compose: add wrapper-first dogfood workspace #1488

2026-08-30T21:09:05Z

marcie commented

2026-08-30 21:09:05 +00:00

Scope

bundle the existing Mosaic git wrappers and their runtime dependencies in the gateway image
configure git-credential-mosaic as the image's system credential helper
add an explicit dogfood Compose overlay that mounts one writable stack worktree and one read-only stack-dogfood seat home
restrict regular-user agent tools to file, read-only git inspection, and sandboxed shell tools
document the standalone and dogfood startup paths
add a hermetic Compose configuration check, including fail-closed missing-path cases and proof that base Compose stays credential-free

Base: e18d13d3
Head: 9b859787

Verification

scripts/verify-dogfood-compose.sh passed
pnpm preflight passed
pnpm typecheck passed, 45 tasks
pnpm lint passed, 25 tasks
pnpm format:check passed
docker build -f docker/gateway.Dockerfile -t mosaic-gateway:b2a-test . passed, including 16 workspace builds
runtime image probe passed for pr-create.sh, git-credential-mosaic, declaration validator, curl, Python, and jq
missing stack-dogfood credential probe returned exit 1, emitted no credential output, and reported REFUSED (fail-closed)
isolated live Compose project reached healthy gateway state with the dogfood identity, sandbox, worktree mount, seat mount, and wrapper path verified inside the container; cleanup left zero containers and volumes

Sequencing

This PR implements B2a only. B2b credential provisioning remains gated on the P0-SEC R3/R4 close verdict. B2c uses the resulting identity to have the in-stack agent open the next PR through pr-create.sh.

Part of #1487.

## Scope - bundle the existing Mosaic git wrappers and their runtime dependencies in the gateway image - configure `git-credential-mosaic` as the image's system credential helper - add an explicit dogfood Compose overlay that mounts one writable stack worktree and one read-only `stack-dogfood` seat home - restrict regular-user agent tools to file, read-only git inspection, and sandboxed shell tools - document the standalone and dogfood startup paths - add a hermetic Compose configuration check, including fail-closed missing-path cases and proof that base Compose stays credential-free Base: `e18d13d3` Head: `9b859787` ## Verification - `scripts/verify-dogfood-compose.sh` passed - `pnpm preflight` passed - `pnpm typecheck` passed, 45 tasks - `pnpm lint` passed, 25 tasks - `pnpm format:check` passed - `docker build -f docker/gateway.Dockerfile -t mosaic-gateway:b2a-test .` passed, including 16 workspace builds - runtime image probe passed for `pr-create.sh`, `git-credential-mosaic`, declaration validator, curl, Python, and jq - missing `stack-dogfood` credential probe returned exit 1, emitted no credential output, and reported `REFUSED (fail-closed)` - isolated live Compose project reached healthy gateway state with the dogfood identity, sandbox, worktree mount, seat mount, and wrapper path verified inside the container; cleanup left zero containers and volumes ## Sequencing This PR implements B2a only. B2b credential provisioning remains gated on the P0-SEC R3/R4 close verdict. B2c uses the resulting identity to have the in-stack agent open the next PR through `pr-create.sh`. Part of #1487.

rev-code-01 approved these changes 2026-08-30 21:12:02 +00:00

Dismissed

rev-code-01 left a comment

Review PASS (rev-code-01, B2aR; wrapper/credential lens). Wrapper reuse verified: verbatim COPY of the framework tools tree, git config --system at the same path, ZERO new wrapper logic in the delta. Compose override explicit+minimal (22 lines, fixed stack-dogfood identity, both paths :? fail-fast, worktree writable, seat home read-only at exactly one slot, base stays credential-free). Verifier executed by reviewer rc 0 — genuinely good structural test incl. fail-closed missing-path arms. SHOULD-FIX F1: the 'same fail-closed helper as fleet seats' claim is overbroad — bundled copy is pre-R3 (no P5-RM-006 ownership gate, no R1-R4 hardening; measured). Bounded today by the single-seat read-only mount (nothing else resolvable in-container), but correct the wording or land the framework sync first. F2 routed: brain->stack sync carrying R1-R4 into the bundle should precede real dogfood wrapper use. Evidence: fleet/agents/rev-code-01/work/B2aR-REVIEW.md on brain main.

marcie added 1 commit 2026-08-30 21:31:08 +00:00

compose: add wrapper-first dogfood workspace (#1487 )

ci/woodpecker/pr/ci Pipeline was successful

Details

8356e72c1c

marcie force-pushed feat/1487-dogfood-agent-workspace from 9b85978793 to 8356e72c1c

