Skip to content

Record the own-clone rule for sandboxed runs and the vendor sandbox's side effects - #1129

Open
seathatflowsinourveins wants to merge 3 commits into
mainfrom
claude/cc-native-practice-sandbox-own-clone-20261015
Open

Record the own-clone rule for sandboxed runs and the vendor sandbox's side effects#1129
seathatflowsinourveins wants to merge 3 commits into
mainfrom
claude/cc-native-practice-sandbox-own-clone-20261015

Conversation

@seathatflowsinourveins

@seathatflowsinourveins seathatflowsinourveins commented Oct 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Scope

  • What this PR changes: the practice skill's sandbox row records the command center's own-clone rule for sandboxed Claude Code runs (2026-10-15) and the env-scrub subprocess sandbox. The client-core row adds a watch item for the placeholders sandboxed runs leave on the Windows drive. The practice record gets a dated addendum.
  • Base commit: a339425ca56ec3fb87dff0fa8ad5dffc83354168
  • Lane: lane:foundation
  • Owned paths touched: .claude/skills/claude-native-practice/reference/ (slots.json, isolation.md, native-clients.md), docs/decisions/2026-10-09-claude-code-native-practice.md, the snapshot label in evidence/artifacts/claude-native-practice-20261009/claude-native-slot-manifest.json, the new tests/test_native_practice_sandbox_own_clone.py, manifests/evidence.json

SOTA sources

Evidence-class table

Claim Evidence class Command / receipt
Sandboxed runs in worktrees of this repository left a 0444 0-byte .git/config.lock in the shared .git and blocked git config writes native_proven git worktree add -b failed with "could not lock config file"; stat of the file (born 2026-10-14T23:59:29Z), recorded and removed at 2026-10-15T00:50:33Z; it re-appeared at 01:04Z during a sandboxed run in a worktree (the running lane's report)
The 2.1.300 sandbox write-protects those .git paths source_review binary string list, offset above
--settings sandbox.enabled false turns the sandbox off; with the env scrub, Bash still runs in a bwrap PID namespace with seccomp native_proven one-turn measurement probes, 2026-10-15T01:06:39Z–01:11:04Z: off/unset wrote outside the cwd with PID 1 /sbin/init; scrub with off wrote outside the cwd, NSpid 6, Seccomp 2, PID 1 bwrap
Neither installed client is affected by the Windows placeholders native_proven WSL 2.1.300 from a scratch HOME, and Windows claude.exe 2.1.270 doctor and -p, all start past managed settings (01:01Z)
The rows state the rulings on both surfaces synthetic tests/test_native_practice_sandbox_own_clone.py

Local commands run

$ python3 -m unittest tests.test_native_practice_sandbox_own_clone   # against main's rows
Ran 3 tests, FAILED (failures=2, errors=1)
$ python3 -m unittest tests.<module>   # at 6a6c3bf7, one process per module, idle-class, 01:13:41-01:15:31Z
rc 0 for all 11: sandbox_own_clone (3), native_practice_retired_routes (45), native_practice_snapshot_provenance (9), primary_source_reading_counts (22), native_practice_meter_windows (6), paired_runs_results (31), evidence_manifest (5), local_pages_policy_grants (25), local_pages_architecture_policy (11), runtime_worker_openhands_push_gate (127), validate (86)

Decision record

docs/decisions/2026-10-09-claude-code-native-practice.md, addendum of 2026-10-15.

Notes for the reads

Fix round 2 (cdee315)

From GPT full1 at efa0b45 (full1-pr1129/GPT-VERDICT-efa0b45a0.md); the local review at efa0b45 had no findings. Pushed under the command center's standing release rule (2026-10-15).

Finding Fix Fail-first test (failed at efa0b45, passes at cdee315)
P2: the source record said the 2.1.300 GPG check was in the floor decision's 2026-10-14 addendum, but this tree has no such addendum (it is #1128's) The check was re-run at 2026-10-15T11:23:49Z and is kept beside the record. release-signature-2.1.300.json holds the receipt; release-2.1.300/ holds the public manifest.json, manifest.json.sig and claude-code.asc it verified. Result: a good signature from 31DDDE24DDFAB679F42D7BD2BAA929FF1A7ECACE, and the manifest's linux-x64 checksum and size equal the installed binary's (674deba0…, 266972344). The record now cites the receipt. test_the_signature_check_the_record_claims_is_retained_and_binds_the_binary checks that the record names the receipt, that every decision file it cites contains 2.1.300, that the retained files' sha256 values match, and that the manifest binds the binary. It failed with 'release-signature-2.1.300.json' not found.
P2, inherited: the model-currency age failure No change. Main's #1124 refreshed those date checks; the read itself marks them cleared by the live base, and the landing rebase takes them. —

The receipt field holding the signer fingerprint is named signer_fingerprint: gitleaks' generic-api-key rule flagged it under the name key_fingerprint, and the hook was not bypassed.

