feat: pin bwrap rein runtimes and isolate private state
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb
This commit is contained in:
parent
c2886b2f77
commit
d69827aaa2
12 changed files with 639 additions and 9 deletions
|
|
@ -8,7 +8,7 @@ status: active
|
|||
owner: codex
|
||||
topic_slug: owner-mediated-execution
|
||||
created: "2026-09-04"
|
||||
updated: "2026-09-04"
|
||||
updated: "2026-09-05"
|
||||
state_hub_workstream_id: "b616d1cd-208f-5ecf-a4a0-a028396422c4"
|
||||
---
|
||||
|
||||
|
|
@ -112,9 +112,16 @@ destroy the workspace, then update Glas readiness and Activity Core
|
|||
`ACTIVITY-WP-0032-T05`. Do not trigger the production pilot before readiness
|
||||
changes.
|
||||
|
||||
This task depends on a reviewed Glas profile revision, the owner-fronted
|
||||
`rein-openweights-openrouter-approle` read, and a deployed sand-boxer owner
|
||||
service. No credential value belongs in this workplan or State Hub.
|
||||
This task depends on a reviewed Glas profile revision and its matching
|
||||
credential/egress/runtime contract. Glas selected the Claude route first in
|
||||
GLAS-WP-0012; the earlier OpenRouter AppRole dependency applies only to the
|
||||
separate open-weight profile and does not establish Claude authentication.
|
||||
|
||||
2026-09-05: SAND-WP-0015 implements pinned Python runtime mounts and private
|
||||
namespace state, with a real rein CLI startup proof. Claude workload credential
|
||||
routing, enforced provider egress, pinning/deploying the Claude executable,
|
||||
and the real-model acceptance remain open in SAND-WP-0015-T04. No credential
|
||||
value belongs in this workplan or State Hub.
|
||||
|
||||
## Acceptance criteria
|
||||
|
||||
|
|
|
|||
109
workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md
Normal file
109
workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md
Normal file
|
|
@ -0,0 +1,109 @@
|
|||
---
|
||||
id: SAND-WP-0015
|
||||
type: workplan
|
||||
title: "Provide a pinned bwrap rein runtime and private state"
|
||||
domain: infotech
|
||||
repo: sand-boxer
|
||||
status: blocked
|
||||
owner: codex
|
||||
topic_slug: bwrap-runtime-and-private-state
|
||||
created: "2026-09-05"
|
||||
updated: "2026-09-05"
|
||||
state_hub_workstream_id: "d3f12387-fd23-58f0-b979-9c811507614d"
|
||||
---
|
||||
|
||||
# Provide a pinned bwrap rein runtime and private state
|
||||
|
||||
Implement the runtime prerequisites returned by Glas in `GLAS-WP-0012` and
|
||||
`docs/local-profile-acceptance.md`. Continue owner work `SAND-WP-0014-T05` and
|
||||
live residual `GLAS-IN-0002`. Runtime startup is a separate acceptance gate
|
||||
from credential delivery, enforced provider egress, and a real model task.
|
||||
|
||||
## Mount an owner-selected, digest-pinned Python runtime
|
||||
|
||||
```task
|
||||
id: SAND-WP-0015-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "93e4aad8-ba9b-5850-93d4-b5bf78ac8978"
|
||||
```
|
||||
|
||||
Add exact artifact verification to trusted extension configuration and mount
|
||||
the standalone runtime read-only at a fixed namespace path. Reject altered
|
||||
content/modes, unexpected files, escaping symlinks, special files, and source
|
||||
or workspace overlap. A caller cannot choose runtime paths through exec input.
|
||||
Provide a non-editable rein-aharness/llm-connect bundle builder with recorded
|
||||
source revisions and resolved dependency versions.
|
||||
|
||||
Completed 2026-09-05. `extensions/runtime.py` verifies complete artifact
|
||||
contents/modes before a read-only mount; the builder installed committed
|
||||
rein-aharness `1429db5` and llm-connect `0056094` without editable source paths.
