coulomb/sand-boxer
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(runtime): install pinned artifacts in a private owner store
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-08 21:08:18 +02:00
parent 174dba17b6
commit df5e941814
6 changed files with 333 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

26
docs/bwrap-runtime.md
View file

@ -194,3 +194,29 @@ Limits: `--version` proves startup with the proxy environment, not that Claude
has sent a provider request through it. No credential acquisition or model run.
The /tmp candidate is not production placement; protected artifact installation,
owner configuration, credential adoption and real-model proof remain T04 gates.
## Install a reviewed artifact in the local owner's store
Use `scripts/install-bwrap-runtime.py --source <absolute-candidate> --sha256
<reviewed-complete-digest>` from the owner checkout with its Python environment.
The default store is `~/.local/share/sandboxer/runtimes`, with mode 0700. The
command accepts only a canonical store beneath that owner's home, checks owner
and ancestor write permissions, verifies the source, copies into a private
staging directory, verifies the copy and atomically publishes under its digest.
It refuses unsafe modes, store aliases and altered existing destinations.
Reinstalling the same unchanged artifact is idempotent; it never overwrites one.
This is owner-controlled local storage. The owner remains able to change its
files, as in the artifact trust contract above; it is not root-owned storage or
Railiance placement. Sandboxes still recheck the pin on creation and receive a
read-only mount. Installation does not select a profile, configure credentials,
activate network access or enable a schedule. Rollback selects a separately
reviewed retained digest through owner configuration; no in-place replacement
or automatic deletion is part of this command.
The 2026-09-08 bnt-lap001 installation used the existing combined Claude 2.1.263
candidate unchanged. Its installed-path startup/lifecycle proof is
[the local installation receipt](evidence/SAND-WP-0015-protected-local-install-2026-09-08.json).
SAND-WP-0015-T06 is complete. T04 still owns configured execution, native
credential adoption, real-model acceptance and production placement.