coulomb/sand-boxer
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add owner-mediated bwrap execution boundary

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06def-6490-7033-8448-2eab2d12ed44
This commit is contained in:
tegwick 2026-09-04 22:12:19 +02:00
parent 877676d1f1
commit d79e3fe358
23 changed files with 1321 additions and 86 deletions
Download patch file Download diff file Expand all files Collapse all files

30
docs/integrations/glas-harness.md
View file

@ -10,7 +10,9 @@ sandboxer create \
--profile profile.agent-dev \
--input repo=/path/to/workspace \
--actor agt \
--project glas-harness
--project glas-harness \
--session-id session-123 \
--run-id run-456
```
## Response fields (ready state)
@ -22,28 +24,31 @@ sandboxer create \
| `reachability.remote_dir` | sand-boxer | Workspace root on remote host |
| `state` | sand-boxer | Lifecycle state (`ready`, etc.) |
## Two reachability modes
## Two execution modes
Not every sandbox has an SSH hop. `ext.compose-ssh` / `ext.vm-packer`
always run remote and populate `reachability.ssh` + `reachability.
remote_dir`; glas-harness execs tools over that SSH channel. `ext.bwrap`
(SAND-WP-0013) runs same-host and never populates `reachability.ssh` —
instead it populates `reachability.pid` (the placeholder process holding
the bwrap namespaces) and `reachability.workspace_dir`. glas-harness
execs tools by entering that pid's namespaces directly
(`nsenter --target <pid> --mount --pid --net --uts --ipc -- <cmd>`, no
tunnel needed) rather than opening an SSH channel. `reachability/enrich.
build_reachability_report()` returns both an `ssh_one_liner` and a
`local_exec_hint`; exactly one is non-null depending on which mode the
resolved extension uses. Consumers should branch on which field is
populated, not on profile id, since routing can fall back between
extensions.
the bwrap namespaces) and `reachability.workspace_dir` as evidence. These
fields are not a consumer attach contract. `build_reachability_report()`
returns `execution.mode: owner-mediated`; glas-harness sends an exec request
to the resident sand-boxer owner service. Direct `nsenter` is unsupported.
The request repeats the exact actor/project/session/run identity used at
create, carries an argument vector (never a shell command string), and may
carry only value-free credential catalog route references. sand-boxer refuses
identity mismatch, non-ready or expired state, concurrent execution, and every
extension without an owner execution implementation. It never retries against
the host source checkout.
## Ownership
| Concern | Owner |
|---------|-------|
| Sandbox provision / teardown | sand-boxer |
| In-namespace command broker, workspace cwd, timeout/output bounds | sand-boxer |
| Tool call parsing and policies | glas-harness |
| SSH / tunnel reachability setup | glas-harness + ops-bridge |
| Agent memory and session state | glas-harness |
@ -62,4 +67,5 @@ one-liner), then destroys.
- Tool schemas and approval flows
- Channel bridges (Slack, email, etc.)
- Subagent orchestration
- Subagent orchestration
- Provider credential acquisition or injection (the selected rein owns it)