S00-030: Confirm the host-context sandbox diagnostic for socket recovery
Changes: Clarify S00-030 host execution guidance in docs/AUTOMATION.md and record the successful bounded diagnostic with QA handoff. Validation: Approved host wrapper and inner workspace-write probe exit 0; project write/read/remove passed, outside write denied EROFS 30. make check exit 0 with 72 tooling tests; git diff --check exit 0. No additional model or storage task ran; app readiness is outside scope. Task: S00-030 Agent: auto-ci-cd-8c7bc1551426 Role: ci-cd Action: claim Status: review Task title: Provide a valid Codex sandbox app-server socket directory
This commit is contained in:
wt committed
1 parent
263d365640
commit
b4a27f2354
8 files changed
+87
-11
No files matched your search
+2
-1
@@ -70,7 +70,8 @@ Release только делает resolver готовым к проверяем
|
||||
На этом Linux host с Codex 0.159.0 `/tmp/codex-daemon-1000` имеет uid 1000,
|
||||
mode 0700; внутри workspace sandbox тот же путь виден с mode 000.
|
||||
Ошибка вложенного запуска `app-server socket directory must be a user-owned directory
|
||||
with mode 0700` сама по себе не доказывает неверные host permissions.
|
||||
with mode 0700` сама по себе не доказывает неверные host permissions. Для S00-030
|
||||
использовать проверенный ниже host context; исправление mode на host не требуется.
|
||||
|
||||
Проверенный способ: одобренный внешний host execution
|
||||
(`sandbox_permissions: require_escalated`) запускает **внутренний workspace-write sandbox**
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Матрица задач
|
||||
|
||||
Generated; state revision **100**. Canonical status: state/tasks.json.
|
||||
Generated; state revision **102**. Canonical status: state/tasks.json.
|
||||
|
||||
| ID | Этап | Оператор | Reviewer | Статус | Owner | Зависимости | Задача |
|
||||
| --- | --- | --- | --- | --- | --- | --- | --- |
|
||||
@@ -32,7 +32,7 @@ Generated; state revision **100**. Canonical status: state/tasks.json.
|
||||
| [S00-027](tasks/S00-027.md) | S00 | ci-cd | security | done | auto-ci-cd-40ae46e8efe7 | S00-001, S00-002, S00-021 | Restore approved npm registry connectivity for the OMEMO2 backend investigation |
|
||||
| [S00-028](tasks/S00-028.md) | S00 | ci-cd | qa | blocked | auto-ci-cd-211cf3a2bd08 | S00-002, S00-030 | Repair conflicting Codex harness sandbox arguments |
|
||||
| [S00-029](tasks/S00-029.md) | S00 | orchestrator | security | blocked | | S00-001, S00-002, S00-021, S00-027 | Record an approved browser OMEMO backend sourcing strategy |
|
||||
| [S00-030](tasks/S00-030.md) | S00 | ci-cd | qa | todo | | S00-002, S00-031 | Provide a valid Codex sandbox app-server socket directory |
|
||||
| [S00-030](tasks/S00-030.md) | S00 | ci-cd | qa | review | auto-ci-cd-8c7bc1551426 | S00-002, S00-031 | Provide a valid Codex sandbox app-server socket directory |
|
||||
| [S00-031](tasks/S00-031.md) | S00 | ci-cd | qa | done | auto-ci-cd-d45ccd3ee7d6 | S00-002 | Supply a verified private Codex app-server socket environment |
|
||||
| [S00-010](tasks/S00-010.md) | S00 | qa | orchestrator | todo | | S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009 | Gate: Профиль и проверка стека |
|
||||
| [S01-001](tasks/S01-001.md) | S01 | orchestrator | security | todo | | S00-010 | Описать identity/model contracts |
|
||||
|
||||
@@ -34,7 +34,7 @@
|
||||
- [S00-027](../tasks/S00-027.md): Restore approved npm registry connectivity for the OMEMO2 backend investigation — ci-cd; done.
|
||||
- [S00-028](../tasks/S00-028.md): Repair conflicting Codex harness sandbox arguments — ci-cd; blocked.
|
||||
- [S00-029](../tasks/S00-029.md): Record an approved browser OMEMO backend sourcing strategy — orchestrator; blocked.
|
||||
- [S00-030](../tasks/S00-030.md): Provide a valid Codex sandbox app-server socket directory — ci-cd; todo.
|
||||
- [S00-030](../tasks/S00-030.md): Provide a valid Codex sandbox app-server socket directory — ci-cd; review.
|
||||
- [S00-031](../tasks/S00-031.md): Supply a verified private Codex app-server socket environment — ci-cd; done.
|
||||
- [S00-010](../tasks/S00-010.md): Gate: Профиль и проверка стека — qa; todo.
