Skip to content

feat(bounded-agent): finish enclave hardening - #6876

Merged
lpcox merged 5 commits into
lpcox-bounded-agent-sbx-backendfrom
lpcox-bounded-agent-final-hardening
Aug 3, 2026
Merged

feat(bounded-agent): finish enclave hardening#6876
lpcox merged 5 commits into
lpcox-bounded-agent-sbx-backendfrom
lpcox-bounded-agent-final-hardening

Conversation

@lpcox

@lpcox lpcox commented Aug 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Summary

Finishes the bounded-agent stack with an independent hardening pass over staging, authenticated broker ingress, runtime capability reporting, dedicated API-proxy authority, enclave lifecycle behavior, CI/runtime coverage, and operational documentation.

This layer fixes all seven actionable review findings from PR #6874:

  • requires executable primary-sbx ingress proof before reporting support
  • delays sbx readiness telemetry until the selected ingress succeeds
  • adds Unix/TCP authenticated ingress conformance coverage
  • adds sbx enclave runner contract and cleanup coverage
  • reports bounded-agent-specific preflight failures
  • corrects overstated sbx lifecycle documentation
  • preserves fail-closed sbx enclave gating with precise capability evidence

Stack

  1. refactor: establish reusable finite-disclosure foundation #6869 — bounded execution foundation (merged)
  2. feat: add bounded agent enclaves #6872 — bounded-agent Docker/gVisor enclave
  3. feat: add bounded agent sbx runtime matrix #6874 — Docker Sandbox backend and primary-runtime ingress
  4. This PR — final audit, adversarial hardening, runtime matrix, live smokes, and documentation

Target: lpcox-bounded-agent-sbx-backend. This branch started from requested commit 46d32011a4b15e0489333c8688a97fd2d947d6bb and has reconciled the base's subsequent review-fix commit 0fd002e1231235f7c5206b55980a8b8bd049292a.

Runtime matrix

Primary Docker enclave gVisor enclave sbx enclave
Docker SUPPORTED SUPPORTED when runsc is registered BLOCKED
gVisor SUPPORTED when runsc is registered SUPPORTED when runsc is registered BLOCKED
sbx SUPPORTED only after executable authenticated broker-ingress proof SUPPORTED only after executable ingress proof and registered runsc BLOCKED

BLOCKED is a capability result, never a fallback or false pass. The audited local Docker Sandbox plugin (docker sandbox v0.12.0) still cannot prove pinned AWF templates, explicit read-only guest mount targets, hard API-proxy-only/lateral-denial network policy, CPU/memory/PID/disk/per-file limits, and the complete deterministic lifecycle required for bounded-agent sbx enclaves.

Threat-model hardening

  • trusted staging uses a minimal child environment and excludes GitHub, Actions, OIDC, provider, proxy, and telemetry authority
  • primary-sbx broker ingress is authenticated, one-shot, and reported ready only after a real exchange
  • the broker remains networkless; Docker/gVisor enclaves receive only the immutable seed and the dedicated API-proxy-only network
  • the dedicated proxy receives only the selected provider credential and no external telemetry or arbitrary proxy authority
  • agent-visible output remains canonical finite JSON; transcripts, stdout/stderr, exit details, protected audit data, and capability values are not disclosed
  • no authenticated gh, safe-output channel, MCP gateway, primary-agent peer, Squid, Docker socket, home state, or sibling repository enters the enclave

Validation

  • schema regeneration and both schema-copy comparison: passed, clean
  • TypeScript type-check: passed
  • focused reconciled hardening suites: 8 suites, 162 tests passed
  • full unit suite: 302 suites, 5,316 passed, 1 skipped
  • bounded-agent Docker integration: 10 tests passed
  • ESLint: passed
  • Markdown lint: 5 files, 0 errors
  • bundle build: passed (release/awf-bundle.js)
  • workflow compilation and mandatory post-processing: passed
  • bounded-agent broker and enclave image builds: passed
  • local live Docker enclave/network-isolation smoke: SUPPORTED
  • local gVisor probe: explicit BLOCKED because runsc is not registered on the local host
  • CI live Docker enclave matrix: passed
  • CI live gVisor enclave matrix with registered runsc: passed
  • CI Docker Sandbox capability gate: passed with explicit bounded-agent sbx block and no fallback
  • CI supply-chain scan, gate, and docs preview: passed
  • local nine-cell matrix: Docker/Docker SUPPORTED; every unavailable runtime cell explicitly BLOCKED
  • independent security specialist review: no exploitable vulnerabilities found
  • independent final diff review: no high-confidence correctness or security findings
  • mergeability against lpcox-bounded-agent-sbx-backend: clean and conflict-free

Notes

Repository dependency installation was unavailable from the configured/fallback registries for several future-pinned package versions, so local TypeScript, Jest, ESLint, Markdown, and bundle validation used isolated compatible tool dependencies without modifying package manifests or lockfiles.

