You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Commit d181440
Browse filesBrowse the repository at this point in the historyBrowse files
The `Agent isolation` workflow runs the same command. The main `CI` workflow skips
17
+
the Docker suites so that they never run in parallel.
18
+
19
+
The live vendor probes need real credentials, so CI does not run them. To run them,
20
+
set `CODEBOOST_RUN_AUTH_PROBES=1`, `CODEBOOST_CODEX_AUTH_FILE` (a Codex `auth.json`
21
+
path) and `CLAUDE_CODE_OAUTH_TOKEN`. Do not put credentials in an issue, a pull
22
+
request or chat.
23
+
24
+
## What the gate proves
25
+
26
+
Each row is a T9 requirement for the Docker suite. The suite fails if any row fails.
27
+
28
+
| Requirement | Tests |
29
+
| --- | --- |
30
+
| Isolation holds: non-root, no capabilities, read-only root, no host paths or secrets, vendor-only egress |`agent-container`: read-only isolation, lockdown and mount validation; `agent-network`: egress and DNS |
31
+
| A read-only phase cannot write `/work`|`agent-container`: phase worktree for all five phases |
32
+
| Planning and questions cannot run a process |`agent-policy`: tool sets exclude the command tool, and command dispatch refuses these phases |
33
+
| Task and scratch byte and inode limits hold |`agent-container`: task capacity; scratch capacity for Codex and Claude (`/tmp`, `HOME`, `CODEX_HOME`, output directory) |
34
+
| Hard links and alias writes from `.git/config` and objects fail, and metadata stays unchanged |`agent-container`: metadata alias probe in planning, review and execute, with a digest of `.git` before and after |
35
+
| Mountpoint replacement fails |`agent-container`: metadata and metadata alias probes (`mv` and `rm -rf` of `.git`) |
36
+
| Both vendor startup probes read the schema and return bounded valid output through their documented channel |`agent-supervisor` live probes: Codex through its output file, Claude through its stdout envelope (credentials required) |
37
+
| Hostile input stays inside the boundary |`agent-container`: repositories with links that leave the checkout are refused, links inside the checkout still work, oversized repositories fail closed; `agent-policy`: option-like prompts; `agent-proxy`: hostile CONNECT traffic; `agent-supervisor`: hostile output |
38
+
39
+
## Why the gate can fail
40
+
41
+
A test that cannot fail proves nothing. `agent-gate` runs each negative probe from
42
+
production in a container that is missing one protection. It then checks that the
43
+
probe reports that exact breach. The cases include writable Git metadata, a writable
44
+
worktree in each read-only phase, task and scratch areas without a byte or an inode
45
+
limit, the Codex-only scratch areas, a writable control directory, and repository
46
+
links or secret content in the worktree.
47
+
48
+
A probe also discards the output of any forbidden command it tries. So a breach that
49
+
succeeds, such as reading a file through a link, cannot copy data into the output.
50
+
51
+
Probe scripts must use the `deny` helper for actions that must fail. Do not write
52
+
`! command` in a probe: `set -e` ignores a negated command, so the probe would
53
+
continue and report success even when the forbidden action worked. Before D5, the
54
+
metadata, read-only isolation and capacity probes had this defect.
55
+
56
+
## Handoff to lanes F and G
57
+
58
+
Use only these entry points to run an agent:
59
+
60
+
1.`createTaskClone` creates a committed, standalone staging clone.
61
+
2.`prepareTaskFilesystems` copies that clone into bounded task storage. Call
62
+
`removeTaskFilesystems` when the task ends. It refuses a repository that has a
63
+
symbolic link with an absolute target or a target outside the checkout, before it
64
+
creates any storage. Report this to the user as a repository the agent cannot run
65
+
on; do not retry it.
66
+
3.`captureInvocation` freezes the request. Capture each attempt ID once. A new
67
+
attempt needs a new attempt ID.
68
+
4.`startCodexInvocation` or `startClaudeInvocation` runs the agent and returns a
69
+
handle. Pass the vendor credential only as the function argument.
70
+
71
+
The boundary guarantees the following:
72
+
73
+
- The profile is immutable, and every launch revalidates it against Docker.
74
+
- Tools are limited by phase. Planning and questions can only read, list and search.
75
+
- Web search and MCP are off, stdin is closed, and network traffic reaches only the
76
+
vendor hosts.
77
+
- Output is bounded and decoded as strict UTF-8. Invalid output fails as
78
+
`capture-failure`.
79
+
- The invocation deadline bounds every launch. Cleanup still runs after the deadline.
80
+
81
+
The caller must do the following:
82
+
83
+
- Keep ownership until `settled` resolves. It resolves only after the container has
84
+
stopped and its cleanup has finished. The supervisor retries cleanup until then.
85
+
- Call `cancel` to stop an invocation. The first stop reason is kept.
86
+
- Treat `stopReason` as the result of the invocation. A missing `stopReason` means
87
+
the agent finished normally.
88
+
89
+
## Limits of this gate
90
+
91
+
- CI does not run the live vendor probes. Run them locally with credentials before
92
+
a release that changes the image, the adapters or the prompts.
93
+
- T9 as a whole is complete only when lane F runs every suite in required CI (F6).
0 commit comments