allod/tools

Watch

Fork 0

Clone-per-change under ~/changes and 'allod change run' to sandbox a worker in it #282

New issue

Closed

opened 2026-10-20 06:05:47 +01:00 by vnprc-agent · 5 comments

vnprc-agent commented

2026-10-20 06:05:47 +01:00

Contributor

allod change begin -d makes a self-contained clone under ~/changes instead of a linked worktree, and a new allod change run runs a worker command inside a bubblewrap sandbox that mounts only that clone, so one dev VM runs many workers that cannot reach each other's trees or the VM's forge and SSH credentials.

Part of allod/strategy#69, which holds the design and the mount set. This issue is the allod/tools half; the archetypes and memory halves are their own issues.

Primary goals:

Clones, not linked worktrees — a tree begin -d makes has its own .git, its origin set to the parent's origin, and its agent/<desc> branch cut from the parent's origin/<start>; a hardlinked local clone, never an alternates clone, because a parent git gc can prune what an alternates clone still references.
The parent keeps the ledger — the parent repository records each clone it issued under its own .git (path and branch), where a sandboxed worker cannot write. list, record, cleanup and run resolve a clone to its parent through that ledger, never through the clone's own config, and record refuses to push a clone whose origin differs from its parent's.
Protection follows the ledger — a ledgered clone resolves to its parent's protected-branches identity, so record from inside one is not a misplaced checkout (exit 8) and the "shared checkout" guard on unnamed changes does not fire for it. The bash twin git-hooks/protected-refs-policy is untouched: inside the sandbox it falls through to the origin match, which blocks only the protected branch and leaves agent/* commits alone.
allod change run [<clone>...] -- <command...> — the mount set in allod/strategy#69 under a transient user scope with a memory cap; refuses anything that is not a ledgered clone on an agent/* branch and never runs unsandboxed.
Existing linked worktrees drain, not break — list, record and cleanup keep handling a linked worktree (--git-dir differs from --git-common-dir) until none remain; begin makes no new ones.

Validation

tests/allod-change.sh rewritten for clones with the linked-worktree cases kept for the drain window; a probe run through run finds no forge token, no SSH directory, no sibling clone and no shared checkout, with the same probe outside the sandbox finding them; git commit succeeds inside on the clone's branch and the parent's refs are byte-identical before and after; a nix build of a trivial derivation succeeds inside through the daemon socket; exceeding the memory cap kills the scope and only the scope. Whether bwrap can open its nested user namespace inside the nix build sandbox is settled by running it; if not, the run checks become a by-hand script beside tests/site-preview-by-hand.sh, run in a dev VM with its output in the PR body.

Scope

In: cmd/allod/change.go, internal/protection, the tests, README.md and docs/. Out: the archetypes package declaration and the skill text, which are their own child issues; network filtering (allod/strategy#14).