|
||||
|
||||
|
||||
@@ -27,7 +27,7 @@ S00-026,S00,ci-cd,qa,done,auto-ci-cd-4255c34da227,"S00-001, S00-002, S00-017, S0
|
||||
S00-027,S00,ci-cd,security,done,auto-ci-cd-40ae46e8efe7,"S00-001, S00-002, S00-021",Restore approved npm registry connectivity for the OMEMO2 backend investigation
|
||||
S00-028,S00,ci-cd,qa,blocked,auto-ci-cd-211cf3a2bd08,"S00-002, S00-030",Repair conflicting Codex harness sandbox arguments
|
||||
S00-029,S00,orchestrator,security,blocked,,"S00-001, S00-002, S00-021, S00-027",Record an approved browser OMEMO backend sourcing strategy
|
||||
S00-030,S00,ci-cd,qa,todo,,"S00-002, S00-031",Provide a valid Codex sandbox app-server socket directory
|
||||
S00-030,S00,ci-cd,qa,review,auto-ci-cd-8c7bc1551426,"S00-002, S00-031",Provide a valid Codex sandbox app-server socket directory
|
||||
S00-031,S00,ci-cd,qa,done,auto-ci-cd-d45ccd3ee7d6,S00-002,Supply a verified private Codex app-server socket environment
|
||||
S00-010,S00,qa,orchestrator,todo,,"S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009",Gate: Профиль и проверка стека
|
||||
S01-001,S01,orchestrator,security,todo,,S00-010,Описать identity/model contracts
|
||||
|
||||
|
@@ -0,0 +1,4 @@
|
||||
Confirm the host-context sandbox diagnostic for socket recovery
|
||||
|
||||
Changes: Clarify S00-030 host execution guidance in docs/AUTOMATION.md and record the successful bounded diagnostic with QA handoff.
|
||||
Validation: Approved host wrapper and inner workspace-write probe exit 0; project write/read/remove passed, outside write denied EROFS 30. make check exit 0 with 72 tooling tests; git diff --check exit 0. No additional model or storage task ran; app readiness is outside scope.
|
||||
@@ -0,0 +1,37 @@
|
||||
# S00-030 executor evidence
|
||||
|
||||
Agent: auto-ci-cd-8c7bc1551426 (ci-cd), 2026-10-15. Awaiting independent QA.
|
||||
|
||||
Input: assigned card/packet, previous handoff, required startup/task reads and reviewed S00-002/S00-031 evidence, reviews, handoffs and accepted stack ADR. Output: confirmation that supplied host context runs the bounded no-model sandbox diagnostic; scoped documentation clarification. Acceptance: no socket guard failure, project write/read/remove succeeds, outside write denied, no model/storage execution.
|
||||
|
||||
## Actual checks
|
||||
|
||||
- resume, show and packet for assigned S00-030: exit0 each; already in_progress, no repeated claim.
|
||||
- Initial git status: exit0, only coordinator claim state/tasks.json modified.
|
||||
- Read /tmp/luma-filesystem-sandbox-probe.py before execution. Exact text matches full probe in state/evidence/S00-031-auto-ci-cd-d45ccd3ee7d6.md; SHA256 cf27daee26667c9855204841271a4681f3878a9467b0627d2916a6c215df71f6. Synthetic data only; no subprocess/model/network inside probe.
|
||||
- Approved exec_command sandbox_permissions=require_escalated ran this wrapper from project root (outer and inner exit0, timeout20 did not expire):
|
||||
|
||||
```python
|
||||
import os, stat, subprocess
|
||||
p = '/tmp/codex-daemon-1000'
|
||||
s = os.stat(p)
|
||||
print({'context':'host','path':p,'uid':s.st_uid,'mode':oct(stat.S_IMODE(s.st_mode)),'directory':stat.S_ISDIR(s.st_mode)}, flush=True)
|
||||
assert s.st_uid == os.getuid() and stat.S_IMODE(s.st_mode) == 0o700 and stat.S_ISDIR(s.st_mode)
|
||||
r = subprocess.run(['codex','-c','sandbox_mode="workspace-write"','-c','sandbox_workspace_write.network_access=true','sandbox','--','python3','/tmp/luma-filesystem-sandbox-probe.py'], timeout=20)
|
||||
print({'sandbox_exit_code':r.returncode}, flush=True)
|
||||
raise SystemExit(r.returncode)
|
||||
```
|
||||
|
||||
Host result: directory=true, uid1000=current uid, mode0o700. Inner JSON: {"project_write_read_remove":"passed","outside_project_write":"denied","denial_errno":30,"outside_probe_created":false,"uid":1000}. sandbox_exit_code=0. No socket ownership/mode error. The host wrapper initializes the inner sandbox; it never executes the filesystem probe directly outside that sandbox.
|
||||
|
||||
- Restricted-shell Python stat/hash: exit0, same socket directory uid1000/mode0o0/directory=true; confirms documented context difference. Socket contents not accessed.
|
||||
- codex --version: exit0, codex-cli0.159.0; read-only filesystem warning for PATH aliases did not prevent execution.
|
||||
|
||||
## Scope and limits
|
||||
|
||||
Only source edit: docs/AUTOMATION.md clarifies S00-030 must use supplied host context and host chmod is unnecessary. Existing S00-031 reproduction instructions retained. No socket/config/writable-root changes, additional model, authentication call or storage task. The inner workspace-write defaults including temporary roots remain intact; negative probe is /home/tola outside project/temp roots. One filesystem boundary is verified, not all sandbox capabilities or app readiness.
