glas-harness/workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	state_hub_workstream_id
GLAS-WP-0005	workplan	Sandbox-boundary correction and runtime hardening	infotech	glas-harness	finished	codex	sandbox-boundary-runtime-hardening	2026-08-21	2026-09-05	c8049700-73ca-549a-b250-1020de1cddc5

Sandbox-boundary correction and runtime hardening

Context

The versioned profile path provisions and tears down sand-boxer instances, but the concrete rein adapters currently prefer the caller's original repository path and invoke their CLIs as ordinary local subprocesses. They do not enter a same-host bwrap namespace or cross the SSH reachability boundary for a remote sandbox. As a result, the existing lifecycle evidence does not prove that the agent process executed inside the selected sandbox, and the enabled remote profile is not executable through its declared transport.

The review also found persistent task-spec files in /tmp, no outer subprocess timeout, an undeclared direct httpx dependency, and a Forgejo workflow that only prints routing probes rather than running tests or catalog validation.

Goal

Make every governed execution use the workspace and execution transport declared by the resolved sand-boxer reachability descriptor, fail closed when that descriptor is unsupported, and close the adjacent runtime/CI gaps without changing scheduling, rein credential ownership, or sand-boxer provisioning ownership.

Task: Correct workspace and execution transport selection

id: GLAS-WP-0005-T01
status: done
priority: high
state_hub_task_id: "fc29c99f-6938-5450-868e-1a94123995f4"

Introduce one validated execution transport derived from SandboxHandle:

• same-host bwrap uses workspace_dir and enters the namespace identified by pid for the rein subprocess;
• remote sandboxes use remote_dir and the declared SSH endpoint;
• the caller's source checkout is never passed to the rein as its execution workspace after sandbox creation; and
• missing, ambiguous, or unsupported reachability fails closed before the rein subprocess starts.

Add tests proving the original checkout is not selected, the expected transport argv is used, remote execution is represented honestly, and teardown still runs on every failure.

Completed 2026-08-21: added strict reachability-derived execution transports. Local descriptors require pid + workspace_dir and wrap commands with nsenter; remote descriptors require ssh + remote_dir and wrap commands over SSH. Mixed/incomplete descriptors fail closed. The gateway no longer passes the source checkout to a rein after provisioning, and tests cover transport argv, workspace selection, refusal, cleanup, and teardown.

Task: Bound subprocesses and remove temporary task material

id: GLAS-WP-0005-T02
status: done
priority: high
state_hub_task_id: "219ecaeb-c576-5b93-b65c-6445ebd3d139"

Enforce the profile timeout on the outer rein subprocess, normalize timeout failures, and remove generated task-spec files on success, ordinary failure, timeout, and interruption. Caller-supplied task files must not be deleted. Record and safely remove already-orphaned glas-harness-task-*.json files after their exact scope is verified.

Completed 2026-08-21: the profile timeout now bounds the outer transport subprocess. Generated task specs are mode-0600 files inside the sandbox workspace and the gateway calls rein cleanup before sandbox teardown on every terminal path; caller-owned task files are preserved. Verified all 22 legacy /tmp/glas-harness-task-*.json files were owned by the current user, mode 0600, and valid Glas task specs with no active rein process, then securely removed those exact files.

Task: Repair package dependency metadata

id: GLAS-WP-0005-T03
status: done
priority: medium
state_hub_task_id: "0c57d3a4-40d4-5764-a0df-7c03c58fa23e"

Declare direct runtime dependencies directly, build the wheel, install it in an isolated environment with the sandbox extra, and validate that packaged profile and rein data resolve without relying on the source checkout.

Completed 2026-08-21: declared httpx>=0.27 directly. Built the wheel with uv, installed it outside the checkout, resolved all three profiles from packaged data, verified both rein descriptors are present, and inspected wheel metadata for direct and optional dependencies.

Task: Replace routing-only CI with executable validation

id: GLAS-WP-0005-T04
status: done
priority: high
state_hub_task_id: "222d9df6-5361-5b5e-8236-8fa3a1fbe3bf"

Make Forgejo CI check out the repository, install the project and its test dependencies, run the full unit suite, and run glas-harness profiles. Retain only routing probes that still provide operational value.