`allod change begin -d` makes a self-contained clone under `~/changes` instead of a linked worktree, and a new `allod change run` runs a worker command inside a bubblewrap sandbox that mounts only that clone, so one dev VM runs many workers that cannot reach each other's trees or the VM's forge and SSH credentials. Part of allod/strategy#69, which holds the design and the mount set. This issue is the `allod/tools` half; the archetypes and memory halves are their own issues. Primary goals: - **Clones, not linked worktrees** — a tree `begin -d` makes has its own `.git`, its `origin` set to the parent's origin, and its `agent/<desc>` branch cut from the parent's `origin/<start>`; a hardlinked local clone, never an alternates clone, because a parent `git gc` can prune what an alternates clone still references. - **The parent keeps the ledger** — the parent repository records each clone it issued under its own `.git` (path and branch), where a sandboxed worker cannot write. `list`, `record`, `cleanup` and `run` resolve a clone to its parent through that ledger, never through the clone's own config, and `record` refuses to push a clone whose `origin` differs from its parent's. - **Protection follows the ledger** — a ledgered clone resolves to its parent's `protected-branches` identity, so `record` from inside one is not a misplaced checkout (exit 8) and the "shared checkout" guard on unnamed changes does not fire for it. The bash twin `git-hooks/protected-refs-policy` is untouched: inside the sandbox it falls through to the origin match, which blocks only the protected branch and leaves `agent/*` commits alone. - **`allod change run [<clone>...] -- <command...>`** — the mount set in allod/strategy#69 under a transient user scope with a memory cap; refuses anything that is not a ledgered clone on an `agent/*` branch and never runs unsandboxed. - **Existing linked worktrees drain, not break** — `list`, `record` and `cleanup` keep handling a linked worktree (`--git-dir` differs from `--git-common-dir`) until none remain; `begin` makes no new ones. ### Validation `tests/allod-change.sh` rewritten for clones with the linked-worktree cases kept for the drain window; a probe run through `run` finds no forge token, no SSH directory, no sibling clone and no shared checkout, with the same probe outside the sandbox finding them; `git commit` succeeds inside on the clone's branch and the parent's refs are byte-identical before and after; a `nix build` of a trivial derivation succeeds inside through the daemon socket; exceeding the memory cap kills the scope and only the scope. Whether `bwrap` can open its nested user namespace inside the nix build sandbox is settled by running it; if not, the `run` checks become a by-hand script beside `tests/site-preview-by-hand.sh`, run in a dev VM with its output in the PR body. ### Scope In: `cmd/allod/change.go`, `internal/protection`, the tests, `README.md` and `docs/`. Out: the archetypes package declaration and the skill text, which are their own child issues; network filtering (allod/strategy#14).

vnprc-agent commented

2026-10-20 07:59:17 +01:00

Author

Contributor

Handoff: the branch for this issue is built, reviewed and verified on a dev VM; it relays to the hypervisor as unpushed commits on agent/worker-sandbox and lands as one PR with this body:

On a dev VM, allod change begin -d now makes a self-contained clone under ~/changes instead of a linked worktree, the parent repository keeps a ledger of the clones it issued under its own .git, and a new allod change run runs a command inside a bubblewrap sandbox that can reach that clone, the memory checkouts read-only, and the runner's own state, with the forge token, the SSH directory, every shared checkout and every other clone absent. What stays identical: record, submit, list and cleanup keep their shapes and exit codes, a linked worktree made before this change keeps working in all of them until it drains, the protection package and the git hook are untouched, and nothing changes on the hypervisor. Proof: the shell suite at 332 cases and the sandbox suite at 48, every flake check green, the by-hand script on a real dev VM showing the scope and its memory cap, a sandboxed commit with the parent untouched, the cap killing only the scope, and a build through the daemon socket, plus a live model call inside the sandbox and every cold-review finding re-executed and refused. If it is wrong, revert the branch: the ledger directory in each parent's .git is inert to older binaries, and any clone already made is an ordinary repository that plain git handles.

Refs allod/strategy#69. Closes allod/tools#282.

Risk

R3. A security boundary inside a VM, generated sandbox arguments, a new trusted store (the ledger) and a change to how every allod change command resolves a tree. No secrets, host commands or provisioning; no deployed state. Rollback is a revert. The worst credible failure after validation is a mount-set gap that lets a worker see something the table says is absent; the probes in tests/allod-change-run.sh and their sabotage halves target that directly.

One cold cross-family review (gpt-5.6-sol via pi) returned eight findings; seven were real and fixed in one round: record and cleanup now trust the ledger's branch and origin, not the clone's; the origin check covers remote.origin.pushurl; begin -d refuses a repository outside the work dir, since the ledger scan would never find its clone; the ledger claim is an O_EXCL create keyed by description; the token exclusion matches hard links and symlinks. Each was re-executed against the rebuilt binary after the fix.

