stack/agents/filbert/work/queue-87/r2/body.md at proxy-ui

0 Fork 1

Files

T

jason.woltje b9ea9304fd lead: commit filbert's untracked evidence (273 files: queue-101 queue-102 queue-105 queue-107 queue-108 queue-109 queue-110 queue-112 queue-113 queue-114 queue-115 queue-116 queue-119 queue-120 queue-122 queue-123 queue-125 queue-126 queue-128 queue-129 queue-130 queue-131 queue-132 queue-133 queue-134 queue-135 queue-136 queue-137 queue-139 queue-140 queue-141 queue-142 queue-145 queue-146 queue-147 queue-148 queue-149 queue-150 queue-151 queue-152 queue-153 queue-154 queue-155 queue-156 queue-162 queue-163 queue-165 queue-166 queue-167 queue-169 queue-170 queue-175 queue-177 queue-181 queue-182 queue-184 queue-185 queue-186 queue-187 queue-188 queue-49 queue-64 queue-66 queue-70 queue-71 queue-80 queue-84 queue-85 queue-87 queue-88)

Unclaimed files left in the canonical checkout. Inventory: canonical-cleanup-inventory.md (commit-as-evidence groups). detect-secrets scan clean on 2026-11-02: hits are sha256 pins, git object ids, test sentinels already in tracked tests and unit-file lines.

2026-11-02 15:05:14 -06:00

5.1 KiB

Raw Permalink Blame History

Filbert review, row 87 round 2: changes.

Candidate: commit 47b030d9b (47b030d9bc), the design docs/plans/2026-10-18_containerized-install-design.md and the rows docs/plans/2026-10-18_containerized-install-rows.md. Every line below is at 47b030d9b's tree. No packages/, scripts/, contracts/, compose.yaml or spike report changed between 203481725 and 47b030d9b, so the code citations stand on the same tree as round 1.

No test reads either file, so under decision 137 these are doc-only. As in round 1, I record changes because the documents are the deliverable and section 10 is what I6 writes into the limits README.

Round 1 items: all answered

Console mounts: section 8 now gives each mount's container path, adds <configDir>/businesses/, sets MOSAIC_CONFIG, and names boot-status.json. The broker path matches packages/webui/src/cli.mjs:56-58 (socketPath(dataRoot)), and the business reads resolve through businessFilePath (packages/business/src/business.mjs:25-32). Correct.
Exact mount lists for every kind: I4, I5 and I6 each carry theirs (broker and notifier, each egress container, the pi worker in I6). Section 2 matches section 9.
The broker-to-provider refusal is in I6's tests.
Hardening (CapEff 0, NoNewPrivs 1, Seccomp 2, read-only root) is in I4, I5 and I6.
Rootless check: "an element exactly equal to", plus I2's substring test.
Section 9's rootless cases match I2.
The tester half of the envelope rule is cited as design.
recover() at launcher.mjs:491-513 and serve() at server.mjs:13. I re-read recover(): it kills the bwrap pid, calls endRun(s.run, "host-lost"), records the end and logs, as the design says.
scripts/test-task.sh probes are listed, and dropNetwork's docker network rm is cited at git-socket.mjs:243.

Darkwing's items also check out against the tree: the bus-host/ allowlist (host.mjs:35-37, 83-84, 122; boot-status.mjs:13-15, 34; session.mjs:47-50, 222; a repo grep finds no other bus-host writer, so five files plus .tmp and .stale is complete); git-host/ (git-socket.mjs:277, 349, 409); the five board routes (packages/webui/src/serve.mjs:304-323) returning 404; the queue panel off; the RESOLVED_VIA human-socket entry (git-socket.mjs:252, 259); the 0.0.0.0 bind recorded as a decision 107 enforcement change, marked not spiked, with I4 testing host 127.0.0.1 and the host's other addresses; and the root case re-measured in I5.

Changes

The Console's outbound reach is unstated, and I missed it in round 1. The Console runs on mosaic-console, "a normal bridge" (design.md:79, 592-597). A normal bridge gives the container outbound reach to any host, with no proxy; every other container that holds authority is on an internal network or behind the egress proxy (section 7, design.md:537-543). The Console holds human authority, and section 8 and section 10 bound a compromised Console only by "its route list and CSP" (design.md:677-679) and the bind (design.md:745-749). Neither covers a compromised process that opens its own outbound connections. Sections 7, 8 and 10 say nothing about it, and no row tests or documents it. Either:
- state it as a section 10 limit ("the Console container can reach any host; nothing proxies it") so I6's limits section carries it, or
- restrict it with a measured option (for example a bridge with IP masquerade disabled, which no spike covers) and add the check to I4's tests. I should have raised this in round 1. Section 8's bridge was already there at 203481725.

Minor, fix in the same round

design.md:537: "There are three networks", but the Console's mosaic-console (design.md:79, 593) is a fourth and is not in the list. Add it, with what joins it and that it is not internal.
design.md:649: "the four state files", but design.md:642-645 lists five (host.json, host.lock, sessions.json, boot-status.json, boot-events.jsonl), and all five are 0600 (boot-status.mjs:35, 37 for the two boot files). Say five.

Checked and correct

Every new citation at 47b030d9b, including S:19, 25, 84-87, 100-103, 146-149, 166-169, 239-241, 311, 320, 329, 352-354, 372, 388-389, 410-418, 433, 491-494 and HP:64-68, 120-121, 149-150; human.mjs:52, runtime.mjs:111 and human-cli.mjs:28; webui serve.mjs:252-253, 270, 277, 283-302; reads.mjs:187-195; mosaic-config.mjs:41-54 and 76-100; cli config.mjs:35; queue store.mjs:51-90.
Section 9 against the briefs, row by row: mount lists, hardening and networks (I4, I5, I6); Console start check, allowlist accept and refuse cases, 404 routes and queue read (I4); via and squash text and the relay (I3); stop matrix, liveness, exit, recover() host-lost, git-host/ and the token (I5); rootless (I2); moved-script refusal and dropNetwork --host (I6). git-socket.mjs is owned by I3, I5 and I6 in dependency order, which is fine.
Section 5's reading is unchanged except wording.

Not run by me

Nothing executed. This is a read of the two documents against the tree and the two spike reports. The spike measurements are Researcher's.

Verdict: changes, on item 1. Items 2 and 3 are small and can go in the same round.

5.1 KiB Raw Permalink Blame History