diff --git a/docs/AUTOMATION.md b/docs/AUTOMATION.md index 65a774a..98259e1 100644 --- a/docs/AUTOMATION.md +++ b/docs/AUTOMATION.md @@ -65,6 +65,35 @@ Release только делает resolver готовым к проверяем Журналы: `state/runs//run.json`, `prompt.md`, `output.log`; хранить без secrets. Каждый report содержит task/role, exit/status, timeout/violation и результат, не включает private command environment. +## Вложенный sandbox: проверенный host context (S00-031) + +На этом Linux host с Codex 0.159.0 `/tmp/codex-daemon-1000` имеет uid 1000, +mode 0700; внутри workspace sandbox тот же путь виден с mode 000. +Ошибка вложенного запуска `app-server socket directory must be a user-owned directory +with mode 0700` сама по себе не доказывает неверные host permissions. + +Проверенный способ: одобренный внешний host execution +(`sandbox_permissions: require_escalated`) запускает **внутренний workspace-write sandbox** +из корня проекта, с timeout 20 секунд: + +```sh +codex -c 'sandbox_mode="workspace-write"' -c sandbox_workspace_write.network_access=true sandbox -- python3 /tmp/luma-filesystem-sandbox-probe.py +``` + +До запуска проверить host `stat`: directory, owner=current uid, mode 0700. +Script содержит только synthetic project write/read/remove и exclusive-create вне +проекта с обязательным отказом EROFS/EACCES/EPERM. Его полный текст и воспроизводимая +команда сохранены в `state/evidence/S00-031-auto-ci-cd-d45ccd3ee7d6.md`; +временный `/tmp` script нужно сначала прочитать или восстановить из evidence. +Executor получил exit 0: project probe passed, outside write denied EROFS 30, +outside file не создан. Ни модель, ни storage task не запускались. + +Не менять socket permissions/mask, writable roots или environment location. +Если approved host execution недоступен, выполнить blocker protocol. +Результат относится к этому host/version и одной filesystem boundary; QA повторяет +проверку независимо. Это не app readiness. Общие понятия: +[официальная документация OpenAI](https://developers.openai.com/codex/security). + ## Гарантии инструмента Dependency/role guards, retired reporter, recovery journal definitions+state, fresh subprocess IDs, bounded prompts, separate reviewer, automatic unblocking only after done и stop на внешнем blocker. Истинность evidence/качество модели/OS sandbox обеспечиваются реальным harness и review, а не названием роли. diff --git a/planning/TASK_MATRIX.md b/planning/TASK_MATRIX.md index fa7c1f7..5c725cd 100644 --- a/planning/TASK_MATRIX.md +++ b/planning/TASK_MATRIX.md @@ -1,6 +1,6 @@ # Матрица задач -Generated; state revision **97**. Canonical status: state/tasks.json. +Generated; state revision **99**. Canonical status: state/tasks.json. | ID | Этап | Оператор | Reviewer | Статус | Owner | Зависимости | Задача | | --- | --- | --- | --- | --- | --- | --- | --- | @@ -33,7 +33,7 @@ Generated; state revision **97**. Canonical status: state/tasks.json. | [S00-028](tasks/S00-028.md) | S00 | ci-cd | qa | blocked | auto-ci-cd-211cf3a2bd08 | S00-002, S00-030 | Repair conflicting Codex harness sandbox arguments | | [S00-029](tasks/S00-029.md) | S00 | orchestrator | security | blocked | | S00-001, S00-002, S00-021, S00-027 | Record an approved browser OMEMO backend sourcing strategy | | [S00-030](tasks/S00-030.md) | S00 | ci-cd | qa | blocked | auto-ci-cd-d37c9faf28f3 | S00-002, S00-031 | Provide a valid Codex sandbox app-server socket directory | -| [S00-031](tasks/S00-031.md) | S00 | ci-cd | qa | todo | | S00-002 | Supply a verified private Codex app-server socket environment | +| [S00-031](tasks/S00-031.md) | S00 | ci-cd | qa | review | auto-ci-cd-d45ccd3ee7d6 | S00-002 | Supply a verified private Codex app-server socket environment | | [S00-010](tasks/S00-010.md) | S00 | qa | orchestrator | todo | | S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009 | Gate: Профиль и проверка стека | | [S01-001](tasks/S01-001.md) | S01 | orchestrator | security | todo | | S00-010 | Описать identity/model contracts | | [S01-002](tasks/S01-002.md) | S01 | orchestrator | security | todo | | S00-010, S01-001 | Описать async account context | diff --git a/planning/stages/S00.md b/planning/stages/S00.md index 6dd74e2..0053b88 100644 --- a/planning/stages/S00.md +++ b/planning/stages/S00.md @@ -35,7 +35,7 @@ - [S00-028](../tasks/S00-028.md): Repair conflicting Codex harness sandbox arguments — ci-cd; blocked. - [S00-029](../tasks/S00-029.md): Record an approved browser OMEMO backend sourcing strategy — orchestrator; blocked. - [S00-030](../tasks/S00-030.md): Provide a valid Codex sandbox app-server socket directory — ci-cd; blocked. -- [S00-031](../tasks/S00-031.md): Supply a verified private Codex app-server socket environment — ci-cd; todo. +- [S00-031](../tasks/S00-031.md): Supply a verified private Codex app-server socket environment — ci-cd; review. - [S00-010](../tasks/S00-010.md): Gate: Профиль и проверка стека — qa; todo. ## Граница этапа diff --git a/planning/task_matrix.csv b/planning/task_matrix.csv index 10fbe2e..78bc996 100644 --- a/planning/task_matrix.csv +++ b/planning/task_matrix.csv @@ -28,7 +28,7 @@ S00-027,S00,ci-cd,security,done,auto-ci-cd-40ae46e8efe7,"S00-001, S00-002, S00-0 S00-028,S00,ci-cd,qa,blocked,auto-ci-cd-211cf3a2bd08,"S00-002, S00-030",Repair conflicting Codex harness sandbox arguments S00-029,S00,orchestrator,security,blocked,,"S00-001, S00-002, S00-021, S00-027",Record an approved browser OMEMO backend sourcing strategy S00-030,S00,ci-cd,qa,blocked,auto-ci-cd-d37c9faf28f3,"S00-002, S00-031",Provide a valid Codex sandbox app-server socket directory -S00-031,S00,ci-cd,qa,todo,,S00-002,Supply a verified private Codex app-server socket environment +S00-031,S00,ci-cd,qa,review,auto-ci-cd-d45ccd3ee7d6,S00-002,Supply a verified private Codex app-server socket environment S00-010,S00,qa,orchestrator,todo,,"S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009",Gate: Профиль и проверка стека S01-001,S01,orchestrator,security,todo,,S00-010,Описать identity/model contracts S01-002,S01,orchestrator,security,todo,,"S00-010, S01-001",Описать async account context diff --git a/state/commit_messages/auto-ci-cd-d45ccd3ee7d6.txt b/state/commit_messages/auto-ci-cd-d45ccd3ee7d6.txt new file mode 100644 index 0000000..a92f8a1 --- /dev/null +++ b/state/commit_messages/auto-ci-cd-d45ccd3ee7d6.txt @@ -0,0 +1,4 @@ +Document verified host context for the Codex sandbox probe + +Changes: Add host-specific socket mask diagnosis and bounded inner workspace-write invocation to automation guidance; record independent evidence and QA handoff. +Validation: Approved host stat confirmed uid1000/mode0700; no-model inner sandbox exited 0 with project write/read/remove and outside write denial EROFS30. Final make check passed 72 tests and git diff --check passed. Initial verbose draft exceeded prompt budgets; compacted guidance passed the rerun. No storage task or model executed. diff --git a/state/evidence/S00-031-auto-ci-cd-d45ccd3ee7d6.md b/state/evidence/S00-031-auto-ci-cd-d45ccd3ee7d6.md new file mode 100644 index 0000000..4b2075b --- /dev/null +++ b/state/evidence/S00-031-auto-ci-cd-d45ccd3ee7d6.md @@ -0,0 +1,59 @@ +# S00-031 executor evidence + +Agent: auto-ci-cd-d45ccd3ee7d6 (ci-cd), 2026-10-15. Awaiting independent QA. +Input: coordinator-supplied host confirmation in previous S00-031 handoff, assigned card/packet and required reads. Output: verified bounded host-context diagnostic and docs/AUTOMATION.md instructions. Acceptance: valid host socket metadata; inner project write/read/remove succeeds; outside write denied; no additional model/storage execution. + +Read master/AGENTS/README/common/ci-cd, all six startup docs, TESTING/storage/ADR registry, all five required blocker reports, existing handoff, S00-002 accepted ADR and executor/review evidence/handoff. resume/show/packet each exit 0; assignment already in_progress, no repeat claim. No exact product requirement applies to this engineering task. + +## Independent diagnostic + +- Outer restricted-shell Python stat: exit 0, `/tmp/codex-daemon-1000`, directory=true, uid1000, mode000. Socket contents not read. +- Read and inspected coordinator probe `/tmp/luma-filesystem-sandbox-probe.py` before execution; synthetic data only, no subprocess/model/network inside script. +- Approved `exec_command` with `sandbox_permissions=require_escalated` ran the Python wrapper below from project root: exit 0. Host directory=true, uid1000, mode0700. Inner sandbox exit 