coulomb/sand-boxer
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix: relocate long-path runtime console launchers
Some checks are pending
CI Smoke / host-smoke (push) Waiting to run
Details
CI Smoke / container-smoke (push) Waiting to run
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e387-534d-70e3-ad53-4ea05676db8c
This commit is contained in:
tegwick 2026-09-27 23:07:44 +02:00
parent 505e82db74
commit 81b5fcff8e
3 changed files with 113 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

27
workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md
View file

@ -9,7 +9,7 @@ flavor: implementation
owner: codex
topic_slug: bwrap-runtime-and-private-state
created: "2026-09-05"
updated: "2026-09-09"
updated: "2026-09-27"
state_hub_workstream_id: "d3f12387-fd23-58f0-b979-9c811507614d"
---
@ -282,3 +282,28 @@ The first standalone candidate exposed a stale cached local wheel despite curren
Git metadata. Owner builds now refresh all local distributions and compare every
installed package source/definition file with its tracked source; stale, missing or
extra files refuse the build. Four content-conformance regressions cover that gap.
## 2026-09-27 installed launcher defect and guarded correction
REINAH-WP-0003's single admitted attempt completed native provider/companion
apply, verify and exec, including scoped-token revocation. The claimed job
`6efa9436-6a91-47c0-94e5-b31b5a0e7e3a` failed before any provider request
reservation. The sandbox was destroyed and the source repository is unchanged.
The parent EUR 10 liability remains held for explicit reconciliation; no retry
or replacement authority is inferred.
Installed artifact `b6e4e8a4` contains uv-generated three-line shell launchers
that still reference a vanished temporary build interpreter. The builder had
only rewritten direct Python shebangs. Fixed both generated forms and added
actual relocation/execution tests for direct, long and space-containing build
paths, plus refusal of unknown governed launchers. Builder tests: 12 passed;
focused lint passes. Rein's real installed bwrap probe reproduces both broken
entrypoints at exit 127 with zero provider forwards; its new bootstrap checks
refuse the malformed artifact before claiming.
T04 remains `wait` and this plan stays `blocked`: replacement artifact build/
admission and a separately authorized successful model/tool/commit proof remain.
The existing SAND-WP-0015 / REINAH-WP-0003 / SECRETS-WP-0009 records retain the
work. No new task or workplan. Detailed non-secret receipts are in rein-aharness
`docs/evidence/2026-09-27-metered-*.json`.