feat(fleet): enforce generated environment boundary (#772)

2026-07-15 08:40:32 +00:00
parent e9c4aa3e8b
commit 191efaefeb
18 changed files with 2282 additions and 785 deletions
--- a/packages/mosaic/framework/systemd/user/README.md
+++ b/packages/mosaic/framework/systemd/user/README.md
@@ -24,45 +24,56 @@ The agent template calls:

 which starts or reuses a tmux session on `MOSAIC_TMUX_SOCKET`.

-## Local customization
+## Generated environment and local data

-Per-agent overrides live outside the package in:
+The roster-derived projection is written outside the package at:

 ```text
-~/.config/mosaic/fleet/agents/<agent>.env
+~/.config/mosaic/fleet/agents/<agent>.env.generated
 ```

-Example:
+Systemd does not read either environment file. It starts the launcher with a fixed cleared bootstrap
+environment; before it creates, queries, or stops an exact agent tmux session, `start-agent-session.sh`
+strictly parses the generated projection and the optional local data file:

-```dotenv
-MOSAIC_TMUX_SOCKET=mosaic-fleet
-MOSAIC_AGENT_RUNTIME=claude
-MOSAIC_AGENT_WORKDIR=$HOME/src/your-project
-# Optional escape hatch for PoC/canary agents:
-# MOSAIC_AGENT_COMMAND=mosaic yolo claude
+```text
+~/.config/mosaic/fleet/agents/<agent>.env.local
 ```

+The local file may contain only safe machine-specific data (`MOSAIC_RUNTIME_BIN`, heartbeat paths or
+interval, and Claude configuration paths). It cannot override roster-derived keys, carry a command,
+or contain secret-like/unknown keys. Both files must be private regular files. Do not hand-edit the
+generated projection; update the roster and regenerate it instead. A legacy `<agent>.env` is
+consumed only for regeneration, strict relocation, or private quarantine and is never launch input.
+
+See `docs/fleet/reference/generated-env-boundary.md` for the full contract.
+
 ## Manual canary sequence

-```bash
-mkdir -p ~/.config/systemd/user ~/.config/mosaic/tools/fleet ~/.config/mosaic/fleet/agents
-cp packages/mosaic/framework/systemd/user/mosaic-*.service ~/.config/systemd/user/
-cp packages/mosaic/framework/tools/fleet/*.sh ~/.config/mosaic/tools/fleet/
-chmod +x ~/.config/mosaic/tools/fleet/*.sh
-systemctl --user daemon-reload
-systemctl --user start mosaic-tmux-holder.service
-systemctl --user start mosaic-agent@canary.service
-tmux -L mosaic-fleet ls
+Use the roster and the supported installer; do not pre-create the agent environment directory or
+edit a generated projection. `mosaic fleet install` validates the roster, installs the units and
+helpers, and writes private roster-derived projections before any service is started.

-# For an operator-interaction service, the roster/env identity selects the
-# generic unit instance; no service source is renamed for an instance.
+```bash
+# Create a site-owned canary roster. Inspect an existing roster before using --force.
+mosaic fleet init --profile minimal --write
+mosaic fleet install
+systemctl --user daemon-reload
+mosaic fleet start canary-pi
+tmux -L mosaic-fleet ls
+```
+
+For an operator-interaction service, first put `<agent-name>` in the roster with the pinned Pi
+runtime, model, reasoning, and `operator-interaction` tool policy. Re-run `mosaic fleet install` after
+that roster change so it writes `<agent-name>.env.generated`; ambient `MOSAIC_AGENT_*` values are not
+launch authority. The generic unit instance uses that generated identity, and no service source is
+renamed for an instance:
+
+```bash
+mosaic fleet install
+systemctl --user daemon-reload
 systemctl --user start mosaic-interaction-agent@<agent-name>.service
-MOSAIC_AGENT_NAME=<agent-name> \
-MOSAIC_AGENT_RUNTIME=pi \
-MOSAIC_AGENT_MODEL=openai/gpt-5.6-sol \
-MOSAIC_AGENT_REASONING=high \
-MOSAIC_AGENT_TOOL_POLICY=operator-interaction \
-  ~/.config/mosaic/tools/fleet/print-interaction-effective-policy.sh
+~/.config/mosaic/tools/fleet/print-interaction-effective-policy.sh <agent-name>
 ```

 Do not use `tmux kill-server` without `-L mosaic-fleet`; this pattern is meant
--- a/packages/mosaic/framework/systemd/user/mosaic-agent@.service
+++ b/packages/mosaic/framework/systemd/user/mosaic-agent@.service
@@ -7,16 +7,13 @@ PartOf=mosaic-tmux-holder.service