0. JSON: `{"project_write_read_remove":"passed","outside_project_write":"denied","denial_errno":30,"outside_probe_created":false,"uid":1000}`. Timeout 20 seconds did not expire. No root/config/socket mutation. This outer execution allows the inner sandbox to initialize; the probe runs only inside that inner sandbox. +- `codex --version`: exit 0, codex-cli 0.159.0; warning that PATH aliases could not be created on read-only filesystem. It did not prevent version output or successful host diagnostic. + +Exact host wrapper (requires approved outer host execution; do not run the probe directly on host): + +```python +import os, stat, subprocess +p = '/tmp/codex-daemon-1000' +s = os.stat(p) +print({'context':'host','path':p,'uid':s.st_uid,'mode':oct(stat.S_IMODE(s.st_mode)),'directory':stat.S_ISDIR(s.st_mode)}, flush=True) +assert s.st_uid == os.getuid() and stat.S_IMODE(s.st_mode) == 0o700 and stat.S_ISDIR(s.st_mode) +r = subprocess.run(['codex','-c','sandbox_mode="workspace-write"','-c','sandbox_workspace_write.network_access=true','sandbox','--','python3','/tmp/luma-filesystem-sandbox-probe.py'], timeout=20) +print({'sandbox_exit_code':r.returncode}, flush=True) +raise SystemExit(r.returncode) +``` + +Full inspected and executed temporary script, which QA can restore under /tmp if needed: + +```python +from pathlib import Path +import uuid,json,os,errno +root=Path('/home/tola/Documents/workspace_micran/swift/web-foundation') +inside=root/'state/runs'/('.sandbox-probe-'+uuid.uuid4().hex) +inside.write_text('synthetic probe\n');assert inside.read_text()=='synthetic probe\n';inside.unlink() +outside=Path('/home/tola')/('.luma-sandbox-denied-'+uuid.uuid4().hex) +try: + with outside.open('x') as f:f.write('synthetic boundary test\n') +except OSError as e: + assert e.errno in {errno.EROFS,errno.EACCES,errno.EPERM},e + print(json.dumps({'project_write_read_remove':'passed','outside_project_write':'denied','denial_errno':e.errno,'outside_probe_created':False,'uid':os.getuid()})) +else: + outside.unlink();raise SystemExit('Filesystem boundary failed: outside-project write succeeded') +``` + +No broader writable roots or unrestricted inner execution flags supplied. The installed Codex workspace-write defaults remain intact, including temporary storage. The negative probe is under /home/tola, outside project and temporary roots. No authentication/API/model call or storage task ran. One filesystem boundary is tested, not all sandbox capabilities. + +## Documentation and checks + +Only source change: docs/AUTOMATION.md, host-specific diagnostic instructions and evidence link. Workflow evidence/handoff/message are metadata. Existing coordinator-supplied handoff is preserved below the executor handoff addition. + +- `python3 scripts/tasks.py validate`: exit 0, 296 tasks, 22 stages, 221 requirements, 211 allocated Web requirements, revision98. +- `git diff --check`: exit 0 before final metadata. +- First documentation write attempt: shell exit1, unmatched backtick caused by an outer heredoc delimiter colliding with an embedded documentation delimiter; no file changed. Retried using a unique delimiter successfully. +- First `make check`: exit2, 72 tests ran, four prompt-budget errors for S21-006 claim/review after the long initial documentation draft. Replaced that draft with compact instructions and placed full reproduction here; no runner/test/plan change. + +Official OpenAI security documentation opened on 2026-10-15: https://developers.openai.com/codex/security (redirects to https://learn.chatgpt.com/docs/security). General context only; host metadata and pass/fail above derive from actual execution, not documentation. No claim that this experiment accepts S00-030/028/storage or product readiness. + +- Final `make check > /tmp/luma-S00-031-check.log 2>&1`: exit0, 72 tooling tests passed in 18.967s, including all fresh prompt budgets. Foundation checks only. Final `git diff --check`: exit0. diff --git a/state/handoffs/S00-031.md b/state/handoffs/S00-031.md index ab04212..2e5b078 100644 --- a/state/handoffs/S00-031.md +++ b/state/handoffs/S00-031.md @@ -28,3 +28,9 @@ Fresh executor and reviewer should REQUEST APPROVED OUTER HOST EXECUTION for thi ## Required next outcome