coulomb/sand-boxer
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(runtime): install pinned artifacts in a private owner store
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-08 21:08:18 +02:00
parent 174dba17b6
commit df5e941814
6 changed files with 333 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

45
workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md
View file

@ -8,7 +8,7 @@ status: blocked
owner: codex
topic_slug: bwrap-runtime-and-private-state
created: "2026-09-05"
updated: "2026-09-06"
updated: "2026-09-08"
state_hub_workstream_id: "d3f12387-fd23-58f0-b979-9c811507614d"
---
@ -204,3 +204,46 @@ Limits: `--version` proves startup with the proxy environment, not that Claude
has sent a provider request through it. No credential acquisition or model run.
The /tmp candidate is not production placement; protected artifact installation,
owner configuration, credential adoption and real-model proof remain T04 gates.
## Install the pinned runtime in the local owner's protected store
```task
id: SAND-WP-0015-T06
status: done
priority: high
assignee: the-custodian
```
HFACT-WP-0001-T04 consumes this independent installation return. Reuse the
already verified combined candidate with digest
`5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`;
do not rebuild resolved dependencies. Publish it under the local owner's
private artifact store, verify exact copied content/modes and refusal of unsafe
or corrupted destinations, and prove startup/read-only access/teardown through
the installed path. The owner remains trusted; this is not root-owned storage.
T04 retains real credential adoption, owner configuration, model acceptance
and production placement. No credential route or profile is activated here.
`scripts/install-bwrap-runtime.py` installs below the owner's home into a
mode-0700 store, verifies before and after copying, preserves artifact modes
and internal symlinks, serializes publishers and never overwrites a published
artifact. Existing modified artifacts are refused rather than repaired silently.
Group/other-writable ancestors, unsafe permission bits and store aliases refuse.
Unit tests cover integrity, idempotence, copy-time corruption and access modes.
T06 completed 2026-09-08 on bnt-lap001, local owner UID 1000. Installed the
unchanged 358-entry / 245176062-byte candidate at
`/home/worsch/.local/share/sandboxer/runtimes/5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`.
The private store is mode 0700; the installing owner remains trusted. A root-owned
system installation was not claimed or required for this local owner contract.
The installed-path sandbox smoke `51b59587` passed real Claude 2.1.263 and rein
startup, read-only mount, private state persistence, clean worktree, absent source,
loopback-only interfaces and complete workspace/proxy teardown. No model call
or credential acquisition occurred. `make check`: lint clean, 188 tests passed.
Two existing tests require the checkout directory name `sand-boxer`; the final
full check used that canonical basename. Evidence:
`docs/evidence/SAND-WP-0015-protected-local-install-2026-09-08.json`.
T04 retains owner execution configuration, native credential/egress and real-model
acceptance; Railiance installation needs its own target-specific return.