 [Service]
 Type=oneshot
+# Remove loader and noninteractive-shell controls before ExecStart loads env.
+UnsetEnvironment=LD_PRELOAD BASH_ENV ENV
 RemainAfterExit=yes
-# No default MOSAIC_TMUX_SOCKET: an absent roster socket means the literal
-# default tmux socket (no -L). The per-agent .env sets it when the roster names
-# one; otherwise it stays unset and start-agent-session.sh uses the default socket.
-Environment=MOSAIC_AGENT_NAME=%i
-Environment=MOSAIC_AGENT_RUNTIME=pi
-Environment=MOSAIC_AGENT_WORKDIR=%h
-EnvironmentFile=-%h/.config/mosaic/fleet/agents/%i.env
-ExecStart=/bin/bash %h/.config/mosaic/tools/fleet/start-agent-session.sh %i
-ExecStop=-/bin/bash -lc 'if [ -n "${MOSAIC_TMUX_SOCKET:-}" ]; then tmux -L "$MOSAIC_TMUX_SOCKET" kill-session -t "=%i"; else tmux kill-session -t "=%i"; fi'
+# Never preload the projection. The launcher starts from a fixed minimal
+# environment and strictly validates generated/local data before tmux effects.
+ExecStart=/usr/bin/env -i HOME=%h MOSAIC_AGENT_NAME=%i PATH=/usr/bin:/bin /bin/bash --noprofile --norc %h/.config/mosaic/tools/fleet/start-agent-session.sh %i
+ExecStop=-/usr/bin/env -i HOME=%h MOSAIC_AGENT_NAME=%i PATH=/usr/bin:/bin /bin/bash --noprofile --norc %h/.config/mosaic/tools/fleet/start-agent-session.sh --stop %i

 [Install]
 WantedBy=default.target
--- a/packages/mosaic/framework/systemd/user/mosaic-interaction-agent@.service
+++ b/packages/mosaic/framework/systemd/user/mosaic-interaction-agent@.service
@@ -7,11 +7,13 @@ PartOf=mosaic-tmux-holder.service

 [Service]
 Type=oneshot
+# Remove loader and noninteractive-shell controls before ExecStart loads env.
+UnsetEnvironment=LD_PRELOAD BASH_ENV ENV
 RemainAfterExit=yes
-Environment=MOSAIC_AGENT_NAME=%i
-EnvironmentFile=%h/.config/mosaic/fleet/agents/%i.env
-ExecStart=/bin/bash %h/.config/mosaic/tools/fleet/start-interaction-service.sh %i
-ExecStop=-/bin/bash -lc 'if [ -n "${MOSAIC_TMUX_SOCKET:-}" ]; then tmux -L "$MOSAIC_TMUX_SOCKET" kill-session -t "=%i"; else tmux kill-session -t "=%i"; fi'
+# The interaction wrapper delegates to the shared strict parser before pinned
+# profile checks; no projection data reaches Bash through systemd.
+ExecStart=/usr/bin/env -i HOME=%h MOSAIC_AGENT_NAME=%i PATH=/usr/bin:/bin /bin/bash --noprofile --norc %h/.config/mosaic/tools/fleet/start-interaction-service.sh %i
+ExecStop=-/usr/bin/env -i HOME=%h MOSAIC_AGENT_NAME=%i PATH=/usr/bin:/bin /bin/bash --noprofile --norc %h/.config/mosaic/tools/fleet/start-agent-session.sh --stop %i

 [Install]
 WantedBy=default.target
--- a/packages/mosaic/framework/systemd/user/mosaic-tmux-holder.service
+++ b/packages/mosaic/framework/systemd/user/mosaic-tmux-holder.service
@@ -6,10 +6,11 @@ After=default.target
 [Service]
 Type=oneshot
 RemainAfterExit=yes
-Environment=MOSAIC_TMUX_SOCKET=mosaic-fleet
-Environment=MOSAIC_TMUX_HOLDER=_holder
-ExecStart=/bin/bash -lc 'tmux -L "$MOSAIC_TMUX_SOCKET" has-session -t "=${MOSAIC_TMUX_HOLDER}:0.0" 2>/dev/null || tmux -L "$MOSAIC_TMUX_SOCKET" new-session -d -s "$MOSAIC_TMUX_HOLDER" "while true; do sleep 3600; done"'
-ExecStop=-/bin/bash -lc 'tmux -L "$MOSAIC_TMUX_SOCKET" kill-server'
+# The holder owns the tmux server, so clear loader, shell-control, and stale
+# manager/session variables before the server process starts.
+UnsetEnvironment=LD_PRELOAD BASH_ENV ENV
+ExecStart=/usr/bin/env -i HOME=%h PATH=/usr/bin:/bin MOSAIC_TMUX_SOCKET=mosaic-fleet MOSAIC_TMUX_HOLDER=_holder /bin/bash --noprofile --norc %h/.config/mosaic/tools/fleet/start-tmux-holder.sh
+ExecStop=-/usr/bin/env -i HOME=%h PATH=/usr/bin:/bin MOSAIC_TMUX_SOCKET=mosaic-fleet /bin/bash --noprofile --norc -c 'tmux -L "$MOSAIC_TMUX_SOCKET" kill-server'

