audit: trigger Phase 16 native CI (macOS sandbox-exec) on remediated HEAD - #3
Closed
13luiz wants to merge 18 commits into
Closed
audit: trigger Phase 16 native CI (macOS sandbox-exec) on remediated HEAD#313luiz wants to merge 18 commits into
13luiz wants to merge 18 commits into
Conversation
…l sandbox_package green on Linux+macOS)
…gration boundaries (16.16.1)
Deletes the built-in native sandbox from the Opi binary — src/sandbox.rs +
src/sandbox/{linux,macos,windows}.rs, the strict FFI in tool/process_tree.rs,
the [sandbox]/SandboxMode/SandboxConfig config surface, the --sandbox /
--sandbox-require flags, and the landlock/seccompiler deps. Policy-neutral L0
supervision (tool/process_tree.rs L0 core + tool/supervision.rs) is retained;
CODE_SANDBOX_DEGRADED is renamed to CODE_PROCESS_TREE_DEGRADED (L0-only
diagnostic). Legacy [sandbox]/--sandbox/--sandbox-require inputs are rejected
with stable remediation pointing at [execution]/--execution-backend and the
opi-sandbox package workflow (ConfigError::LegacySandboxSection + hidden clap
remediation args covering bare and valued forms). New execution_migration.rs +
phase16_crate_boundaries.rs guard the migration; phase15_safety_sandbox_docs.rs
re-points off deleted source while keeping Phase 15 history citable;
sandbox_config/strict/linux_backend tests are superseded by the rejection
suite.
Opi-Task: 16.16.1
Opi-DoD-SHA256: 54eb93ea871e398c160b2aabecfa938a7ccc2d2344012939687186f31b17e589
Opi-Verification: workspace; D.1 gates green (Windows host): execution_migration 15/15, phase16_crate_boundaries 5/5, sandbox_l0 9/9, phase15_safety_sandbox_docs 9/9; cargo tree -p opi-coding-agent has no opi-sandbox/landlock/seccompiler; cargo fmt --check --all clean; cargo clippy -p opi-coding-agent --all-targets -D warnings clean; RUSTDOCFLAGS=-D warnings cargo doc --workspace --no-deps clean. D.2 exec-verify (wf_867c5ad9-f4b) 0 must-fix; 9 low flags folded in the amend (stale doc refs to removed sandbox surface; bare --sandbox remediation via num_args=0..=1; LegacySandboxSection diagnostic-arm test; crate-boundary tripwire needles extended with prepare_production/build_tools_with_sandbox).
Opi-Evaluator: passed
Opi-Acceptance: SC16-15a; execution_migration demonstrates legacy [sandbox]/--sandbox/--sandbox-require rejection + remediation needles across CLI (incl. bare) / TOML / all resolve layers, the LegacySandboxSection diagnostic arm, and migration-target acceptance; phase16_crate_boundaries demonstrates no opi-sandbox/landlock/seccompiler edge, no src/sandbox* module, and no legacy sandbox symbols in production source; sandbox_l0 demonstrates retained L0 supervision (timeout/cancel/drop/tree-kill/bounded-drain); phase15_safety_sandbox_docs demonstrates the adapted Phase-15 history guard.
…native sandbox removed, D.2 clean)
…agnostics (16.16.2) Prove the product vertical slice and cross-surface stable diagnostics the preceding Phase 16 tasks implemented but had not yet pinned behaviorally. - SC16-13 keystone: a REAL packaged archive (the execution-backend mock peer copied into a package dir) reaches a real bash tool turn through package CLI dispatch -> PackageActivationStore (add/trust/enable) -> ExecutionRuntime::build -> routing -> permission -> ExecutionProtocolHost -> BashTool::execute, with the packaged backend's own output as the assertion (no canned contribution). - contribution_disabled behavioral coverage: a packaged adapter enabled then disabled through the real store fails the turn closed with contribution_disabled and no local fallback. - ALL 14 SC16-14 stable codes reach ToolResult.diagnostics through the production build_tools -> BashTool chokepoint (13 in execution_product.rs across mock-peer failure modes plus activation/selection/permission seams, plus the interactive harness's permission_denied = 14 total). Remediation is pinned non-empty, command-text-free, and DISTINCT across all 14 codes (value-distinctness test in execution_failures.rs). policy_denied is proven both in ToolResult and on the startup-diagnostic surfaces (text stderr / NDJSON / RPC). - fixed/rules/model all proven at the production chokepoint (rules-strategy test: first-match runs, denied first-match fails closed without catch-all fallthrough). - No degraded success: bash.rs flags timed_out AND cancelled as is_error even when the backend reports a clean exit code, pinned by completed_timed_out and completed_cancelled mock modes + production-path tests. - Cross-surface stable code: policy_denied reaches NDJSON StartupDiagnostics, RPC ready header, AND text stderr (production fix surfaces startup diagnostics in text mode per the runner's documented contract, rendered in the canonical lowercase source::code form). The three runner-based tests isolate the user config dir (common::empty_user_config_dir, mutex held for the full window) so the Minimal-Runtime branch is deterministic regardless of host package-trust state. Doctor surfaces emit doctor-local stable codes with render-time redaction pinned on canary-seeded output. - Production cleanup: remove 5 vestigial #[allow(dead_code)] on the protocol/execution/cleanup ExecutionFailure variants, correct the producer-split notes, and make PermissionRequired remediation mode-aware (interactive gives persistent-allowance guidance only; headless adds run-interactively) with both branches pinned. Opi-Task: 16.16.2 Opi-DoD-SHA256: 502c8fe4f1c9dccb1009943594cff422500b52f00c7ddb629a3c279c2f54959b Opi-Verification: workspace; 7 gates green (execution_product 17/17, non_interactive 12/12, json_mode 29/29, rpc_jsonl 83/83, interactive_permission 13/13, doctor_cli 44/44, execution_failures 8/8); fmt/clippy/doc clean Opi-Acceptance: SC16-13, SC16-14; all 14 stable codes reach ToolResult.diagnostics at the production chokepoint (17/17 execution_product incl. real-archive keystone); policy_denied additionally reaches text/NDJSON/RPC startup surfaces (12/29/83); doctor surfaces emit doctor-local stable codes with render-time redaction (44/44 doctor_cli) Opi-Evaluator: passed
…ll-to-execute + cross-surface diagnostics proven, D.2 clean)
Opi-Task: 16.16.3 Opi-DoD-SHA256: 0567243734e29d3798c6972ff6f4ac353308d99ff5050a07318d7ff76164da73 Opi-Verification: workspace; 11 gates green (5 doc guards + fmt + clippy + workspace all-targets + doctest + rustdoc + opi-artifact-audit --phase-exit); genuine Windows (host) + Linux (WSL2) native smoke + packaged linux archive; macos native tests via preserved CI log with real cargo pass markers + provenance; all six release-triple cargo checks green (4 CI logs + 2 genuine WSL2 --all-targets logs); per-DoD-category gate captures preserved Opi-Evaluator: passed Opi-Acceptance: SC16-15b; paired EN/ZH spec+README+AGENTS/CLAUDE+Unreleased changelog pin shipped Minimal Runtime/gates/routing-permission/no-fallback/opi-sandbox CLI-SDK/native guarantees/Windows posture/migration/Non-Goals (incl. doctor-local-code surface truthfulness); phase16_extension_docs lockstep guards + artifact_audit_script phase-exit fixtures (failed-target/failed-gate/zero-test rejection + per-category gate evidence) pass; D.2 exec-verify converged 0 must-fix (3 low provenance-accuracy flags resolved)
…+ repo gates closed, D.2 clean)
Verify economics (Track A): - Parameterize smoke into boot/full/scoped modes; non-workspace tiers no longer compile every test binary (--all-targets -> per-target --lib/--test). - D.3 cross-cutting gates tier-dispatched (workspace->full, others->scoped, documentation->none); drop redundant D.1 library build --workspace. - D.2 skip rule for documentation and isolated single-crate library tasks. - Encode CARGO_TARGET_DIR (off-repo drive) + CARGO_INCREMENTAL=0 + per-task cargo clean -p and session-end cleanup convention. Grilling integration (Track B): - A.init.2b grilling pass at spec->ledger decomposition; Phase B B.1a grill-on-fuzzy. Reuses the installed grilling skill. - Spec-amend procedure (in-place amend + dated marker, re-derive affected entries, snapshot guardrail). One-decision-one-home; no docs/adr/. Docs: - Move CONTEXT.md to docs/; add glossary pointers in CLAUDE.md and AGENTS.md (runtime auto-loads only AGENTS.md/CLAUDE.md). - Design spec + appendix recording TDD-engine and matt-coverage decisions. Tier-scoped verification is not yet validated on a real task (deferred).
Contributor
Author
|
Temporary PR opened only to trigger Phase 16 native CI for the independent audit. Evidence (run 31319356200) is captured in docs/snapshots/phase16/audit.glm5.2.md. Closing per the PR's stated intent; not for merge. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Temporary draft PR created by the independent phase-16 audit (
/opi-audit phase16) to run thesandbox_package (macos-latest)job against the post-remediation HEAD, which is 18 commits ahead of origin/main and has never been CI'd. Also yields fmt/clippy/test evidence for the remediated state. Will be closed and the branch deleted once native evidence is captured. Not for merge.