|
||||
|
||||
OpenAI Docs skill used; official https://developers.openai.com/codex/security opened 2026-10-15 (redirects to https://learn.chatgpt.com/docs/security) for general context. Host-specific conclusions derive from actual probe and reviewed supplied environment, not web documentation.
|
||||
|
||||
- `make check > /tmp/luma-S00-030-check.log 2>&1`: exit0; 72 tooling tests passed in18.770s, including prompt budgets. Foundation integrity only.
|
||||
- `git diff --check`: exit0; source diff limited to docs/AUTOMATION.md, other changes workflow metadata.
|
||||
@@ -1,3 +1,13 @@
|
||||
# S00-030 executor handoff — bounded diagnostic passed
|
||||
|
||||
Executor: auto-ci-cd-8c7bc1551426 (ci-cd), 2026-10-15. Awaiting independent QA.
|
||||
|
||||
Reviewed S00-031 supplied host context and repeated approved outer host wrapper with inner workspace-write sandbox. Host socket uid1000/mode0700; inner exit0, synthetic project write/read/remove passed, outside /home/tola exclusive-create denied EROFS30, no outside file created. No socket/root/config changes or additional model/storage execution. Restricted-shell socket mode000 confirms why recursive invocation failed previously.
|
||||
|
||||
Source edit only docs/AUTOMATION.md: clarify S00-030 uses verified host context, without host chmod. Exact wrapper, inspected script hash, outputs and limits: state/evidence/S00-030-auto-ci-cd-8c7bc1551426.md. QA should inspect scoped diff/message and independently repeat the bounded approved host wrapper after inspecting/recovering the temporary script from S00-031 evidence. Do not run probe directly on host. make check exit0 (72 tooling tests,18.770s); git diff --check exit0. Review only S00-030; coordinator owns commit and subsequent fresh sessions.
|
||||
|
||||
## Previous blocker handoff (superseded diagnosis, retained history)
|
||||
|
||||
# S00-030 handoff — external socket environment still invalid
|
||||
|
||||
Executor: auto-ci-cd-d37c9faf28f3 (ci-cd). No source changes or additional model/storage execution.
|
||||
|
||||
+30
-6
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"schema_version": 1,
|
||||
"revision": 100,
|
||||
"revision": 102,
|
||||
"tasks": {
|
||||
"S00-001": {
|
||||
"status": "done",
|
||||
@@ -1419,18 +1419,19 @@
|
||||
"reason": "Pinned libomemo.js@3.0.0 supplies real embedded WASM but is a different unaudited ratchet and excludes consumer SCE; no approved decision reconciles it with S00-022 retained audited engine/persistence requirement."
|
||||
},
|
||||
"S00-030": {
|
||||
"status": "todo",
|
||||
"owner": null,
|
||||
"status": "review",
|
||||
"owner": "auto-ci-cd-8c7bc1551426",
|
||||
"external_wait": false,
|
||||
"reason": null,
|
||||
"started_at": "2026-10-15T10:30:53+00:00",
|
||||
"updated_at": "2026-10-15T10:44:07+00:00",
|
||||
"started_at": "2026-10-15T10:44:46+00:00",
|
||||
"updated_at": "2026-10-15T10:46:42+00:00",
|
||||
"blocked_by": [],
|
||||
"resume_status": "in_progress",
|
||||
"blocker_report": "state/blockers/S00-031.md",
|
||||
"handoff": "state/handoffs/S00-030.md",
|
||||
"previous_owner": "auto-ci-cd-d37c9faf28f3",
|
||||
"resumed_after_blocker": true
|
||||
"resumed_after_blocker": true,
|
||||
"evidence": "state/evidence/S00-030-auto-ci-cd-8c7bc1551426.md"
|
||||
},
|
||||
"S00-031": {
|
||||
"status": "done",
|
||||
@@ -2709,6 +2710,29 @@
|
||||
"to": "done",
|
||||
"reason": null,
|
||||
"evidence": "state/evidence/S00-031-review.md"
|
||||
},
|
||||
{
|
||||
"revision": 101,
|
||||
"at": "2026-10-15T10:44:46+00:00",
|
||||
"action": "claim",
|
||||
"task": "S00-030",
|
||||
"agent": "auto-ci-cd-8c7bc1551426",
|
||||
"role": "ci-cd",
|
||||
"from": "todo",
|
||||
"to": "in_progress",
|
||||
"reason": null
|
||||
},
|
||||
{
|
||||
"revision": 102,
|
||||
"at": "2026-10-15T10:46:42+00:00",
|
||||
"action": "submit",
|
||||
"task": "S00-030",
|
||||
"agent": "auto-ci-cd-8c7bc1551426",
|
||||
"role": null,
|
||||
"from": "in_progress",
|
||||
"to": "review",
|
||||
"reason": null,
|
||||
"evidence": "state/evidence/S00-030-auto-ci-cd-8c7bc1551426.md"
|
||||
}
|
||||
],
|
||||
"retired_agents": [
|
||||
|
||||
Reference in new issue
Block a user