@lpcox
feat(bounded-agent): finish enclave hardening
1925d3d 
Harden runtime capability reporting, authenticated ingress, staging and proxy isolation, and fail-closed Docker Sandbox handling. Add adversarial coverage, live Docker/gVisor smokes, the nine-cell runtime matrix, compiled agentic workflows, and operational threat-model documentation.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 815c9ab8-b519-4fe8-918f-07124708a871
Copilot AI review requested due to automatic review settings August 3, 2026 04:50
@github-actions

github-actions Bot commented Aug 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Documentation Preview

Documentation build failed for this PR. View logs.

Built from commit ed23607

Copilot AI reviewed Aug 3, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Hardens bounded-agent enclave ingress, runtime reporting, isolation checks, and operational validation across Docker, gVisor, and blocked sbx configurations.

Changes:

  • Delays sbx readiness telemetry until authenticated ingress succeeds.
  • Adds enclave, ingress, credential-isolation, and runtime-matrix coverage.
  • Adds live smoke workflows and updates bounded-agent documentation.
Show a summary per file
File Description
src/services/bounded-agent-service.test.ts Tests dedicated proxy credential isolation.
src/commands/main-action.ts Records sbx ingress telemetry.
src/bounded-agent/sbx-runner.test.ts Tests sbx runner lifecycle and isolation contract.
src/bounded-agent/preflight.ts Rewrites shared preflight errors for bounded agents.
src/bounded-agent/preflight.test.ts Tests bounded-agent-specific errors.
src/bounded-agent/manager.ts Defers sbx readiness reporting.
src/bounded-agent/manager.test.ts Tests minimal staging environment.
src/bounded-agent/ingress-conformance.test.ts Tests Unix/TCP ingress parity and authentication.
scripts/ci/smoke-bounded-agent-enclave.sh Adds live enclave isolation smoke.
scripts/ci/report-bounded-agent-runtime-matrix.test.ts Tests executable sbx capability gating.
scripts/ci/report-bounded-agent-runtime-matrix.js Requires real sbx ingress proof.
scripts/ci/probe-bounded-agent-primary-sbx.js Adds primary-sbx ingress probe.
README.md Links bounded-agent documentation.
docs/bounded-agents.md Clarifies sbx limitations and authority boundaries.
docs/awf-config-spec.md Corrects sbx lifecycle claims.
.github/workflows/test-bounded-agent-runtime-matrix.yml Adds runtime matrix CI.
.github/workflows/smoke-bounded-agents.md Adds Docker scheduled smoke source.
.github/workflows/smoke-bounded-agents.lock.yml Compiles Docker smoke workflow.
.github/workflows/smoke-bounded-agents-gvisor.md Adds gVisor scheduled smoke source.
.github/workflows/smoke-bounded-agents-gvisor.lock.yml Compiles gVisor smoke workflow.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 20/20 changed files
  • Comments generated: 3
  • Review effort level: Balanced

Comment thread .github/workflows/test-bounded-agent-runtime-matrix.yml
Comment thread scripts/ci/smoke-bounded-agent-enclave.sh
Comment thread src/bounded-agent/preflight.ts Outdated
lpcox added 3 commits August 2, 2026 21:59
@lpcox
fix(ci): use proxy IP in enclave smoke
1ec753f 
Exercise the production-style direct API-proxy endpoint instead of relying on Docker DNS inside gVisor, while exposing only content-free failure dimensions.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 815c9ab8-b519-4fe8-918f-07124708a871
@lpcox
fix(ci): retrigger matrix for smoke changes
f1e6a27 
Include the live enclave smoke script in the runtime matrix path filter so security-test changes cannot evade CI.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 815c9ab8-b519-4fe8-918f-07124708a871
@lpcox
merge: reconcile bounded-agent review fixes
2d95438 
Integrate the updated sbx backend base while retaining the executable primary-sbx ingress probe, final adversarial coverage, CI matrix, and hardening documentation.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 815c9ab8-b519-4fe8-918f-07124708a871
@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

✅ Copilot review passed with no inline comments.

@lpcox Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

@lpcox
test(bounded-agent): match executable probe path
c030f12 
Exercise the exact primary-sbx probe command emitted by the reconciled runtime-matrix collector.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 815c9ab8-b519-4fe8-918f-07124708a871
@lpcox
lpcox merged commit 3f57089 into lpcox-bounded-agent-sbx-backend Aug 3, 2026
6 checks passed
@lpcox
lpcox deleted the lpcox-bounded-agent-final-hardening branch August 3, 2026 05:19
@lpcox

lpcox commented Aug 3, 2026

Copy link
Copy Markdown
Collaborator Author

@copilot Fix the code for all comments in this review thread.

When a review comment includes a suggested change, apply the suggestion exactly.

Do not make changes beyond what is described in the linked review thread.

This was referenced Aug 3, 2026
Open
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@lpcox