Validation

go vet ./..., go test ./...: all packages ok.
tests/allod-change.sh: 332 passed. tests/allod-change-run.sh: 48 passed, each credential probe with a sabotage run proving it can fail.
nix build .#checks.x86_64-linux.<each> for all eight attributes, one at a time: green; allod-parity runs the 332-case suite inside the build.
tests/allod-change-run-by-hand.sh on a dev VM: scope named and MemoryMax set; sandboxed commit lands, parent refs byte-identical; cap exceeded kills the scope only (oom-kill, exit 137); nix-build inside succeeds through the daemon socket. bwrap opens its nested user namespace inside the nix build sandbox, but that sandbox has no /etc, /run/current-system, /bin or /usr to bind, which is why the run suite is by-hand rather than a flake check.
Live: a ledgered clone of a protected repo, allod change run with a claude -p --model haiku call inside answered; inside, the forge token, ~/.ssh, shared checkouts and other clones were absent, the memory tree read-only, a push refused for lack of credentials.
Review findings re-executed: wrong branch at record (exit 3), push URL redirected (exit 9), origin repointed at cleanup (exit 9), ledgered branch not checked out at cleanup (exit 3), begin outside the work dir refused, duplicate description refused (exit 5), hard-linked token absent inside the sandbox.

Handoff: the branch for this issue is built, reviewed and verified on a dev VM; it relays to the hypervisor as unpushed commits on `agent/worker-sandbox` and lands as one PR with this body: On a dev VM, `allod change begin -d` now makes a self-contained clone under `~/changes` instead of a linked worktree, the parent repository keeps a ledger of the clones it issued under its own `.git`, and a new `allod change run` runs a command inside a bubblewrap sandbox that can reach that clone, the memory checkouts read-only, and the runner's own state, with the forge token, the SSH directory, every shared checkout and every other clone absent. What stays identical: `record`, `submit`, `list` and `cleanup` keep their shapes and exit codes, a linked worktree made before this change keeps working in all of them until it drains, the protection package and the git hook are untouched, and nothing changes on the hypervisor. Proof: the shell suite at 332 cases and the sandbox suite at 48, every flake check green, the by-hand script on a real dev VM showing the scope and its memory cap, a sandboxed commit with the parent untouched, the cap killing only the scope, and a build through the daemon socket, plus a live model call inside the sandbox and every cold-review finding re-executed and refused. If it is wrong, revert the branch: the ledger directory in each parent's `.git` is inert to older binaries, and any clone already made is an ordinary repository that plain git handles. Refs allod/strategy#69. Closes allod/tools#282. ## Risk R3. A security boundary inside a VM, generated sandbox arguments, a new trusted store (the ledger) and a change to how every `allod change` command resolves a tree. No secrets, host commands or provisioning; no deployed state. Rollback is a revert. The worst credible failure after validation is a mount-set gap that lets a worker see something the table says is absent; the probes in `tests/allod-change-run.sh` and their sabotage halves target that directly. One cold cross-family review (gpt-5.6-sol via pi) returned eight findings; seven were real and fixed in one round: record and cleanup now trust the ledger's branch and origin, not the clone's; the origin check covers `remote.origin.pushurl`; `begin -d` refuses a repository outside the work dir, since the ledger scan would never find its clone; the ledger claim is an O_EXCL create keyed by description; the token exclusion matches hard links and symlinks. Each was re-executed against the rebuilt binary after the fix. ## Validation - `go vet ./...`, `go test ./...`: all packages ok. - `tests/allod-change.sh`: 332 passed. `tests/allod-change-run.sh`: 48 passed, each credential probe with a sabotage run proving it can fail. - `nix build .#checks.x86_64-linux.<each>` for all eight attributes, one at a time: green; `allod-parity` runs the 332-case suite inside the build. - `tests/allod-change-run-by-hand.sh` on a dev VM: scope named and `MemoryMax` set; sandboxed commit lands, parent refs byte-identical; cap exceeded kills the scope only (`oom-kill`, exit 137); `nix-build` inside succeeds through the daemon socket. `bwrap` opens its nested user namespace inside the nix build sandbox, but that sandbox has no `/etc`, `/run/current-system`, `/bin` or `/usr` to bind, which is why the run suite is by-hand rather than a flake check. - Live: a ledgered clone of a protected repo, `allod change run` with a `claude -p --model haiku` call inside answered; inside, the forge token, `~/.ssh`, shared checkouts and other clones were absent, the memory tree read-only, a push refused for lack of credentials. - Review findings re-executed: wrong branch at record (exit 3), push URL redirected (exit 9), origin repointed at cleanup (exit 9), ledgered branch not checked out at cleanup (exit 3), begin outside the work dir refused, duplicate description refused (exit 5), hard-linked token absent inside the sandbox.