Completed 2026-08-21: replaced the two echo-only jobs with the estate's archive-checkout pattern, explicit Python/sand-boxer/project installation, the full test suite, and packaged catalog validation. Run #45 was superseded and canceled; run #46 exposed five tests that incorrectly relied on the host's global Git author identity. The same job reproduced this cleanly in the runner's node:20-bookworm image, and the test repositories now configure a local, non-deliverable test identity. Forgejo Actions run #47 passed on published commit 994b2da.

Task: Re-prove the sandbox boundary and close evidence

id: GLAS-WP-0005-T05
status: done
priority: high
state_hub_task_id: "a4be4d68-b0af-5273-978a-367bba414f0c"

Run offline boundary tests and, where the already-approved local runtime permits it, a bounded non-secret bwrap proof showing that execution targets the sandbox copy and cannot mutate the source checkout. Correct prior evidence claims rather than silently treating lifecycle-only proof as isolation proof. Run the full suite and catalog validation, synchronize work records, and hand off any live residual before finishing the workplan.

2026-08-21 boundary recheck: offline transport/package tests pass and the prior GLAS-WP-0004 evidence now explicitly withdraws its isolation implication. A real managed-agent bwrap probe failed closed: direct nsenter was denied on the reported namespace and neither rein command is mounted inside the bwrap root. The source checkout is no longer used as a fallback. Runtime mounting, owner-exec, network, and credential delivery are handed off as residual GLAS-IN-0002; live positive proof waits on that owner contract.

2026-08-22 coordination: primary registrar reconciliation assigned the workplan, all tasks, and GLAS-IN-0002 authoritative State Hub identities. A fresh owner check found no sand-boxer implementation or returned contract, so the registered residual was re-sent to sand-boxer in message 2e203700-6a2c-4d86-8eed-5dea72e69994. T05 remains wait; no unsafe host fallback was introduced.

2026-08-23 production evidence: rein-aharness deployed the corrected worker_id/actor mapping and ran ops run ededc939-266f-473c-8386-ffd3f027f5f0 with governed actor agt. Glas resolved the local profile, created sandbox d750cd5c, and failed closed at session_start before dispatch or commit because consumer nsenter could not join the bwrap namespaces. The sandbox reached destroyed and its workspace is absent. Loading Ubuntu's bwrap user-namespace AppArmor profile kept bwrap alive with child CapEff=0, but did not make direct namespace entry permissible. This confirms that T05 needs sand-boxer-owned execution rather than another consumer-side namespace workaround.

Completed 2026-09-05: reviewed sand-boxer b6655d8 and replaced the stale T01 direct-nsenter implementation with sandbox-owner execution. Create and exec now preserve exact actor/project and resolved request id as consumer.run_id; every command carries the profile's value-free credential route references and a timeout capped by its limit. Task writes and removal both execute inside the sandbox, with prompt content supplied only over bounded stdin. Unbound local descriptors, owner refusals, timeouts, and truncated output fail closed.

The real non-secret gateway proof passed in sandbox e3907e55: source checkout absent and mutation refused, a new commit only in the sandbox copy, exact child identity, mode-0600 task removed before teardown, loopback-only networking, unchanged host source, and destroyed/absent sandbox workspace. Full suite: 81 passed; catalog validation passes. Reproduction and limitations: owner boundary evidence.

The production runtime/credential/explicit-egress requirements remain live in registered residual GLAS-IN-0002 (01a02b76-f020-7d60-a3ce-12a34c13ebce), refreshed before closure with owner responsibilities and real-rein acceptance. Both local profiles remain blocked and the remote profile unverified. This closes T05's bounded boundary proof and residual handoff; it does not certify production rein readiness. Decision: 6d927f9f-d37d-4234-ad97-bad562b31eaf.

Overall acceptance

1. No governed rein invocation operates on the caller's original checkout.
2. The selected process crosses the declared local namespace or remote SSH boundary, or fails closed without execution.
3. Profile timeouts bound the outer subprocess and generated task files do not survive any terminal path.
4. Package metadata names every direct dependency and the built artifact carries the executable profile/rein catalog.
5. Forgejo CI executes tests plus catalog validation.
6. Evidence distinguishes sandbox lifecycle from verified sandbox execution.