Repository navigation
Commit 32be8a9
committed
feat(agents): verify sandbox checkpoint evidence against S3
Add the reaper's checkpoint evidence module. A key is recorded only when
it sits directly under the session's own <developer prefix><generation>/
prefix, with the prefix built from the reaper configuration and a
validated (32 lowercase hex) Sandbox generation, never from the Pod, and
an S3 ListObjectsV2 confirms it. Three sources name a key: the
termination-log receipt, the newest object listed in the session prefix
(for a receipt that was never observed), and a recovered session's
inherited restore key, which may belong to an older ancestor generation.
An existence check lists with the key itself as the prefix, so it needs
one request and no pagination. The newest-object listing follows all pages
within a 25-second deadline and rejects missing or repeated continuation
tokens. A regression test finds the newest key after twelve listing pages. Any store failure defers the decision instead of recording a
missing checkpoint, and buzz_sandbox_reaper_s3_errors_total carries a
bounded kind label (timeout, access_denied, not_found_bucket, other).
The S3 adapter is tested against a local HTTP endpoint.
This brings in the AWS SDK dependencies and documents the checkpoint
evidence rules in docs/remote-agents.md.
Signed-off-by: Tee8z <[email protected]>1 parent 979923d commit 32be8a9
6 files changed
Lines changed: 1316 additions & 82 deletions
File tree
- crates/buzz-sandbox-reaper
- src
- docs
0 commit comments