vnprc-agent referenced this issue from allod/memory

2026-10-20 07:59:18 +01:00

delegate-impl dispatches workers through 'allod change run'; worktree conventions become clones #86

vnprc-agent referenced this issue from allod/strategy

2026-10-20 07:59:18 +01:00

Sandbox every delegated worker inside its dev VM so one VM runs a swarm #69

vnprc-agent referenced this issue from allod/vm

2026-10-21 19:35:20 +01:00

Dev VM user is a trusted nix user: a worker can switch the daemon's sandbox off #12

vnprc-agent referenced this issue from allod/memory

2026-10-21 23:29:33 +01:00

delegate-impl dispatches workers through 'allod change run'; worktree conventions become clones #86

vnprc-agent commented

2026-10-22 02:10:14 +01:00

Author

Contributor

Handoff update for commit cd9a968 on local branch agent/worker-sandbox (17 commits ahead of current master, clean, unpushed). This replaces the validation counts and security claims in the earlier handoff comment.

On a dev VM, allod change begin -d makes a self-contained clone under ~/changes; the parent keeps its ledger outside the worker's reach. allod change run confines a worker to the named clone or clones, read-only memory and Git rails, and the runner state it needs, under a user scope with a memory cap. A worker can commit inside its clone. The forge token, SSH directory, shared checkouts, and sibling clones are absent. Outside operations on a ledgered clone use isolated Git configuration so worker-controlled hooks, attributes, filters, and inherited helpers do not run with the overseer's authority. Existing linked worktrees still drain through the old paths.

The command refuses a trusted Nix user. It becomes usable on the deployed dev VMs after the paired allod/vm#12 and allod/nexus changes land, allod/archetypes#146 declares bubblewrap, and the VM is rebuilt. The runner's provider credential and shared network remain inside the sandbox by design (allod/strategy#13, allod/strategy#14). A clone whose HTTPS remote depends on a global credential helper needs an approved transport, because outside clone Git does not load that helper. If this change is wrong, revert it; its ledger is inert to the previous binary and each clone remains an ordinary Git repository.

Refs allod/strategy#69. Closes allod/tools#282.

Risk

R3. This changes the allod change lifecycle and adds an isolation boundary inside the existing VM. The VM remains the host boundary. The worst credible failure after the checks is a mount or Git execution gap in one worker; the sandbox and host Git gates fail closed on the observed unsafe inputs. No deployed state changes until a pin advance and VM rebuild.

Validation

Exact committed tree: nix flake check -L passed. go test ./... and go vet ./... passed in the dev shell.
Built binary: tests/allod-change.sh 441/441; tests/allod-change-run.sh 133/133. The focused cases include sabotage probes for the mount set, executable hooks and filters, credential aliases, reflog links, commit graphs, unsafe runner paths, and missing or unparseable Nix configuration.
tests/allod-change-run-by-hand.sh 6/6 on a dev VM: two writable clones in one scope, a commit with the parent untouched, scope-only OOM kill at the cap, and a trivial build through the Nix daemon socket. It first verifies the real trusted-user refusal, then uses a test-only Nix query mock to exercise the sandbox; a production run as an untrusted user awaits the VM change above.
git diff --check origin/master...HEAD and the local worktree are clean. The final review findings were resolved in the committed implementation; no new review pass is claimed.

