coulomb/sand-boxer
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Package pinned native Claude and prove isolated startup
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb
This commit is contained in:
tegwick 2026-09-06 23:51:50 +02:00
parent cfc79d51af
commit 174dba17b6
7 changed files with 299 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

43
docs/bwrap-runtime.md
View file

@ -58,9 +58,9 @@ It imports the rein's Claude adapter and llm-connect, runs `rein-aharness
worktree, verifies source absence and a clean Git tree, checks loopback-only
networking, and tears down. This is real CLI startup, not a model task.
The Python bundle does not package or pin the separate Claude executable.
That executable's release, startup behavior, and authentication still require
review in the eventual production runtime. No committed profile selects a
The default Python-only build does not package Claude. The optional explicit
Claude pin and isolated startup proof are documented in the later candidate
section below; production authentication remains a separate gate. No committed profile selects a
temporary `/tmp` build as its production runtime.
## Private writable state
@ -157,3 +157,40 @@ of CCR-2026-0016), owner machine authentication, the pinned Claude executable
with its own HTTPS_PROXY startup proof, and the real-model acceptance run.
Provider workspace scope and spend limit remain operator inputs; a model
`budget_tokens` setting is not a provider spend limit.
## Pinned Claude candidate and isolated startup — 2026-09-06
The builder now accepts `--claude-binary`, `--claude-sha256` and
`--claude-version` together. It requires a regular native ELF file, verifies the
exact copied bytes, refuses symlinks/wrappers/mismatches and existing destination
files, and copies only the executable as bin/claude mode 0755. The expected
version is metadata until the sandbox smoke checks the actual output. No
interactive HOME, provider key or login state is copied.
Candidate provenance: the explicitly selected installed native release
`/home/worsch/.local/share/claude/versions/2.1.263`, SHA-256
`26d020351e8112f4006790f3cfce43b4c9df0c1bb1d0e542364d64151b81d5ba`.
This is a digest pin of the selected local artifact, not an upstream signature
verification claim. Complete runtime candidate:
`/tmp/sandboxer-claude-runtime-20260906`, SHA-256
`5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`.
Mount remains `/opt/sandboxer/runtime`; Claude is `/opt/sandboxer/runtime/bin/claude`.
Rein sources remain 1429db5 / llm-connect 0056094; resolved dependency versions
are recorded in the evidence. Rebuilding may resolve different dependencies;
the complete digest pins this artifact, not future builds.
Sandbox f8821ec2 ran real `claude --version` -> `2.1.263 (Claude Code)` plus rein
CLI/import checks, with owner allowlisted provider egress and HTTPS_PROXY set
by the broker. Runtime read-only, private 0700 HOME/state persistence, clean Git,
absent source and loopback-only interfaces passed; workspace and proxy removed.
`make check`: lint passed, 175 tests passed.
Evidence: docs/evidence/SAND-WP-0015-claude-startup-2026-09-06.json.
Reproduce with the builder options above and `scripts/smoke-bwrap-runtime.py
--runtime-path <candidate> --runtime-sha256 <digest> --claude-version 2.1.263`.
Limits: `--version` proves startup with the proxy environment, not that Claude
has sent a provider request through it. No credential acquisition or model run.
The /tmp candidate is not production placement; protected artifact installation,
owner configuration, credential adoption and real-model proof remain T04 gates.