Add sandbox worktree experiment#142
Merged
Merged
Conversation
…cape failure Replace the contrived absolute-path/symlink/branch scenarios with one realistic, non-planted failure: an agent runs the project's own build.sh, which publishes to a sibling ../published, overwriting an untracked file outside the worktree while git status stays clean. h5i env (process tier) denies the same write. Verified end-to-end on this host (Landlock ABI 3): headless 'claude -p' ran build.sh unprompted and clobbered the outside homepage; identical build.sh via 'h5i env run' was denied (mkdir ../published: Permission denied) with auto-captured evidence. Fix inherited bug: '--audit all' is not an env create flag.
… tier The agent/agent-claude profile (auto-selected at the supervised & container tiers) grants host-shared /tmp as agent scratch, so a precious file in /tmp was writable from the box and the h5i arm failed on supervised. Move the experiment to a dedicated $HOME dir (granted by neither the default nor agent profile) so the out-of-$WORK write is denied on every enforceable tier. Add a rm -rf safety guard and an ISOLATION env var (process|supervised|...). Verified 5/5 PASS on both ISOLATION=process (default profile) and ISOLATION=supervised (agent-claude profile). Docs now explain the boundary is set by the profile, not the tier, and why the demo avoids host-shared /tmp.
Collaborator
Author
🪙 75% AI-authored · 6 files
Important 🎯 Goal: Rewrite experiment_safe_sandbox_worktree_workflow.md around a realistic, intrinsic git-worktree failure that h5i env prevents
💬 The ask
📍 What shipped
Tip ✅ Security scan cleanNo credentials leaked in this branch's diff. h5i scanned every added line against the secret rule pack and found nothing to rotate. Note Duplicate-code scan clean — no copy-paste blocks introduced. 🧠 Reasoning by file — 6079 nodes across 6 lanes, latest 24 only%%{init: {"flowchart": {"nodeSpacing": 42, "rankSpacing": 48, "diagramPadding": 14}, "themeVariables": {"fontSize": "18px"}} }%%
flowchart TB
subgraph lane_0["💭 Reasoning · 2 steps"]
direction LR
n_lane_0_0["THINK · 131.0) are here. Note: Codex ships its *own* sandbox by default, so for …"]:::t
n_lane_0_1["THINK · Let me save this non-obvious finding to memory (it'll save re-deriving i…"]:::t
n_lane_0_0 --> n_lane_0_1
end
subgraph lane_1["📄 scripts/experiment_safe_sandbox_worktree_workflow.md · 10 ops"]
direction LR
n_lane_1_0["READ"]:::o
n_lane_1_1["EDIT"]:::a
n_lane_1_2["READ"]:::o
n_lane_1_3["EDIT × 2"]:::a
n_lane_1_4["READ"]:::o
n_lane_1_5["EDIT × 4"]:::a
n_lane_1_0 --> n_lane_1_1
n_lane_1_1 --> n_lane_1_2
n_lane_1_2 --> n_lane_1_3
n_lane_1_3 --> n_lane_1_4
n_lane_1_4 --> n_lane_1_5
end
subgraph lane_2["📄 scripts/experiment_safe_sandbox_worktree.sh · 5 ops"]
direction LR
n_lane_2_0["READ"]:::o
n_lane_2_1["EDIT"]:::a
n_lane_2_2["READ"]:::o
n_lane_2_3["EDIT × 2"]:::a
n_lane_2_0 --> n_lane_2_1
n_lane_2_1 --> n_lane_2_2
n_lane_2_2 --> n_lane_2_3
end
subgraph lane_3["📄 scripts/experiment_safe_sandbox_worktree_results.md · 3 ops"]
direction LR
n_lane_3_0["READ"]:::o
n_lane_3_1["EDIT × 2"]:::a
n_lane_3_0 --> n_lane_3_1
end
subgraph lane_4["📄 MEMORY.md · 2 ops"]
direction LR
n_lane_4_0["READ"]:::o
n_lane_4_1["EDIT"]:::a
n_lane_4_0 --> n_lane_4_1
end
subgraph lane_5["🗂 Other · 2 nodes"]
direction LR
n_lane_5_0["READ · read src/sandbox.rs"]:::o
n_lane_5_1["EDIT · wrote agent-profile-grants-shared-tmp.md"]:::a
n_lane_5_0 --> n_lane_5_1
end
classDef o fill:#dbeafe,stroke:#1e3a8a,color:#0b1c4a;
classDef t fill:#fef3c7,stroke:#92400e,color:#3f2d05;
classDef a fill:#dcfce7,stroke:#166534,color:#0a2e16;
classDef n fill:#ede9fe,stroke:#5b21b6,color:#221251;
classDef m fill:#e5e7eb,stroke:#374151,color:#0b0f17;
Note 🪙 Token reduction — 2 captured tool outputs kept out of context: 1578 → 1574 tokens (0% saved, 4 tokens). Full output is recoverable with 📜 Per-commit provenance
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.