Handoff update for commit `cd9a968` on local branch `agent/worker-sandbox` (17 commits ahead of current master, clean, unpushed). This replaces the validation counts and security claims in the earlier handoff comment. On a dev VM, `allod change begin -d` makes a self-contained clone under `~/changes`; the parent keeps its ledger outside the worker's reach. `allod change run` confines a worker to the named clone or clones, read-only memory and Git rails, and the runner state it needs, under a user scope with a memory cap. A worker can commit inside its clone. The forge token, SSH directory, shared checkouts, and sibling clones are absent. Outside operations on a ledgered clone use isolated Git configuration so worker-controlled hooks, attributes, filters, and inherited helpers do not run with the overseer's authority. Existing linked worktrees still drain through the old paths. The command refuses a trusted Nix user. It becomes usable on the deployed dev VMs after the paired `allod/vm#12` and `allod/nexus` changes land, `allod/archetypes#146` declares bubblewrap, and the VM is rebuilt. The runner's provider credential and shared network remain inside the sandbox by design (`allod/strategy#13`, `allod/strategy#14`). A clone whose HTTPS remote depends on a global credential helper needs an approved transport, because outside clone Git does not load that helper. If this change is wrong, revert it; its ledger is inert to the previous binary and each clone remains an ordinary Git repository. Refs allod/strategy#69. Closes allod/tools#282. ## Risk R3. This changes the `allod change` lifecycle and adds an isolation boundary inside the existing VM. The VM remains the host boundary. The worst credible failure after the checks is a mount or Git execution gap in one worker; the sandbox and host Git gates fail closed on the observed unsafe inputs. No deployed state changes until a pin advance and VM rebuild. ## Validation - Exact committed tree: `nix flake check -L` passed. `go test ./...` and `go vet ./...` passed in the dev shell. - Built binary: `tests/allod-change.sh` 441/441; `tests/allod-change-run.sh` 133/133. The focused cases include sabotage probes for the mount set, executable hooks and filters, credential aliases, reflog links, commit graphs, unsafe runner paths, and missing or unparseable Nix configuration. - `tests/allod-change-run-by-hand.sh` 6/6 on a dev VM: two writable clones in one scope, a commit with the parent untouched, scope-only OOM kill at the cap, and a trivial build through the Nix daemon socket. It first verifies the real trusted-user refusal, then uses a test-only Nix query mock to exercise the sandbox; a production run as an untrusted user awaits the VM change above. - `git diff --check origin/master...HEAD` and the local worktree are clean. The final review findings were resolved in the committed implementation; no new review pass is claimed.

vnprc-agent commented

2026-10-22 03:15:56 +01:00

Author

Contributor

Handoff, final: head 1619cbf on agent/worker-sandbox, 18 commits on current master d3d045f, verified by the integrator on this tree (441 change cases, 133 sandbox cases and six live steps from nix develop, Go checks green). The last two cold reads' verified findings were already covered by cd9a968; the two commits after it trim comments and document that the sandbox suites run from the devShell. PR body:

On a dev VM, allod change begin -d now makes a self-contained clone under ~/changes instead of a linked worktree, the parent repository keeps a ledger of the clones it issued under its own .git, and a new allod change run runs a command inside a bubblewrap sandbox that can reach that clone, the memory checkouts read-only, and the runner's session directories, with the forge token, the SSH directory, every shared checkout, every other clone, the overseer's runner configuration and the environment absent. Every command that acts on a clone from outside trusts only the ledger: it refuses a clone whose branch, remote or git config differs from what the ledger and a fixed allowlist permit, and refuses while a worker is still running in it. run refuses to start on a guest whose login user is still a trusted nix user, which every guest is until allod/vm#12 lands, so this change is usable for a swarm only after that one. What stays identical: record, submit, list and cleanup keep their shapes, a linked worktree from before keeps working in all of them until it drains, the protection package and the git hook are untouched, and nothing changes on the hypervisor. Proof: the shell suite at 441 cases, the sandbox suite at 133, every flake check green, six live steps on a real dev VM including a two-clone run, a live model call inside the sandbox, and fourteen cold model reads across ten fix rounds whose verified findings were fixed and re-executed. If it is wrong, revert the branch: the ledger directories are inert to older binaries and any clone already made is an ordinary repository.

