Skip to content

Add sandbox worktree experiment#142

Merged
Koukyosyumei merged 4 commits into
mainfrom
sandbox-experiment
Jun 15, 2026
Merged

Add sandbox worktree experiment#142
Koukyosyumei merged 4 commits into
mainfrom
sandbox-experiment

Conversation

@Koukyosyumei

Copy link
Copy Markdown
Collaborator

No description provided.

…cape failure

Replace the contrived absolute-path/symlink/branch scenarios with one realistic,
non-planted failure: an agent runs the project's own build.sh, which publishes to
a sibling ../published, overwriting an untracked file outside the worktree while
git status stays clean. h5i env (process tier) denies the same write.

Verified end-to-end on this host (Landlock ABI 3): headless 'claude -p' ran
build.sh unprompted and clobbered the outside homepage; identical build.sh via
'h5i env run' was denied (mkdir ../published: Permission denied) with auto-captured
evidence. Fix inherited bug: '--audit all' is not an env create flag.
@Koukyosyumei Koukyosyumei changed the title Sandbox experiment Add sandbox worktree experiment Jun 15, 2026
… tier

The agent/agent-claude profile (auto-selected at the supervised & container
tiers) grants host-shared /tmp as agent scratch, so a precious file in /tmp was
writable from the box and the h5i arm failed on supervised. Move the experiment
to a dedicated $HOME dir (granted by neither the default nor agent profile) so
the out-of-$WORK write is denied on every enforceable tier. Add a rm -rf safety
guard and an ISOLATION env var (process|supervised|...).

Verified 5/5 PASS on both ISOLATION=process (default profile) and
ISOLATION=supervised (agent-claude profile). Docs now explain the boundary is
set by the profile, not the tier, and why the demo avoids host-shared /tmp.
@Koukyosyumei

Copy link
Copy Markdown
Collaborator Author

🪙 75% AI-authored · 6 files

3 AI commits · 🚩 1 flagged

Important

🎯 Goal: Rewrite experiment_safe_sandbox_worktree_workflow.md around a realistic, intrinsic git-worktree failure that h5i env prevents

3 / 461 : 1.81 / 11
AI commitsfiles touchedREAD : EDITTHINKs / ops

💬 The ask

"Add a reproducible experiment comparing plain git worktree escape behavior with h5i env sandbox-style worktree protection, including observed results."

📍 What shipped

  • ✓ Add sandbox worktree experiment
  • ✓ update
  • ✓ experiment: recenter worktree-vs-h5i demo on a verified filesystem-escape failure
  • ✓ experiment: move worktree demo off /tmp so it holds on the supervised tier

Tip

✅ Security scan clean

No credentials leaked in this branch's diff. h5i scanned every added line against the secret rule pack and found nothing to rotate.

Note

Duplicate-code scan clean — no copy-paste blocks introduced.

🧠 Reasoning by file — 6079 nodes across 6 lanes, latest 24 only
%%{init: {"flowchart": {"nodeSpacing": 42, "rankSpacing": 48, "diagramPadding": 14}, "themeVariables": {"fontSize": "18px"}} }%%
flowchart TB
  subgraph lane_0["💭 Reasoning · 2 steps"]
    direction LR
    n_lane_0_0["THINK · 131.0) are here. Note: Codex ships its *own* sandbox by default, so for …"]:::t
    n_lane_0_1["THINK · Let me save this non-obvious finding to memory (it'll save re-deriving i…"]:::t
    n_lane_0_0 --> n_lane_0_1
  end
  subgraph lane_1["📄 scripts/experiment_safe_sandbox_worktree_workflow.md · 10 ops"]
    direction LR
    n_lane_1_0["READ"]:::o
    n_lane_1_1["EDIT"]:::a
    n_lane_1_2["READ"]:::o
    n_lane_1_3["EDIT × 2"]:::a
    n_lane_1_4["READ"]:::o
    n_lane_1_5["EDIT × 4"]:::a
    n_lane_1_0 --> n_lane_1_1
    n_lane_1_1 --> n_lane_1_2
    n_lane_1_2 --> n_lane_1_3
    n_lane_1_3 --> n_lane_1_4
    n_lane_1_4 --> n_lane_1_5
  end
  subgraph lane_2["📄 scripts/experiment_safe_sandbox_worktree.sh · 5 ops"]
    direction LR
    n_lane_2_0["READ"]:::o
    n_lane_2_1["EDIT"]:::a
    n_lane_2_2["READ"]:::o
    n_lane_2_3["EDIT × 2"]:::a
    n_lane_2_0 --> n_lane_2_1
    n_lane_2_1 --> n_lane_2_2
    n_lane_2_2 --> n_lane_2_3
  end
  subgraph lane_3["📄 scripts/experiment_safe_sandbox_worktree_results.md · 3 ops"]
    direction LR
    n_lane_3_0["READ"]:::o
    n_lane_3_1["EDIT × 2"]:::a
    n_lane_3_0 --> n_lane_3_1
  end
  subgraph lane_4["📄 MEMORY.md · 2 ops"]
    direction LR
    n_lane_4_0["READ"]:::o
    n_lane_4_1["EDIT"]:::a
    n_lane_4_0 --> n_lane_4_1
  end
  subgraph lane_5["🗂 Other · 2 nodes"]
    direction LR
    n_lane_5_0["READ · read src/sandbox.rs"]:::o
    n_lane_5_1["EDIT · wrote agent-profile-grants-shared-tmp.md"]:::a
    n_lane_5_0 --> n_lane_5_1
  end
  classDef o fill:#dbeafe,stroke:#1e3a8a,color:#0b1c4a;
  classDef t fill:#fef3c7,stroke:#92400e,color:#3f2d05;
  classDef a fill:#dcfce7,stroke:#166534,color:#0a2e16;
  classDef n fill:#ede9fe,stroke:#5b21b6,color:#221251;
  classDef m fill:#e5e7eb,stroke:#374151,color:#0b0f17;
Loading

Note

🪙 Token reduction — 2 captured tool outputs kept out of context: 1578 → 1574 tokens (0% saved, 4 tokens). Full output is recoverable with h5i recall object.

📜 Per-commit provenance

3698a4ab experiment: move worktree demo off /tmp so it holds on the supervised tier

  • promptUse a different dir instead of /tmp to make the supervised tier work in this example.
  • model claude-opus-4-8 · agent claude-code

1954e493 experiment: recenter worktree-vs-h5i demo on a verified filesystem-escape failure

  • promptRewrite the worktree experiment around a realistic, convincing git-worktree failure that h5i prevents; test it with a headless agent; update results.md and the .sh script.
  • model claude-opus-4-8 · agent claude-code
  • 🚩 review signals — score 0.40: PERMISSION_CHANGE, PERMISSION_CHANGE
    • shape signals (informational): LARGE_DIFF, UNTESTED_CHANGE

fc932487 Add sandbox worktree experiment

  • promptAdd a reproducible experiment comparing plain git worktree escape behavior with h5i env sandbox-style worktree protection, including observed results.
  • model unknown · agent codex

Generated by h5i · re-run h5i share pr post to refresh.

@Koukyosyumei Koukyosyumei merged commit e85b64e into main Jun 15, 2026
5 checks passed
@Koukyosyumei Koukyosyumei deleted the sandbox-experiment branch June 15, 2026 16:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant