coulomb/sand-boxer
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Package pinned native Claude and prove isolated startup
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb
This commit is contained in:
tegwick 2026-09-06 23:51:50 +02:00
parent cfc79d51af
commit 174dba17b6
7 changed files with 299 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

53
workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md
View file

@ -151,3 +151,56 @@ contract, owner machine authentication, the pinned Claude executable with its
own proxy startup proof, and the real-model acceptance are still operator and
upstream-owner gated. Provider workspace scope and spend limit remain operator
inputs. `SAND-WP-0014-T05` remains open on the same gates.
## Package and prove the pinned Claude executable independently of custody
```task
id: SAND-WP-0015-T05
status: done
priority: high
state_hub_task_id: "f0163cda-b581-56a0-a0dd-9c8a436f5bbe"
```
Split the independent executable packaging/startup portion from T04 so credential
custody does not hide completed local runtime work. Implement explicit binary
pinning, reject mismatches/host wrappers, and prove actual startup with the
broker proxy environment and complete cleanup. T04 retains protected deployment,
credential adoption and real-provider acceptance.
## Pinned Claude candidate and isolated startup — 2026-09-06
The builder now accepts `--claude-binary`, `--claude-sha256` and
`--claude-version` together. It requires a regular native ELF file, verifies the
exact copied bytes, refuses symlinks/wrappers/mismatches and existing destination
files, and copies only the executable as bin/claude mode 0755. The expected
version is metadata until the sandbox smoke checks the actual output. No
interactive HOME, provider key or login state is copied.
Candidate provenance: the explicitly selected installed native release
`/home/worsch/.local/share/claude/versions/2.1.263`, SHA-256
`26d020351e8112f4006790f3cfce43b4c9df0c1bb1d0e542364d64151b81d5ba`.
This is a digest pin of the selected local artifact, not an upstream signature
verification claim. Complete runtime candidate:
`/tmp/sandboxer-claude-runtime-20260906`, SHA-256
`5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`.
Mount remains `/opt/sandboxer/runtime`; Claude is `/opt/sandboxer/runtime/bin/claude`.
Rein sources remain 1429db5 / llm-connect 0056094; resolved dependency versions
are recorded in the evidence. Rebuilding may resolve different dependencies;
the complete digest pins this artifact, not future builds.
Sandbox f8821ec2 ran real `claude --version` -> `2.1.263 (Claude Code)` plus rein
CLI/import checks, with owner allowlisted provider egress and HTTPS_PROXY set
by the broker. Runtime read-only, private 0700 HOME/state persistence, clean Git,
absent source and loopback-only interfaces passed; workspace and proxy removed.
`make check`: lint passed, 175 tests passed.
Evidence: docs/evidence/SAND-WP-0015-claude-startup-2026-09-06.json.
Reproduce with the builder options above and `scripts/smoke-bwrap-runtime.py
--runtime-path <candidate> --runtime-sha256 <digest> --claude-version 2.1.263`.
Limits: `--version` proves startup with the proxy environment, not that Claude
has sent a provider request through it. No credential acquisition or model run.
The /tmp candidate is not production placement; protected artifact installation,
owner configuration, credential adoption and real-model proof remain T04 gates.