Refs allod/strategy#69. Closes allod/tools#282.

Risk

R4, by the owner's call: a security boundary inside a VM where a mistake exposes the forge credential or the overseer's session to a worker. No secrets or deployed state move and rollback is a revert, but the review budget was the R4 one: a design read, hardening reads with repository access, correctness reads and third-family reads, fourteen in all across OpenAI, Anthropic and open-weight models, rotated until the last pair.s verified findings were all already in the tree. The worst credible failure after validation is a mount-set or gate gap a reviewer did not think of; the probes with sabotage halves in tests/allod-change-run.sh and the config-gate tests in tests/allod-change.sh pin what was thought of.

What the reviews found and the branch now does, in short: trusts the ledger's branch and origin, not the clone's (push URLs included); refuses a clone whose git config could run a command, whose .git is a gitfile, or which holds a populated submodule; copies objects instead of hardlinking them; refuses while a run scope for the branch is active; clears the environment to a fixed allowlist with no flag to widen it; binds runner directories read-only except sessions and logs and gives Claude Code a per-run copy of its state file; skips any symlink or hard link that would surface the token; masks memory checkouts' own git directories; starts a new session so the sandbox cannot inject into the invoking terminal; and refuses to start for a trusted nix user or a readable nix netrc.

Validation

go vet ./..., go test ./...: all packages ok.
tests/allod-change.sh: 441 passed. tests/allod-change-run.sh: 133 passed from the repository devShell, each absence probe with a sabotage run proving it can fail.
nix build .#checks.x86_64-linux.<each> for all eight attributes, one at a time: green.
tests/allod-change-run-by-hand.sh from the devShell on a dev VM, six steps: the real trusted-user refusal; scope named with MemoryMax; a two-clone run with both writable; a sandboxed commit with the parent untouched; the cap killing the scope only, with a process started outside surviving; a build inside through the daemon socket.
Live, with the stand-in nix the script uses: a ledgered clone of a protected repo, claude -p answering inside; inside, the forge token, ~/.ssh, shared checkouts, other clones and the briefs directory absent; runner settings read-only and session directories writable; the outside state file unchanged after a run; memory checkouts readable with their .git masked; no controlling terminal; a push refused for lack of credentials.
Every review finding re-executed against the rebuilt binary after its fix.

