|
|
Sand-boxer now supports owner allowlisted HTTPS CONNECT egress with isolated
|
|
network namespaces. No credentials were read or model calls made.
|
|
|
|
- Extension smoke sandbox `e290e788`: Anthropic verified TLS, HTTP 404;
|
|
undeclared example.com and direct 1.1.1.1:443 denied; proxy/workspace removed.
|
|
- Persisted-manager smoke sandbox `1c64fa89`: the same checks passed after
|
|
reconstructing the manager/store, including proxy teardown from saved state.
|
|
- Glas regression: 101 tests passed in its .venv. The system Python lacks the
|
|
sandboxer dependency and could not collect the suite; the configured venv passed.
|
|
- Glas deterministic boundary smoke `741a9b87`: source absent/unchanged,
|
|
exact identity, task mode0600/removal, only lo and workspace teardown passed.
|
|
|
|
Implementation and scope: ../sand-boxer/docs/bwrap-egress.md. The proxy enforces
|
|
connection destinations, not HTTP path or TLS SNI on shared hosting; the trusted
|
|
host resolver supplies addresses and non-global results refuse. Existing
|
|
production profiles remain blocked and opt out of the new egress by default.
|
|
|
|
Remaining GLAS-WP-0012-T02 / SAND-WP-0015-T04: concrete machine auth binding,
|
|
protected credential delivery from confirmed KV version 2, pinned Claude
|
|
executable and real authentication/task acceptance. The platform CCR applier
|
|
currently supports OIDC/Kubernetes and transitional token auth, not AppRole;
|
|
local machine identity must be implemented through its owner before activation.
|
|
Do not use the operator UI session as runtime authentication.
|