|
||||
Candidate digest and source/package evidence are in `docs/bwrap-runtime.md`.
|
||||
|
||||
## Keep writable runtime state outside the repository
|
||||
|
||||
```task
|
||||
id: SAND-WP-0015-T02
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "c8a689f8-bdf2-57a2-8521-a1c0ca44e750"
|
||||
```
|
||||
|
||||
Create private mode-0700 HOME/config/cache/state/tmp directories within the
|
||||
namespace, preserve them across exec requests, and remove them with teardown.
|
||||
Keep the command environment sanitized and disable Python user-site/bytecode
|
||||
writes. Fail closed on profile network/setup-credential declarations that the
|
||||
current bwrap implementation cannot honor.
|
||||
|
||||
Completed 2026-09-05. Mode-0700 namespace HOME and XDG/TMP directories sit
|
||||
outside the copied Git tree. Explicit runtime PATH selection remains owner
|
||||
controlled. Unsupported egress/default-allow and setup credentials now refuse
|
||||
before workspace creation; regression tests cover these boundaries.
|
||||
|
||||
## Verify the real rein runtime and owner regression paths
|
||||
|
||||
```task
|
||||
id: SAND-WP-0015-T03
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "1a3002f6-c6a8-59d0-9d38-942028419de5"
|
||||
```
|
||||
|
||||
Run `make check`, the existing authenticated cross-request owner smoke, and a
|
||||
real runtime startup smoke. Verify the actual rein CLI and adapter imports,
|
||||
read-only runtime, private HOME, clean worktree, absent source, loopback-only
|
||||
network, and teardown. Keep the production Glas profile blocked.
|
||||
|
||||
Completed 2026-09-05. `make check`: lint clean, 132 tests passed. Authenticated
|
||||
owner API smoke `223db65b` returned HTTP 200 and proved exact consumer identity,
|
||||
stdin delivery, absent source, loopback-only network and complete teardown.
|
||||
Pinned runtime smoke `d4de9531` ran the actual rein CLI and imported its Claude
|
||||
adapter, proved read-only runtime/private HOME/clean worktree, retained private
|
||||
state across a second exec, and removed the workspace. No model call or
|
||||
credential acquisition occurred; T04 remains waiting.
|
||||
|
||||
## Resolve Claude credentials, enforced egress, and production acceptance
|
||||
|
||||
```task
|
||||
id: SAND-WP-0015-T04
|
||||
status: wait
|
||||
priority: high
|
||||
state_hub_task_id: "58817ef6-76d9-5e34-908f-c024e6c99f93"
|
||||
```
|
||||
|
||||
The 2026-09-05 routing lookup found no concrete Anthropic/Claude workload lane.
|
||||
The generic OpenBao template is not a delegable lane; the OpenRouter AppRole
|
||||
belongs to another rein. Credential owner railiance-platform/OpenBao plus
|
||||
rein-aharness must establish a concrete Claude-compatible route and delivery/
|
||||
revocation contract before values can be requested or supplied to the runtime.
|
||||
|
||||
Sand-boxer must then implement the matching enforced provider egress contract
|
||||
(including DNS/TLS and denied-destination proof) and pin/deploy the actual
|
||||
Claude executable. No unrestricted-network or interactive-login substitute is
|
||||
permitted. Review the deployed runtime/profile with Glas, run its real-rein
|
||||
acceptance fixture, and update only the proven profile's readiness. No
|
||||
production schedule is enabled by the runtime-startup smoke.
|
||||
|
||||
This task and SAND-WP-0014-T05 remain open until those gates pass. The detailed
|
||||
return contract and runtime proof are in `docs/bwrap-runtime.md`; the live
|
||||
cross-repo residual remains `GLAS-IN-0002`.
|
||||
Loading…
Add table
Add a link
Reference in a new issue