 [Install]
 WantedBy=default.target
--- a/packages/mosaic/framework/systemd/user/test-fleet-units.sh
+++ b/packages/mosaic/framework/systemd/user/test-fleet-units.sh
@@ -5,6 +5,8 @@ SCRIPT_DIR=$(cd -- "$(dirname -- "$0")" && pwd)
 HOLDER="$SCRIPT_DIR/mosaic-tmux-holder.service"
 AGENT="$SCRIPT_DIR/mosaic-agent@.service"
 INTERACTION="$SCRIPT_DIR/mosaic-interaction-agent@.service"
+HOLDER_START="$SCRIPT_DIR/../../tools/fleet/start-tmux-holder.sh"
+START_AGENT="$SCRIPT_DIR/../../tools/fleet/start-agent-session.sh"

 fail() {
  echo "FAIL: $*" >&2
@@ -14,16 +16,40 @@ fail() {
 [ -f "$HOLDER" ] || fail "missing mosaic-tmux-holder.service"
 [ -f "$AGENT" ] || fail "missing mosaic-agent@.service"
 [ -f "$INTERACTION" ] || fail "missing mosaic-interaction-agent@.service"
+[ -x "$HOLDER_START" ] || fail "missing executable start-tmux-holder.sh"
+[ -x "$START_AGENT" ] || fail "missing executable start-agent-session.sh"

 grep -qF 'ExecStart=' "$HOLDER" || fail "holder has no ExecStart"
 grep -qF 'tmux -L' "$HOLDER" || fail "holder does not use named tmux socket"
 grep -qF '_holder' "$HOLDER" || fail "holder session is not explicit"
+grep -qF 'UnsetEnvironment=LD_PRELOAD BASH_ENV ENV' "$HOLDER" || \
+  fail "holder does not remove loader and shell-control variables"
+grep -qF 'ExecStart=/usr/bin/env -i HOME=%h PATH=/usr/bin:/bin MOSAIC_TMUX_SOCKET=mosaic-fleet MOSAIC_TMUX_HOLDER=_holder /bin/bash --noprofile --norc %h/.config/mosaic/tools/fleet/start-tmux-holder.sh' "$HOLDER" || \
+  fail "holder does not clear manager environment before starting tmux"
+grep -qF 'ExecStop=-/usr/bin/env -i HOME=%h PATH=/usr/bin:/bin MOSAIC_TMUX_SOCKET=mosaic-fleet /bin/bash --noprofile --norc -c' "$HOLDER" || \
+  fail "holder stop does not clear manager environment"
+if grep -qF -- '/bin/bash -lc' "$HOLDER"; then
+  fail "holder must not start tmux through a login shell"
+fi
 grep -qF 'Requires=mosaic-tmux-holder.service' "$AGENT" || fail "agent does not require holder"
 grep -qF 'start-agent-session.sh' "$AGENT" || fail "agent unit does not call start-agent-session.sh"
-grep -qF 'kill-session -t "=%i"' "$AGENT" || fail "agent stop does not exact-match its session"
+if grep -qE '^Environment(File)?=' "$AGENT" "$INTERACTION"; then
+  fail "agent units must not accept ambient or projection environment before strict parsing"
+fi
+grep -qF 'UnsetEnvironment=LD_PRELOAD BASH_ENV ENV' "$AGENT" || \
+  fail "agent unit does not remove loader and shell-control variables"
+grep -qF 'UnsetEnvironment=LD_PRELOAD BASH_ENV ENV' "$INTERACTION" || \
+  fail "interaction unit does not remove loader and shell-control variables"
+grep -qF 'ExecStart=/usr/bin/env -i HOME=%h MOSAIC_AGENT_NAME=%i PATH=/usr/bin:/bin /bin/bash --noprofile --norc' "$AGENT" || \
+  fail "agent unit does not clear bootstrap environment before strict parsing"
+grep -qF 'start-agent-session.sh --stop %i' "$AGENT" || \
+  fail "agent stop does not use the validated exact-stop path"
 grep -qF 'Requires=mosaic-tmux-holder.service' "$INTERACTION" || fail "interaction service does not require holder"
-grep -qF 'EnvironmentFile=%h/.config/mosaic/fleet/agents/%i.env' "$INTERACTION" || fail "interaction service does not require per-agent config"
-grep -qF 'start-interaction-service.sh %i' "$INTERACTION" || fail "interaction service does not validate before startup"
+grep -qF 'ExecStart=/usr/bin/env -i HOME=%h MOSAIC_AGENT_NAME=%i PATH=/usr/bin:/bin /bin/bash --noprofile --norc' "$INTERACTION" || \
+  fail "interaction unit does not clear bootstrap environment before strict parsing"
+grep -qF 'start-interaction-service.sh %i' "$INTERACTION" || fail "interaction service does not use shared strict parsing"
+grep -qF 'start-agent-session.sh --stop %i' "$INTERACTION" || \
+  fail "interaction stop does not use the validated exact-stop path"