Independently repeat host ownership/mode and actual positive/negative inner filesystem probe, document supported invocation only in docs/AUTOMATION.md, provide evidence and submit for QA. S00-030/028/storage remain unfinished until the normal reviewed chain completes. No check from this coordinator handoff is independent executor/reviewer evidence. + +## Executor handoff to independent QA — auto-ci-cd-d45ccd3ee7d6 + +S00-031 outcome implemented, awaiting review. Independently approved outer host execution confirmed directory uid1000/mode0700 and ran one no-model inner workspace-write probe: exit0, project write/read/remove passed, /home/tola exclusive-create denied EROFS30, no outside file created. Outer restricted-shell stat sees mode000, consistent with supplied mask diagnosis. Socket permissions/config/writable roots unchanged; no model/storage task launched. + +Source change only docs/AUTOMATION.md. Full inspected probe and exact host wrapper: state/evidence/S00-031-auto-ci-cd-d45ccd3ee7d6.md. Final make check passed all72 tooling tests; initial verbose draft caused prompt-budget errors, fixed by compacting documentation. QA must inspect diff/message, independently request approved outer host execution of the bounded inner sandbox wrapper, verify metadata and both filesystem results, then review only S00-031. Do not execute the probe directly unsandboxed, mutate sockets, or start downstream storage work. Temporary script may be inspected/recreated from evidence; no permanent script dependency. Coordinator owns commit and next fresh process. diff --git a/state/tasks.json b/state/tasks.json index 63a79a7..7db6dcc 100644 --- a/state/tasks.json +++ b/state/tasks.json @@ -1,6 +1,6 @@ { "schema_version": 1, - "revision": 97, + "revision": 99, "tasks": { "S00-001": { "status": "done", @@ -1433,10 +1433,14 @@ "handoff": "state/handoffs/S00-030.md" }, "S00-031": { - "status": "todo", - "owner": null, + "status": "review", + "owner": "auto-ci-cd-d45ccd3ee7d6", "external_wait": false, - "reason": "New verified root cause and supported host execution context supplied in state/handoffs/S00-031.md. Actual host /tmp/codex-daemon-1000 uid1000/mode0700 is valid; outer sandbox deliberately masks it read-only mode000. Installed-version primary source confirms this design; TMPDIR/no-daemon cannot fix nested guard. Approved OUTER HOST EXECUTION of bounded no-model inner codex workspace-write probe passes project write/read/remove and denies outside write EROFS30, no outside file created. No socket mutation or broader roots. Fresh executor/QA must read handoff, request approved outer host execution and independently repeat, document and review; no task acceptance claimed." + "reason": null, + "started_at": "2026-10-15T10:38:13+00:00", + "updated_at": "2026-10-15T10:41:56+00:00", + "evidence": "state/evidence/S00-031-auto-ci-cd-d45ccd3ee7d6.md", + "handoff": "state/handoffs/S00-031.md" } }, "events": [ @@ -2658,6 +2662,29 @@ "task": "S00-031", "agent": "coordinator-input-s00-031", "reason": "New verified root cause and supported host execution context supplied in state/handoffs/S00-031.md. Actual host /tmp/codex-daemon-1000 uid1000/mode0700 is valid; outer sandbox deliberately masks it read-only mode000. Installed-version primary source confirms this design; TMPDIR/no-daemon cannot fix nested guard. Approved OUTER HOST EXECUTION of bounded no-model inner codex workspace-write probe passes project write/read/remove and denies outside write EROFS30, no outside file created. No socket mutation or broader roots. Fresh executor/QA must read handoff, request approved outer host execution and independently repeat, document and review; no task acceptance claimed." + }, + { + "revision": 98, + "at": "2026-10-15T10:38:13+00:00", + "action": "claim", + "task": "S00-031", + "agent": "auto-ci-cd-d45ccd3ee7d6", + "role": "ci-cd", + "from": "todo", + "to": "in_progress", + "reason": null + }, + { + "revision": 99, + "at": "2026-10-15T10:41:56+00:00", + "action": "submit", + "task": "S00-031", + "agent": "auto-ci-cd-d45ccd3ee7d6", + "role": null, + "from": "in_progress", + "to": "review", + "reason": null, + "evidence": "state/evidence/S00-031-auto-ci-cd-d45ccd3ee7d6.md" } ], "retired_agents": [