Follow-ups

  • GPT P3: some cited documentation and measurement captures are not retained.
  • GPT P3: replaying the probe overwrites shared output names.

Checklist

  • No GitHub Actions changed.
  • No workflows changed.
  • No secrets printed, logged or committed.
  • No paid hosting, subscription or billing surface.
  • Peer-owned files and worktrees preserved.

🤖 Generated with Claude Code

@seathatflowsinourveins @claude
Record the own-clone rule for sandboxed runs and the vendor sandbox's…
6a6c3bf 
… side effects

The command center ruled on 2026-10-15 that a sandboxed Claude Code session
runs in its own clone, never in the shared main checkout or one of its
worktrees.

- The sandbox row's note carries the rule and why. The 2.1.300 sandbox
  write-protects .git/config, .git/config.lock, .git/config.worktree and its
  lock, .git/hooks, .git/worktrees and more; bwrap creates an empty read-only
  placeholder for a missing path; and a worktree's common directory is the
  main .git. Sandboxed runs in worktrees therefore left .git/config.lock in
  the shared .git and blocked every lane's git config writes (2026-10-14
  23:59:29Z to 2026-10-15 00:50:33Z, and again at 01:04Z). The note also
  gives the interim removal-with-stat and the 10-minute alert.
- The same note records the env-scrub subprocess sandbox:
  CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1 runs Bash in a bwrap PID namespace with
  a seccomp filter whatever sandbox.enabled says (CHANGELOG 2.1.98; measured:
  NSpid 6, Seccomp 2, an outside write still allowed with sandbox.enabled
  false). That accounts for the "sandbox stayed on" report.
- The client-core row watches the 0-byte placeholders left under
  C:\Program Files\ClaudeCode, among them a file named managed-settings.d.
  No effect was measured on WSL 2.1.300 or Windows claude.exe 2.1.270; it is
  re-checked at the next Windows client upgrade.
- The practice record gets a 2026-10-15 addendum, and the snapshot label
  follows the slots file.

Tests: a new module pins the three statements on both surfaces a session
reads. Against main's rows it fails (2 failures, 1 error).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
@seathatflowsinourveins seathatflowsinourveins added the lane:foundation Foundation lane: Claude/Codex setup, hosts, memory, RAG, research, workers label Oct 15, 2026
@seathatflowsinourveins seathatflowsinourveins mentioned this pull request Oct 15, 2026
Open
5 tasks done
seathatflowsinourveins and others added 2 commits October 15, 2026 01:14
@seathatflowsinourveins @claude
Link a reviewable source record for the own-clone correction
efa0b45 
The local review of 6a6c3bf (review_output.json 55604e97) found that the
correction at docs/decisions/2026-10-09-claude-code-native-practice.md
:458-459 cited the lane's working files for its binary offsets and probes.

- evidence/artifacts/sandbox-own-clone-20261015/SOURCE-RECORD.md: the
  2.1.300 binary pinned by sha256 (674deba0, the signed manifest's
  linux-x64 checksum) with the three byte offsets re-read at 05:10Z and
  the bytes found there (the protected-path list, the WSL managed-settings
  directory, the wslInheritsWindowsSettings schema text); the probe table
  and the env-scrub probe; the CHANGELOG lines at 94506ff0 (2.1.98 and
  2.1.299) and the docs quotes; and what is inference (the
  bind-to-placeholder step). No session ids.
- probe.sh: the probe script as run.
- The decision links the record instead of the working files.

tests/test_native_practice_sandbox_own_clone.py gains an assertion that
failed before this commit; the native-practice modules run 104 OK;
validate rc 0.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
@seathatflowsinourveins @claude
Retain the 2.1.300 signature check beside the own-clone source record
cdee315 
GPT read of #1129 at efa0b45 (P2): the source record said the GPG check of the signed 2.1.300 manifest was
in the floor decision's 2026-10-14 addendum, which this tree does not contain (that addendum is #1128's). The
check was re-run 2026-10-15T11:23:49Z and is retained here: release-signature-2.1.300.json, with the public
manifest.json, manifest.json.sig and claude-code.asc it verified in release-2.1.300/. Result: good signature
from 31DDDE24DDFAB679F42D7BD2BAA929FF1A7ECACE, and the manifest's linux-x64 checksum and size equal the
installed binary's (674deba0..., 266972344). The record now cites the receipt.

Regression test_the_signature_check_the_record_claims_is_retained_and_binds_the_binary checks:
- the record names the receipt, and every decision file it cites contains 2.1.300;
- the retained files match their sha256;
- the manifest binds the binary.
Fail-before: AssertionError: 'release-signature-2.1.300.json' not found. After: 5 OK; the privacy and
provenance modules OK. validate reports only the inherited model-currency date checks that main has refreshed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This was referenced Oct 15, 2026
Open
Open

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

lane:foundation Foundation lane: Claude/Codex setup, hosts, memory, RAG, research, workers

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@seathatflowsinourveins