 if command -v systemd-analyze >/dev/null 2>&1; then
  systemd-analyze verify --user "$HOLDER" "$AGENT" "$INTERACTION" >/tmp/mosaic-fleet-systemd-verify.log 2>&1 || {
@@ -32,4 +58,102 @@ if command -v systemd-analyze >/dev/null 2>&1; then
  }
 fi

+# Real isolated socket regression: a preexisting server with an LD_PRELOAD
+# constructor marker must fail closed, while a fresh named server is created.
+if command -v tmux >/dev/null 2>&1 && command -v cc >/dev/null 2>&1; then
+  TEST_ROOT=$(mktemp -d)
+  TEST_SOCKET="mosaic-holder-test-$$"
+  trap 'tmux -L "$TEST_SOCKET" kill-server >/dev/null 2>&1 || true; rm -rf "$TEST_ROOT"' EXIT
+  MARKER="$TEST_ROOT/loader-marker"
+  LIBRARY="$TEST_ROOT/marker.so"
+  HOLDER_HOME="$TEST_ROOT/holder-home"
+  mkdir -p "$HOLDER_HOME/.config/mosaic/fleet/run"
+  chmod 700 "$HOLDER_HOME/.config" "$HOLDER_HOME/.config/mosaic" \
+    "$HOLDER_HOME/.config/mosaic/fleet" "$HOLDER_HOME/.config/mosaic/fleet/run"
+  printf '123e4567-e89b-12d3-a456-426614174000\n' > \
+    "$HOLDER_HOME/.config/mosaic/fleet/run/holder-owner"
+  chmod 600 "$HOLDER_HOME/.config/mosaic/fleet/run/holder-owner"
+  cat > "$TEST_ROOT/marker.c" <<'EOF'
+#include <fcntl.h>
+#include <stdlib.h>
+#include <unistd.h>
+__attribute__((constructor)) static void mark_loader(void) {
+  const char *path = getenv("MOSAIC_LOADER_MARKER");
+  if (path != NULL) {
+    int fd = open(path, O_WRONLY | O_CREAT | O_APPEND, 0600);
+    if (fd >= 0) { write(fd, "loaded\\n", 7); close(fd); }
+  }
+}
+EOF
+  cc -shared -fPIC -o "$LIBRARY" "$TEST_ROOT/marker.c"
+  MOSAIC_LOADER_MARKER="$MARKER" LD_PRELOAD="$LIBRARY" \
+    tmux -L "$TEST_SOCKET" new-session -d -s _holder 'sleep 60'
+  [ -s "$MARKER" ] || fail "contaminated fixture did not execute loader constructor"
+  server_pid=$(tmux -L "$TEST_SOCKET" display-message -p '#{pid}')
+  : > "$MARKER"
+  if /usr/bin/env -i HOME="$HOLDER_HOME" PATH=/usr/bin:/bin \
+    MOSAIC_TMUX_SOCKET="$TEST_SOCKET" MOSAIC_TMUX_HOLDER=_holder "$HOLDER_START" \
+    >"$TEST_ROOT/holder.out" 2>&1; then
+    fail "holder adopted contaminated named server"
+  fi
+  grep -qF 'global environment does not match the owned-server contract' "$TEST_ROOT/holder.out" || \
+    fail "holder did not report contaminated server environment"
+  [ "$(tmux -L "$TEST_SOCKET" display-message -p '#{pid}')" = "$server_pid" ] || \
+    fail "holder replaced a contaminated server instead of failing closed"
+  [ ! -s "$MARKER" ] || fail "holder execution triggered a contaminated loader"
+
+  # Agent validation must reject the same unmanaged server without cleaning its
