coulomb/sand-boxer
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: return combined bwrap runtime candidate to Glas
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Answer the GLAS-WP-0015 handoff for SAND-WP-0015-T04 without activating any
production path.

Add candidate profile profile.claude-agent-dev-proof v1.1.0 (ext.bwrap,
localhost-only, default: deny, declared api.anthropic.com:443) for GLAS-WP-0012
review. The committed profile grants no egress by itself — ext.bwrap refuses it
unless owner extension config independently allowlists the destination — and a
regression test asserts that fail-closed default.

Reconcile the differing project examples in favour of the acceptance runner's
actor agt / project glas-local-proof, keeping the documented credential route
bound to that single project rather than broadening it.

Record the return contract (profile revision, host scope, consumer tuple,
runtime digest and mount paths, declared egress, value-free denial/cleanup
receipts) in docs/bwrap-runtime.md.

T04 stays wait: Claude credential lane, owner machine authentication, pinned
Claude executable and real-model acceptance remain operator gated.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HjyScPKb8MV8y2VZHGFSSV

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 716401@bnt-lap001
Assistant-Session: 0d02392b-d4a8-4fed-98e3-32333f768169
This commit is contained in:
tegwick 2026-09-06 20:34:51 +02:00
parent 17d4160b6e
commit 23d0c2b34d
6 changed files with 124 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

35
docs/bwrap-runtime.md
View file

@ -122,3 +122,38 @@ teardown. Follow-up runtime smoke `d4de9531` repeated the real CLI/startup
checks and proved private state survives a second exec in the same namespace.
The default unconfigured `profile.bwrap-local` still has no selected rein
bundle; candidate startup does not constitute production deployment.
## 2026-09-06 combined-runtime return to Glas (GLAS-WP-0015 handoff)
Returned for `GLAS-WP-0012` review of revision 1.1.0. Nothing here is activated.
| Field | Value |
|---|---|
| Profile | `profile.claude-agent-dev-proof`, version `1.1.0`, `ext.bwrap` |
| Host scope | `localhost` only (`placement.prefer: [localhost]`, no fallback) |
| Consumer tuple | `actor: agt`, `project: glas-local-proof`, nonempty `run_id` |
| Credential route | `glas-claude-agent-dev-anthropic`, exec-env, `ANTHROPIC_API_KEY` |
| Declared egress | `api.anthropic.com:443`, under `network.default: deny` |
| Python runtime digest | `4c316737ec2715936a12c4f49621a5e4be3d1f4fe4739130393f28cdda66fbd9` |
| Runtime mount | read-only `/opt/sandboxer/runtime`, `bin` prepended to child PATH |
| Runtime sources | rein-aharness `1429db5`, llm-connect `0056094`, Python 3.12.3 |
| Claude executable | **not pinned** — no path, no digest, no startup proof |
The project example is reconciled to the acceptance runner's `glas-local-proof`;
the route is not broadened to other Glas projects. See bwrap-credentials.md.
Denial and cleanup evidence already recorded, all value-free: wrong-project
credential denial and next-exec key absence in sandbox `0e5fb35a`; undeclared
`example.com` and direct `1.1.1.1:443` denial with proxy/workspace teardown in
sandbox `e290e788`; read-only runtime, private 0700 HOME, clean worktree, absent
source and loopback-only networking in sandboxes `f333fb66` / `d4de9531`. The
committed profile declares egress but grants none: `ext.bwrap` refuses it unless
the owner extension config independently allowlists the destination, and a
regression test asserts that fail-closed default.
Still operator-blocked, so this profile stays unready: the concrete Claude
credential lane and its delivery/revocation contract (SECRETS-WP-0009 upstream
of CCR-2026-0016), owner machine authentication, the pinned Claude executable
with its own HTTPS_PROXY startup proof, and the real-model acceptance run.
Provider workspace scope and spend limit remain operator inputs; a model
`budget_tokens` setting is not a provider spend limit.