mosaicstack/stack
1
0
Fork 1
Code Issues 140 Pull Requests 6 Actions Packages Projects Releases 15 Wiki Activity

RM-60: external trust boundary for isolated per-commit replay #1031

New Issue
Open
opened 2026-08-01 03:05:45 +00:00 by f10-coder · 0 comments
f10-coder commented 2026-08-01 03:05:45 +00:00
Collaborator
Copy Link
Copy Source

Objective

Provide an external trust boundary for RM-02 isolated per-commit gate replay before any pull-request-controlled executable or configuration is evaluated.

Security requirement

Repository-controlled code cannot safely grant itself namespace capability and then claim that capability contains it. A privileged pull-request step is permanently forbidden: PR-controlled package.json, verifier code, and pipeline configuration execute before an in-repository Bubblewrap call and could consume or rewrite the constraint.

Acceptable authority patterns

Choose and implement one outside the audited PR tree:

  1. runner-level unprivileged/rootless user namespaces that permit Bubblewrap without granting the PR elevated capability; or
  2. provider-side protected default-branch pipeline configuration / immutable trusted launcher that enters the sandbox before reading or executing PR-controlled code.

Acceptance criteria

  • Pull-request code never executes with host/container privilege or namespace-creation capability outside the established sandbox.
  • The immutable authority enters a network/PID/IPC/UTS/user-isolated environment, uses a cleared allowlisted environment and isolated home, drops all capabilities, and exposes only read-only system/pnpm inputs plus the bounded writable replay tree.
  • Each prospective commit is evaluated from its own archived tree and lockfile; authoritative archived files cannot be rewritten by install lifecycle scripts.
  • A malicious PR that changes pipeline config, package.json, or verifier code cannot bypass the launcher or execute before containment.
  • Failure to establish containment is terminal nonzero.
  • Protected post-merge detection documents quarantine/revert response and is not represented as pre-merge prevention.

Provenance

Discovered by RM-02 PR #1030 pipelines #2177/#2178 and Codex critical review. Cross-reference RM-59: both require the anchor to live outside the audited party's authority.

## Objective Provide an external trust boundary for RM-02 isolated per-commit gate replay before any pull-request-controlled executable or configuration is evaluated. ## Security requirement Repository-controlled code cannot safely grant itself namespace capability and then claim that capability contains it. A privileged pull-request step is permanently forbidden: PR-controlled `package.json`, verifier code, and pipeline configuration execute before an in-repository Bubblewrap call and could consume or rewrite the constraint. ## Acceptable authority patterns Choose and implement one outside the audited PR tree: 1. runner-level unprivileged/rootless user namespaces that permit Bubblewrap without granting the PR elevated capability; or 2. provider-side protected default-branch pipeline configuration / immutable trusted launcher that enters the sandbox before reading or executing PR-controlled code. ## Acceptance criteria - Pull-request code never executes with host/container privilege or namespace-creation capability outside the established sandbox. - The immutable authority enters a network/PID/IPC/UTS/user-isolated environment, uses a cleared allowlisted environment and isolated home, drops all capabilities, and exposes only read-only system/pnpm inputs plus the bounded writable replay tree. - Each prospective commit is evaluated from its own archived tree and lockfile; authoritative archived files cannot be rewritten by install lifecycle scripts. - A malicious PR that changes pipeline config, `package.json`, or verifier code cannot bypass the launcher or execute before containment. - Failure to establish containment is terminal nonzero. - Protected post-merge detection documents quarantine/revert response and is not represented as pre-merge prevention. ## Provenance Discovered by RM-02 PR #1030 pipelines #2177/#2178 and Codex critical review. Cross-reference RM-59: both require the anchor to live outside the audited party's authority.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
coder-mos1 coder-mos2 f10-coder jason.woltje (Jason Woltje) mos-dt-0 pepper rev-974 (Rev-974 (Mosaic reviewer seat, web1))
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1031