+  # global environment or adding a managed session.
+  AGENT_HOME="$HOLDER_HOME/.config/mosaic"
+  AGENT_NAME=loader-safe
+  AGENT_WORKDIR="$AGENT_HOME/work"
+  AGENT_BIN="$TEST_ROOT/agent-bin"
+  mkdir -p "$AGENT_HOME/fleet/agents" "$AGENT_WORKDIR" "$AGENT_BIN"
+  chmod 700 "$AGENT_HOME/fleet/agents"
+  cat > "$AGENT_HOME/fleet/agents/$AGENT_NAME.env.generated" <<EOF
+MOSAIC_AGENT_NAME=$AGENT_NAME
+MOSAIC_AGENT_CLASS=code
+MOSAIC_AGENT_RUNTIME=pi
+MOSAIC_AGENT_MODEL=
+MOSAIC_AGENT_REASONING=
+MOSAIC_AGENT_TOOL_POLICY=code
+MOSAIC_AGENT_WORKDIR=$AGENT_WORKDIR
+MOSAIC_TMUX_SOCKET=$TEST_SOCKET
+EOF
+  printf 'MOSAIC_RUNTIME_BIN=%s\n' "$AGENT_BIN" > "$AGENT_HOME/fleet/agents/$AGENT_NAME.env.local"
+  chmod 600 "$AGENT_HOME/fleet/agents/$AGENT_NAME.env.generated" \
+    "$AGENT_HOME/fleet/agents/$AGENT_NAME.env.local"
+  cat > "$AGENT_BIN/mosaic" <<'EOF'
+#!/bin/sh
+sleep 30
+EOF
+  chmod 700 "$AGENT_BIN/mosaic"
+  server_environment_before=$(tmux -L "$TEST_SOCKET" show-environment -g | sort)
+  server_sessions_before=$(tmux -L "$TEST_SOCKET" list-sessions | sort)
+  if /usr/bin/env -i HOME="$HOLDER_HOME" PATH=/usr/bin:/bin MOSAIC_HOME="$AGENT_HOME" \
+    "$START_AGENT" "$AGENT_NAME" >"$TEST_ROOT/agent.out" 2>&1; then
+    fail "agent launcher adopted contaminated named server"
+  fi
+  [ "$(tmux -L "$TEST_SOCKET" display-message -p '#{pid}')" = "$server_pid" ] || \
+    fail "agent launcher changed unmanaged server PID"
+  [ "$(tmux -L "$TEST_SOCKET" show-environment -g | sort)" = "$server_environment_before" ] || \
+    fail "agent launcher changed unmanaged global environment"
+  [ "$(tmux -L "$TEST_SOCKET" list-sessions | sort)" = "$server_sessions_before" ] || \
+    fail "agent launcher changed unmanaged sessions"
+  tmux -L "$TEST_SOCKET" kill-server
+  /usr/bin/env -i HOME="$HOLDER_HOME" PATH=/usr/bin:/bin \
+    MOSAIC_TMUX_SOCKET="$TEST_SOCKET" MOSAIC_TMUX_HOLDER=_holder "$HOLDER_START"
+  tmux -L "$TEST_SOCKET" has-session -t '=_holder:0.0' || fail "fresh holder was not created"
+  if tmux -L "$TEST_SOCKET" show-environment -g LD_PRELOAD 2>/dev/null | grep -q '^LD_PRELOAD='; then
+    fail "fresh holder retained LD_PRELOAD"
+  fi
+  /usr/bin/env -i HOME="$HOLDER_HOME" PATH=/usr/bin:/bin MOSAIC_HOME="$AGENT_HOME" \
+    "$START_AGENT" "$AGENT_NAME"
+  tmux -L "$TEST_SOCKET" has-session -t "=$AGENT_NAME:0.0" || \
+    fail "agent did not launch on a valid owned server"
+  tmux -L "$TEST_SOCKET" kill-server
+  trap - EXIT
+  rm -rf "$TEST_ROOT"
+fi
+
 echo "ok - fleet systemd unit templates"