2026-08-30 21:31:08 +00:00

Compare

marcie dismissed rev-code-01's review 2026-08-30 21:31:09 +00:00

Reason:

New commits pushed, approval review dismissed automatically according to repository settings

marcie added 4 commits 2026-08-30 22:02:35 +00:00

security: constrain dogfood delivery execution (#1487 ) f194ccb8a3

framework: port R4 credential-helper pair from brain 15f6979a (python entrypoint w/ alpine bash-path candidates + impl, byte-faithful; P0-SEC T125) a47f7aec10

(cherry picked from commit 13e7398c2a)

framework: port the credential-helper regression suite (byte-faithful from brain 15f6979a; verified green from the stack tree) ce51029ecf

(cherry picked from commit 62b163a254)

fix: preserve credential lineage in dogfood container (#1487 )

ci/woodpecker/pr/ci Pipeline failed

Details

581223e382

rev-code-01 approved these changes 2026-08-30 22:03:26 +00:00

Dismissed

rev-code-01 left a comment

T125 integration verdict PASS at 581223e3 (rev-code-01; supersedes 392 for this lineage continuation). Armed checks all executed: (1) pair integrated UNCHANGED — all three files sha256-identical to baselines brain 15f6979a / stack 62b163a2; (2) init:true on the gateway service with the does-not-trust-PID-1 rationale comment; (3) verifier mechanically asserts services.gateway.init is True naming the R4 lineage reason — the runtime precondition cannot be silently removed; (4) README rationale present (overlay enables Docker init so the R4 helper establishes seat lineage below PID 1); (5) verifier executed by reviewer rc 0 at the head. Ruling (a) on record: deployment-side init:true is correct — pid-1 exclusion is load-bearing against unshare --pid --fork lineage spoofing. CI 3049 fresh/running at the pin; terminal-green is the merge gate. Evidence: fleet/agents/rev-code-01/work/T125R-REVIEW.md on brain main.

T125 integration verdict PASS at 581223e3 (rev-code-01; supersedes 392 for this lineage continuation). Armed checks all executed: (1) pair integrated UNCHANGED — all three files sha256-identical to baselines brain 15f6979a / stack 62b163a2; (2) init:true on the gateway service with the does-not-trust-PID-1 rationale comment; (3) verifier mechanically asserts services.gateway.init is True naming the R4 lineage reason — the runtime precondition cannot be silently removed; (4) README rationale present (overlay enables Docker init so the R4 helper establishes seat lineage below PID 1); (5) verifier executed by reviewer rc 0 at the head. Ruling (a) on record: deployment-side init:true is correct — pid-1 exclusion is load-bearing against unshare --pid --fork lineage spoofing. CI 3049 fresh/running at the pin; terminal-green is the merge gate. Evidence: fleet/agents/rev-code-01/work/T125R-REVIEW.md on brain main.

marcie added 1 commit 2026-08-30 22:11:15 +00:00

test: sanitize credential-helper fixture comment (#1487 )

ci/woodpecker/pr/ci Pipeline was successful

Details

5827e2c9e9

marcie dismissed rev-code-01's review 2026-08-30 22:11:16 +00:00

Reason:

New commits pushed, approval review dismissed automatically according to repository settings

rev-code-01 approved these changes 2026-08-30 22:12:05 +00:00

rev-code-01 left a comment

T125 re-pin verdict PASS at 5827e2c9 (rev-code-01; supersedes 393 at 581223e3). Delta verified = exactly one sanitized comment line in the regression suite (line 467 genericized; named-account reference removed); helper pair sha256-identical to baselines; suite differs from baseline by that one line only. All 5 armed checks re-run green at the new head: init:true present, verifier asserts services.gateway.init is True, README rationale present, verifier rc 0 AND credential regression suite rc 0 on my runs. CI 3050 fresh/running at the pin — merge on terminal-green + guard.

T125 re-pin verdict PASS at 5827e2c9 (rev-code-01; supersedes 393 at 581223e3). Delta verified = exactly one sanitized comment line in the regression suite (line 467 genericized; named-account reference removed); helper pair sha256-identical to baselines; suite differs from baseline by that one line only. All 5 armed checks re-run green at the new head: init:true present, verifier asserts services.gateway.init is True, README rationale present, verifier rc 0 AND credential regression suite rc 0 on my runs. CI 3050 fresh/running at the pin — merge on terminal-green + guard.

orch-01 merged commit 736b0affc1 into next

2026-08-30 22:29:31 +00:00

orch-01 deleted branch feat/1487-dogfood-agent-workspace

2026-08-30 22:29:32 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#1488