coulomb/sand-boxer
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(runtime): install pinned artifacts in a private owner store
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-08 21:08:18 +02:00
parent 174dba17b6
commit df5e941814
6 changed files with 333 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

26
docs/bwrap-runtime.md
View file

@ -194,3 +194,29 @@ Limits: `--version` proves startup with the proxy environment, not that Claude
has sent a provider request through it. No credential acquisition or model run.
The /tmp candidate is not production placement; protected artifact installation,
owner configuration, credential adoption and real-model proof remain T04 gates.
## Install a reviewed artifact in the local owner's store
Use `scripts/install-bwrap-runtime.py --source <absolute-candidate> --sha256
<reviewed-complete-digest>` from the owner checkout with its Python environment.
The default store is `~/.local/share/sandboxer/runtimes`, with mode 0700. The
command accepts only a canonical store beneath that owner's home, checks owner
and ancestor write permissions, verifies the source, copies into a private
staging directory, verifies the copy and atomically publishes under its digest.
It refuses unsafe modes, store aliases and altered existing destinations.
Reinstalling the same unchanged artifact is idempotent; it never overwrites one.
This is owner-controlled local storage. The owner remains able to change its
files, as in the artifact trust contract above; it is not root-owned storage or
Railiance placement. Sandboxes still recheck the pin on creation and receive a
read-only mount. Installation does not select a profile, configure credentials,
activate network access or enable a schedule. Rollback selects a separately
reviewed retained digest through owner configuration; no in-place replacement
or automatic deletion is part of this command.
The 2026-09-08 bnt-lap001 installation used the existing combined Claude 2.1.263
candidate unchanged. Its installed-path startup/lifecycle proof is
[the local installation receipt](evidence/SAND-WP-0015-protected-local-install-2026-09-08.json).
SAND-WP-0015-T06 is complete. T04 still owns configured execution, native
credential adoption, real-model acceptance and production placement.

40
docs/evidence/SAND-WP-0015-protected-local-install-2026-09-08.json Normal file
View file

@ -0,0 +1,40 @@
{
"date": "2026-09-08",
"scope": "local owner artifact installation; not Railiance admission",
"host": "bnt-lap001",
"owner_uid": 1000,
"store_mode": "0700",
"runtime_path": "/home/worsch/.local/share/sandboxer/runtimes/5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922",
"runtime_sha256": "5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922",
"binary_version": "2.1.263",
"binary_sha256": "26d020351e8112f4006790f3cfce43b4c9df0c1bb1d0e542364d64151b81d5ba",
"candidate_rebuilt": false,
"installed_entries": 358,
"installed_regular_bytes": 245176062,
"root_owned": false,
"smoke": {
"ok": true,
"sandbox_id": "51b59587",
"rein_cli_started": true,
"adapter_imported": true,
"claude_version": "2.1.263 (Claude Code)",
"runtime_readonly": true,
"source_absent": true,
"home_outside_workspace": true,
"home_mode": "0700",
"worktree_clean": true,
"interfaces": [
"lo"
],
"python_prefix": "/opt/sandboxer/runtime",
"https_proxy_present": true,
"credential_refs": [],
"private_state_persisted": true,
"workspace_removed": true,
"proxy_removed": true,
"exit_code": 0
},
"model_run_proven": false,
"profile_activated": false,
"credential_delivery_configured": false
}