Handoff, final: head `1619cbf` on `agent/worker-sandbox`, 18 commits on current master `d3d045f`, verified by the integrator on this tree (441 change cases, 133 sandbox cases and six live steps from `nix develop`, Go checks green). The last two cold reads' verified findings were already covered by `cd9a968`; the two commits after it trim comments and document that the sandbox suites run from the devShell. PR body: On a dev VM, `allod change begin -d` now makes a self-contained clone under `~/changes` instead of a linked worktree, the parent repository keeps a ledger of the clones it issued under its own `.git`, and a new `allod change run` runs a command inside a bubblewrap sandbox that can reach that clone, the memory checkouts read-only, and the runner's session directories, with the forge token, the SSH directory, every shared checkout, every other clone, the overseer's runner configuration and the environment absent. Every command that acts on a clone from outside trusts only the ledger: it refuses a clone whose branch, remote or git config differs from what the ledger and a fixed allowlist permit, and refuses while a worker is still running in it. `run` refuses to start on a guest whose login user is still a trusted nix user, which every guest is until allod/vm#12 lands, so this change is usable for a swarm only after that one. What stays identical: `record`, `submit`, `list` and `cleanup` keep their shapes, a linked worktree from before keeps working in all of them until it drains, the protection package and the git hook are untouched, and nothing changes on the hypervisor. Proof: the shell suite at 441 cases, the sandbox suite at 133, every flake check green, six live steps on a real dev VM including a two-clone run, a live model call inside the sandbox, and fourteen cold model reads across ten fix rounds whose verified findings were fixed and re-executed. If it is wrong, revert the branch: the ledger directories are inert to older binaries and any clone already made is an ordinary repository. Refs allod/strategy#69. Closes allod/tools#282. ## Risk R4, by the owner's call: a security boundary inside a VM where a mistake exposes the forge credential or the overseer's session to a worker. No secrets or deployed state move and rollback is a revert, but the review budget was the R4 one: a design read, hardening reads with repository access, correctness reads and third-family reads, fourteen in all across OpenAI, Anthropic and open-weight models, rotated until the last pair.s verified findings were all already in the tree. The worst credible failure after validation is a mount-set or gate gap a reviewer did not think of; the probes with sabotage halves in `tests/allod-change-run.sh` and the config-gate tests in `tests/allod-change.sh` pin what was thought of. What the reviews found and the branch now does, in short: trusts the ledger's branch and origin, not the clone's (push URLs included); refuses a clone whose git config could run a command, whose `.git` is a gitfile, or which holds a populated submodule; copies objects instead of hardlinking them; refuses while a run scope for the branch is active; clears the environment to a fixed allowlist with no flag to widen it; binds runner directories read-only except sessions and logs and gives Claude Code a per-run copy of its state file; skips any symlink or hard link that would surface the token; masks memory checkouts' own git directories; starts a new session so the sandbox cannot inject into the invoking terminal; and refuses to start for a trusted nix user or a readable nix netrc. ## Validation - `go vet ./...`, `go test ./...`: all packages ok. - `tests/allod-change.sh`: 441 passed. `tests/allod-change-run.sh`: 133 passed from the repository devShell, each absence probe with a sabotage run proving it can fail. - `nix build .#checks.x86_64-linux.<each>` for all eight attributes, one at a time: green. - `tests/allod-change-run-by-hand.sh` from the devShell on a dev VM, six steps: the real trusted-user refusal; scope named with `MemoryMax`; a two-clone run with both writable; a sandboxed commit with the parent untouched; the cap killing the scope only, with a process started outside surviving; a build inside through the daemon socket. - Live, with the stand-in nix the script uses: a ledgered clone of a protected repo, `claude -p` answering inside; inside, the forge token, `~/.ssh`, shared checkouts, other clones and the briefs directory absent; runner settings read-only and session directories writable; the outside state file unchanged after a run; memory checkouts readable with their `.git` masked; no controlling terminal; a push refused for lack of credentials. - Every review finding re-executed against the rebuilt binary after its fix.

vnprc-agent referenced this issue from allod/strategy

2026-10-22 03:15:57 +01:00

Sandbox every delegated worker inside its dev VM so one VM runs a swarm #69

vnprc-agent commented

2026-10-22 05:17:38 +01:00

Author

Contributor

Shipped to relay: head bf12261, history rewritten into two logical commits (clones, ledger and gates; the run command) with the tree byte-identical to the verified head 07ad7d4; the first commit builds on its own. Final verification on that head: Go checks, the flake parity gate (704), 454 change cases, 146 sandbox cases and 8 live steps from the devShell. Twelve fix rounds and sixteen cold reads in all; the last read on the shipped source reproduced nothing.

Shipped to relay: head `bf12261`, history rewritten into two logical commits (clones, ledger and gates; the run command) with the tree byte-identical to the verified head `07ad7d4`; the first commit builds on its own. Final verification on that head: Go checks, the flake parity gate (704), 454 change cases, 146 sandbox cases and 8 live steps from the devShell. Twelve fix rounds and sixteen cold reads in all; the last read on the shipped source reproduced nothing.

vnprc-agent commented

2026-10-22 05:47:10 +01:00

Author

Contributor

Landed as the two logical commits on master; verified on nix-dev after its rebuild.

vnprc-agent closed this issue

2026-10-22 05:47:10 +01:00