Skip to content

Live SBX and MSB validation of the host-authoritative lifecycle slices #639

New issue
New issue
Open
Open
Live SBX and MSB validation of the host-authoritative lifecycle slices#639

Description

@mogul
mogul
opened on Oct 25, 2026

Replaces the original body, which predated the merge of #637 and the read-only mount redesign.

Already validated live (do not repeat)

  • msb 0.7.7, macOS arm64, default image, fresh create: the optional canary scripts/qualify-msb-ro-mount passed (every write denied, host directory unchanged, controls OK). Recorded in docs/adr/0035-host-authoritative-sandbox-config.md.
  • msb inspect --format json on a real acq sandbox returned the expected mount shape: the host-config mount appears in active_config.mounts[] as a read-only Bind backed by the sandbox's acq host config directory.
  • The provider-adoption live gate (identity check and --no-provider-kits removal) passed on SBX and MSB at the revision recorded in docs/VERIFY_PROVIDER_ADOPTION.md.

Still unverified on a real host

MSB:

  • A readonly: true kit file used end to end on create and on heal (no shipped kit uses one yet; needs the Patterns pin bump, chore(kits): bump PATTERNS_KIT_REF to the first Patterns release with readonly root startup scripts #649).
  • Linux hosts, msb versions other than 0.7.7, and behavior after msb start or a restart.
  • The .config.mounts path in msb inspect output (the gate reads only .active_config.mounts), and inspect output shape on other versions.
  • Whether msb exec passes a guest exit code of 2 through unchanged (affects only the wording of a refusal).
  • Forging each legacy guest marker (agent, workspace, SSH socket, kit env, install gate) and confirming no session behavior changes; deleting host keys and confirming the heal re-runs.

SBX:

  • Forged-probe heal: remove the Zscaler CA file, USAi config and playbook AGENTS.md in the guest; re-attach must not re-apply them while the host builtin-kits record is current; altering the host record must trigger kit add.
  • Legacy sandbox (no builtin-kits): one consolidated recreate notice on sbx 0.38+; acq rm plus a fresh run re-seeds the record.
  • Stale-bundle refresh still re-applies all kits.
  • The eight-step validation in ADR-0037 (mount enforcement under sudo, restart persistence, replay integrity, clone and mountless modes).

Record each result as PASS, FAIL or BLOCKED in docs/VERIFY_PROVIDER_ADOPTION.md, with the tested revision and backend version. File failures as their own issues.

Blocked on: a sandbox-capable host; the end-to-end item is blocked on #649.

AI-assisted tracker entry (OpenCode). Human review required.

Activity

  1. mogul
    added a parent issue on Oct 25, 2026

  2. mogul commented on Nov 10, 2026

    @mogul
    mogul
    on Nov 10, 2026
    ContributorAuthor

    🤖: AI agent (First Mate), posting on behalf of @mogul.

    First live run of scripts/verify-host-authority-live (#682, revision 4e2e57e8), 2026-11-10, macOS arm64, msb 0.7.7, sbx v0.51.0. Raw transcript stays in the maintainer's gitignored tmp/ directory.

    Step Result
    msb-ro-kit-create PASS
    msb-inspect-shape PASS
    msb-exit-code PASS
    msb-ro-kit-heal PASS
    msb-forged-markers (exec sessions) PASS
    msb-install-gate PASS
    msb-ro-oci (shipped oci-engine kit, Patterns v1.19.0) PASS
    sbx-baseline and the 4 SBX steps that depend on it BLOCKED: sbx 0.51.0 rejects acq's kit composition; filed as #690
    sbx read-only mount vs a sudo guest (extra check, not in the PR script) see caveat below

    Caveat on the extra SBX check: writes, creates and renames inside the :ro mount failed with "Read-only file system", and the host directory was unchanged. The remount attempt could not run (mount: not found in the guest image), and the check compared only the host side. So this shows the mount refused ordinary writes from the guest and did not prove resistance to a remount by guest root. Not recorded as a full PASS for ADR-0037 step 2.

    Still not covered: host reboot persistence, other hosts and msb versions, Windows, a live ssh-agent forward, MANUAL 1 attach/agent-key cases, and the sbx registered-command tamper test (ADR-0037 step 5).

  3. mogul commented on Nov 10, 2026

    @mogul
    mogul
    on Nov 10, 2026
    ContributorAuthor

    🤖: AI agent (First Mate), posting on behalf of @mogul.

    Second live run of scripts/verify-host-authority-live, 2026-11-10, revision ff592e78 (#682, with the review fixes and the hang fix), macOS arm64, msb 0.7.7, sbx v0.51.0. The first run was on 4e2e57e8; results for the MSB steps are unchanged.

    Step Result
    msb-ro-kit-create, msb-inspect-shape, msb-exit-code, msb-ro-kit-heal, msb-forged-markers, msb-install-gate, msb-ro-oci 7 of 7 PASS
    sbx-baseline and the 4 SBX steps that depend on it BLOCKED: the same sbx 0.51.0 kit-composition error as before ("cannot mix v3 kits with v1/v2 kits"), tracked in #690; guard in #691
    sbx read-only mount vs a sudo guest (extra wrapper check) BLOCKED: the guest image has no mount command, so the remount attempt cannot run. Writes alone are not accepted as evidence

    Not covered, as before: host reboot persistence, other hosts and msb versions, Windows, a live ssh-agent forward, the MANUAL 1 attach and agent-key cases, and the sbx registered-command tamper test (ADR-0037 step 5). The SBX rows in the Host Authority Live Validation Record in docs/VERIFY_PROVIDER_ADOPTION.md therefore stay BLOCKED.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions