Native ACP session computer dispatch and renewable scoped admission

toasterson commented

2026-10-18 00:36:18 +00:00

Owner

Merged main 71ca31b7 records ACP computer capabilities but never dispatches the native agent's tools through them. This adds an explicit session-scoped ACP client-computer Backend: one retained session pins one fresh allocation tuple, its filesystem/exec tools use custodian callbacks, and failed admission, expiry, mismatch or transport ambiguity cannot select the configured Execd backend.

Design

The authenticated owning scoped principal opts in through session/load metadata. Explicit intent is sticky even if initial admission fails. The full owner/allocation/session/workspace/sandbox/generation/executor/site/root tuple is immutable; only same-tuple lease extension is accepted. New connections must explicitly reattach. Capabilities alone do not enable dispatch; foreign principals and session operators cannot substitute another owner's computer.
The existing panic-safe turn overlay replaces the five primary filesystem/exec tools with one coherent Backend. Other sessions, Akhs and background work retain their configured backends. Host filesystem/process tools, CLI/WASM and secondary backends are refused in the bound scope unless actually routed through the ACP computer. Host-enabled code generation now truthfully declares its optional rustfmt process capability; the pure variant remains available.
Standard ACP read/write and terminal callbacks reach the custodian's exact Computer. Directory classification/listing/size use that same terminal, with no host metadata. Callback deadlines respect the remaining command and lease budget; cancellation stops the actual child. A sticky native fence complements the custodian's durable operation fence. Pre/post tool availability checks prevent glob/grep from reporting successful partial results after a lost binding.
Callbacks keep receiving credentials and allocation verification at the custodian. Exact-allocation adoption in ExecdBackend would need a second credential/transport/lifecycle policy and removal of its unconditional allocation/renewal behavior. The callback seam preserves the existing ownership split.

Bootstrap, renewal and receiver custody

Existing privileged session issuer and separate sandbox bootstrap principal perform allocation/attach/renew; custodian allocation_read and executor_scoped principals remain narrow and cannot acquire lifecycle authority.
Optional Endpoint.native_tls provides exact-issuer authenticated HTTPS, trusted token-file custody, no ambient proxy, redirects, retries or plaintext, while honoring the configured request deadline.
Optional trusted atomic native_admission_file refreshes exact grants at request time without restarting either receiver, resetting generation, reattaching or losing processes/receipts. Missing/malformed/untrusted/expired snapshots fail closed with no cached/inline fallback. A coordinator renews the real lease first and publishes capped grants; native session cap refresh uses idle retained load, so turns remain bounded by the observed lease.
Isolated receivers require root plus CHOWN, DAC_OVERRIDE, FOWNER, KILL, SETGID, SETUID and SETPCAP in the calling thread's effective/permitted/bounding sets. Missing child-control capability is rejected before child execution. Existing UID/GID, child capability/session, helper refusal and trust custody boundaries remain in force.

Full contract and explicit Talos work: native-client-computer.md.

Validation and independent review

Final product/test/design revision 4c996e823ca79ec8b71b1c3907e51ae3e93a667c; evidence-only commits through 20178602c4da24c057ea2cb71183523201234d29 preserved all 30 recorded hashes. Current head e0ecfe99b46fbccc3c214547c6bf9726e5f17a18 adds only the round-6c CI workflow/test-runner correction and evidence below. The other 28 recorded source files, including Rust product code, Rust tests and custodian fixtures, retain their hashes.

50 selected local tests passed, zero failed, zero ignored on macOS arm64:

19 native admission/TLS/real lifecycle tests, including separate bootstrap transport, strict timeout, expired/mismatched tuples and atomic grant refresh with the original live child/receipt preserved.
2 native-computer integration tests, including child-only umask0000: deterministic model → real native Agent/tool loop → real ACP connection → retained actual custodian Computer code → fresh allocation/attach → real TLS listeners/routers/stores/child. Covers all five tools, rejected first admission, tuple substitution, foreign/operator refusal, missing capabilities, reconnect, renewal, exact running-child cancellation, expired grants/fencing, and the sole unbound session's original backend.
6 computer unit regressions plus 6 existing glob, 16 code generation and one concurrent session-scope regression.

Fresh-context independent full-diff review is CLEAN STATIC REVIEW at the final source revision after seven findings were corrected. Reviewer ran no builds/tests. Retained report, exact raw compressed logs/checksums, artifact hashes and earlier failing evidence: round-6a evidence.

Every build used jobs=2 and dedicated /Users/toasty/.cache/mausbot-round6a-target, debug0/incremental0, Data-volume preflight and a 20GiB floor watcher. No floor bypass or target cleanup. Feature-limited library compilation emitted existing unused/dead-code warnings; full feature/clippy/CI coverage is pending.

Round 6c: native client computer CI prerequisite correction

Run 4321 / job 2 failed at exact old head 20178602c4da24c057ea2cb71183523201234d29. Authoritative Solstice request 6967f100-88e5-42a5-8966-0a07c6122e53 shows successful compilation, then native_computer_fixture_survives_permissive_umask and its inner native_agent_custodian_exact_fresh_receiver fail because the guest installed Node 12.22.9. driver.mjs:20 top-level await throws SyntaxError: Unexpected reserved word. The root test was never reached. This is CI prerequisite wiring, with no observed product, permission or timing defect and no blind rerun.

The guest now installs official Node v22.23.3, pinned with separate x64/arm64 SHA256 checksums. Before Cargo, the runner checks both CI-user and sudo Node >=22, driver syntax, actual custodian-module import, top-level await and required APIs; successful CI receipts record both versions. Six local prerequisite/order/syntax checks pass; both Linux archives were streamed and their exact official SHA256 values verified without installation/execution. Other CI categories and test-selection/receipt requirements are unchanged.

Data remained below the 20 GiB floor (about 19.84 GiB), so round 6c performed no Rust compilation or fixture execution and deleted no targets. Real local Node preflight used v26.12.0; Node12/missing-runtime/failure-order cases use mocks. No new-head Linux pipeline pass is claimed. Product code and fixtures are unchanged, so no independent product-delta review was required. Exact raw compressed Solstice logs, readable views, source/artifact hashes, validation and classification: round-6c CI receipt.

WAITING-CI at e0ecfe99b46fbccc3c214547c6bf9726e5f17a18; parent watches and merges. Temporary read-only logs port-forward closed. No Talos edits, merge, live/production mutation or live cluster daemon/binary execution.

Required CI and post-merge acceptance

Exact final-head full CI, including existing receiver-isolation VM receipt (2 executed/0 ignored).
New test-native-client-computer VM receipt (2 executed/0 ignored): non-root permissive-umask regression and actual root native pipeline, with missing-KILL/reduced-worker denials and exact cancellation under the seven-capability receiver profile. Linux execution was not performed on this Mac.
Parent merges and obtains immutable merged-main images before any window.
Talos #200 round 7 must inject the trusted retained-session binding and compare every callback tuple in FullPolicy, provide separate persistent allocator/receiver profiles and stores, seven-capability root/child custody, ESO/OpenBao mounts and strict bootstrap TLS/readiness, and the single authorized lease/grant writer with atomic directory delivery and idle cap refresh. The retained Computer fixture proves the native callback path; it does not claim the current deployed FullPolicy already performs the new opt-in glue.
Owner/CoS reconciliation, real native tool → custodian audit → exact fresh receiver receipts, expiry/failure/custody checks and bounded rollback/recovery remain later armed-window gates.

No merge, production/live mutation, enrollment, grant/allocation installation, activation, Board action or live daemon probe was performed. All allocations/credentials/certificates/processes used here were disposable fixtures. Round 6b PID/discovery and incident reconciliation are untouched. Parent owns watching CI and merging.

Merged main `71ca31b7` records ACP computer capabilities but never dispatches the native agent's tools through them. This adds an explicit session-scoped ACP client-computer Backend: one retained session pins one fresh allocation tuple, its filesystem/exec tools use custodian callbacks, and failed admission, expiry, mismatch or transport ambiguity cannot select the configured Execd backend. ## Design - The authenticated **owning scoped principal** opts in through `session/load` metadata. Explicit intent is sticky even if initial admission fails. The full owner/allocation/session/workspace/sandbox/generation/executor/site/root tuple is immutable; only same-tuple lease extension is accepted. New connections must explicitly reattach. Capabilities alone do not enable dispatch; foreign principals and session operators cannot substitute another owner's computer. - The existing panic-safe turn overlay replaces the five primary filesystem/exec tools with one coherent Backend. Other sessions, Akhs and background work retain their configured backends. Host filesystem/process tools, CLI/WASM and secondary backends are refused in the bound scope unless actually routed through the ACP computer. Host-enabled code generation now truthfully declares its optional rustfmt process capability; the pure variant remains available. - Standard ACP read/write and terminal callbacks reach the custodian's exact Computer. Directory classification/listing/size use that same terminal, with no host metadata. Callback deadlines respect the remaining command and lease budget; cancellation stops the actual child. A sticky native fence complements the custodian's durable operation fence. Pre/post tool availability checks prevent glob/grep from reporting successful partial results after a lost binding. - Callbacks keep receiving credentials and allocation verification at the custodian. Exact-allocation adoption in ExecdBackend would need a second credential/transport/lifecycle policy and removal of its unconditional allocation/renewal behavior. The callback seam preserves the existing ownership split. ## Bootstrap, renewal and receiver custody - Existing privileged `session` issuer and separate `sandbox` bootstrap principal perform allocation/attach/renew; custodian `allocation_read` and `executor_scoped` principals remain narrow and cannot acquire lifecycle authority. - Optional `Endpoint.native_tls` provides exact-issuer authenticated HTTPS, trusted token-file custody, no ambient proxy, redirects, retries or plaintext, while honoring the configured request deadline. - Optional trusted atomic `native_admission_file` refreshes exact grants at request time without restarting either receiver, resetting generation, reattaching or losing processes/receipts. Missing/malformed/untrusted/expired snapshots fail closed with no cached/inline fallback. A coordinator renews the real lease first and publishes capped grants; native session cap refresh uses idle retained load, so turns remain bounded by the observed lease. - Isolated receivers require root plus CHOWN, DAC_OVERRIDE, FOWNER, KILL, SETGID, SETUID and SETPCAP in the **calling thread's** effective/permitted/bounding sets. Missing child-control capability is rejected before child execution. Existing UID/GID, child capability/session, helper refusal and trust custody boundaries remain in force. Full contract and explicit Talos work: [native-client-computer.md](docs/mausbot/native-client-computer.md). ## Validation and independent review Final product/test/design revision `4c996e823ca79ec8b71b1c3907e51ae3e93a667c`; evidence-only commits through `20178602c4da24c057ea2cb71183523201234d29` preserved all 30 recorded hashes. Current head `e0ecfe99b46fbccc3c214547c6bf9726e5f17a18` adds only the round-6c CI workflow/test-runner correction and evidence below. The other 28 recorded source files, including Rust product code, Rust tests and custodian fixtures, retain their hashes. **50 selected local tests passed, zero failed, zero ignored** on macOS arm64: - 19 native admission/TLS/real lifecycle tests, including separate bootstrap transport, strict timeout, expired/mismatched tuples and atomic grant refresh with the original live child/receipt preserved. - 2 native-computer integration tests, including child-only umask0000: deterministic model → real native Agent/tool loop → real ACP connection → retained actual custodian Computer code → fresh allocation/attach → real TLS listeners/routers/stores/child. Covers all five tools, rejected first admission, tuple substitution, foreign/operator refusal, missing capabilities, reconnect, renewal, exact running-child cancellation, expired grants/fencing, and the sole unbound session's original backend. - 6 computer unit regressions plus 6 existing glob, 16 code generation and one concurrent session-scope regression. Fresh-context independent full-diff review is **CLEAN STATIC REVIEW** at the final source revision after seven findings were corrected. Reviewer ran no builds/tests. Retained report, exact raw compressed logs/checksums, artifact hashes and earlier failing evidence: [round-6a evidence](docs/mausbot/evidence/native-computer-20261018-round6a/README.md). Every build used jobs=2 and dedicated `/Users/toasty/.cache/mausbot-round6a-target`, debug0/incremental0, Data-volume preflight and a 20GiB floor watcher. No floor bypass or target cleanup. Feature-limited library compilation emitted existing unused/dead-code warnings; full feature/clippy/CI coverage is pending. ## Round 6c: native client computer CI prerequisite correction Run **4321 / job 2** failed at exact old head `20178602c4da24c057ea2cb71183523201234d29`. Authoritative Solstice request `6967f100-88e5-42a5-8966-0a07c6122e53` shows successful compilation, then `native_computer_fixture_survives_permissive_umask` and its inner `native_agent_custodian_exact_fresh_receiver` fail because the guest installed Node **12.22.9**. `driver.mjs:20` top-level `await` throws **`SyntaxError: Unexpected reserved word`**. The root test was never reached. This is **CI prerequisite wiring**, with no observed product, permission or timing defect and no blind rerun. The guest now installs official Node **v22.23.3**, pinned with separate x64/arm64 SHA256 checksums. Before Cargo, the runner checks both CI-user and sudo Node >=22, driver syntax, actual custodian-module import, top-level await and required APIs; successful CI receipts record both versions. Six local prerequisite/order/syntax checks pass; both Linux archives were streamed and their exact official SHA256 values verified without installation/execution. Other CI categories and test-selection/receipt requirements are unchanged. Data remained below the **20 GiB** floor (about **19.84 GiB**), so round 6c performed **no Rust compilation or fixture execution** and deleted no targets. Real local Node preflight used **v26.12.0**; Node12/missing-runtime/failure-order cases use mocks. No new-head Linux pipeline pass is claimed. Product code and fixtures are unchanged, so no independent product-delta review was required. Exact raw compressed Solstice logs, readable views, source/artifact hashes, validation and classification: [round-6c CI receipt](docs/mausbot/evidence/native-computer-20261018-round6c-ci4321/README.md). **WAITING-CI** at `e0ecfe99b46fbccc3c214547c6bf9726e5f17a18`; parent watches and merges. Temporary read-only logs port-forward closed. No Talos edits, merge, live/production mutation or live cluster daemon/binary execution. ## Required CI and post-merge acceptance - Exact final-head full CI, including existing receiver-isolation VM receipt (2 executed/0 ignored). - New `test-native-client-computer` VM receipt (2 executed/0 ignored): non-root permissive-umask regression and actual root native pipeline, with missing-KILL/reduced-worker denials and exact cancellation under the seven-capability receiver profile. Linux execution was **not** performed on this Mac. - Parent merges and obtains immutable merged-main images before any window. - Talos #200 round 7 must inject the trusted retained-session binding and compare every callback tuple in FullPolicy, provide separate persistent allocator/receiver profiles and stores, seven-capability root/child custody, ESO/OpenBao mounts and strict bootstrap TLS/readiness, and the single authorized lease/grant writer with atomic directory delivery and idle cap refresh. The retained Computer fixture proves the native callback path; it does not claim the current deployed FullPolicy already performs the new opt-in glue. - Owner/CoS reconciliation, real native tool → custodian audit → exact fresh receiver receipts, expiry/failure/custody checks and bounded rollback/recovery remain later armed-window gates. No merge, production/live mutation, enrollment, grant/allocation installation, activation, Board action or live daemon probe was performed. All allocations/credentials/certificates/processes used here were disposable fixtures. Round 6b PID/discovery and incident reconciliation are untouched. Parent owns watching CI and merging.

toasterson added 9 commits

2026-10-18 00:36:18 +00:00