security: constrain dogfood delivery execution (#1487)

scripts/verify-dogfood-compose.sh

@@ -5,7 +5,7 @@ set -euo pipefail
 repo_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
 tmp=$(mktemp -d)
 trap 'rm -rf "$tmp"' EXIT
-mkdir -p "$tmp/worktree" "$tmp/seat/secrets"
+mkdir -p "$tmp/worktree" "$tmp/common.git" "$tmp/seat/secrets"
 
 base_config_json=$(
   cd "$repo_root"
@@ -26,6 +26,10 @@ for key in (
     "MOSAIC_BRAIN_HOME",
     "AGENT_FILE_SANDBOX_DIR",
     "AGENT_USER_TOOLS",
+    "AGENT_SHELL_ENABLED",
+    "AGENT_DELIVERY_ENABLED",
+    "MOSAIC_GIT_TOOLS_DIR",
+    "MOSAIC_INTEGRATION_TRUNK",
 ):
     assert key not in env, f"base compose unexpectedly sets dogfood variable {key}"
 
@@ -38,6 +42,7 @@ config_json=$(
   cd "$repo_root"
   BETTER_AUTH_SECRET=test-only-not-a-credential \
   MOSAIC_DOGFOOD_WORKTREE="$tmp/worktree" \
+  MOSAIC_DOGFOOD_COMMON_GIT_DIR="$tmp/common.git" \
   MOSAIC_DOGFOOD_SEAT_HOME="$tmp/seat" \
     docker compose \
       -f docker-compose.yml \
@@ -46,7 +51,7 @@ config_json=$(
       config --format json
 )
 
-CONFIG_JSON="$config_json" EXPECT_WORKTREE="$tmp/worktree" EXPECT_SEAT="$tmp/seat" python3 <<'PY'
+CONFIG_JSON="$config_json" EXPECT_WORKTREE="$tmp/worktree" EXPECT_COMMON_GIT="$tmp/common.git" EXPECT_SEAT="$tmp/seat" python3 <<'PY'
 import json
 import os
 
@@ -59,6 +64,10 @@ expected_env = {
     "MOSAIC_GIT_IDENTITY": "stack-dogfood",
     "MOSAIC_BRAIN_HOME": "/opt/mosaic/brain",
     "AGENT_FILE_SANDBOX_DIR": "/workspace/stack",
+    "AGENT_SHELL_ENABLED": "false",
+    "AGENT_DELIVERY_ENABLED": "true",
+    "MOSAIC_GIT_TOOLS_DIR": "/opt/mosaic/tools/git",
+    "MOSAIC_INTEGRATION_TRUNK": "next",
 }
 for key, value in expected_env.items():
     assert env.get(key) == value, f"{key}: expected {value!r}, got {env.get(key)!r}"
@@ -72,8 +81,10 @@ assert allowed == {
     "git_status",
     "git_log",
     "git_diff",
-    "shell_exec",
+    "git_publish_branch",
+    "git_open_pull_request",
 }, f"unexpected dogfood tool set: {sorted(allowed)}"
+assert "shell_exec" not in allowed
 
 mounts = {mount["target"]: mount for mount in gateway["volumes"]}
 worktree = mounts["/workspace/stack"]
@@ -81,6 +92,11 @@ assert worktree["type"] == "bind"
 assert worktree["source"] == os.environ["EXPECT_WORKTREE"]
 assert not worktree.get("read_only", False), "dogfood worktree must be writable"
 
+common_git = mounts[os.environ["EXPECT_COMMON_GIT"]]
+assert common_git["type"] == "bind"
+assert common_git["source"] == os.environ["EXPECT_COMMON_GIT"]
+assert not common_git.get("read_only", False), "common Git directory must accept branch updates"
+
 seat = mounts["/opt/mosaic/brain/fleet/agents/stack-dogfood"]
 assert seat["type"] == "bind"
 assert seat["source"] == os.environ["EXPECT_SEAT"]
@@ -105,6 +121,19 @@ expect_missing_path() {
         cd "$repo_root"
         env -u MOSAIC_DOGFOOD_WORKTREE \
           BETTER_AUTH_SECRET=test-only-not-a-credential \
+          MOSAIC_DOGFOOD_COMMON_GIT_DIR="$tmp/common.git" \
+          MOSAIC_DOGFOOD_SEAT_HOME="$tmp/seat" \
+          docker compose -f docker-compose.yml -f docker-compose.dogfood.yml \
+            --profile stack config 2>&1
+      )
+      rc=$?
+      ;;
+    MOSAIC_DOGFOOD_COMMON_GIT_DIR)
+      output=$(
+        cd "$repo_root"
+        env -u MOSAIC_DOGFOOD_COMMON_GIT_DIR \
+          BETTER_AUTH_SECRET=test-only-not-a-credential \
+          MOSAIC_DOGFOOD_WORKTREE="$tmp/worktree" \
           MOSAIC_DOGFOOD_SEAT_HOME="$tmp/seat" \
           docker compose -f docker-compose.yml -f docker-compose.dogfood.yml \
             --profile stack config 2>&1
@@ -117,6 +146,7 @@ expect_missing_path() {
         env -u MOSAIC_DOGFOOD_SEAT_HOME \
           BETTER_AUTH_SECRET=test-only-not-a-credential \
           MOSAIC_DOGFOOD_WORKTREE="$tmp/worktree" \
+          MOSAIC_DOGFOOD_COMMON_GIT_DIR="$tmp/common.git" \
           docker compose -f docker-compose.yml -f docker-compose.dogfood.yml \
             --profile stack config 2>&1
       )
@@ -139,6 +169,7 @@ expect_missing_path() {
 }
 
 expect_missing_path MOSAIC_DOGFOOD_WORKTREE
+expect_missing_path MOSAIC_DOGFOOD_COMMON_GIT_DIR
 expect_missing_path MOSAIC_DOGFOOD_SEAT_HOME
 
 printf 'dogfood compose verification passed\n'