coulomb/sand-boxer
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Package sandbox definitions and build a pinned owner runtime
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-09 22:54:39 +02:00
parent bfe0e4c4c8
commit be42de7caf
9 changed files with 127 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

24
docs/bwrap-runtime.md
View file

@ -220,3 +220,27 @@ candidate unchanged. Its installed-path startup/lifecycle proof is
[the local installation receipt](evidence/SAND-WP-0015-protected-local-install-2026-09-08.json).
SAND-WP-0015-T06 is complete. T04 still owns configured execution, native
credential adoption, real-model acceptance and production placement.
## Standalone owner candidate
`build-rein-runtime.py --owner-runtime` verifies rein's runtime-contract lock,
then installs non-editable rein/llm/Glas/sandboxer packages from rein's frozen
uv.lock. The artifact records source pins, package versions and the uv.lock digest.
Use the existing explicit `--claude-binary/--claude-sha256/--claude-version` pin;
a rolling workstation alias is not a candidate input. Console shebangs remain
fixed to the namespace mount; use the candidate interpreter with `-I -B -m` for
host owner commands. No credential, provider call or installation is part of build.
Sandboxer wheels now include profile and extension definitions with packaged-first
lookup and source-checkout fallback. This closes a concrete local-versus-installed
owner discrepancy for bwrap. It is not a claim that every remote backend's external
hosts/templates/tools are packaged or admitted. The ephemeral Messages binding may
select an exact runtime path/digest; usual overlap and default-deny checks apply.
Required `make check`: lint clean, 201 tests passed. Rein's
`scripts/prove-metered-runtime.py` consumes the candidate to test installed imports,
packaged definitions, explicit one-cycle bootstrap, actual pinned CLI/metered stream,
insufficient-capacity refusal and teardown against fixtures. The resulting receipt
belongs to `prj-helixforge-factory/evidence/2026-09-09-owner-bootstrap.json`.
Production installation and credential-holder/empty-egress profile/placement admission
remain SAND-WP-0015-T04 and HFACT-WP-0001-T03/T04; no prior profile is promoted.