kyle/boxmaker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Apply P13: tool containers run from one Nix-built image named by digest

Browse Source 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
kyle
2026-09-22 22:30:04 -07:00
co-authored by Claude Opus 5.5
parent b426ca1958
commit 655683c9e0
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/decisions.md
+2 -3
View File
@@ -82,9 +82,8 @@ Later changes to the brief:
|---|---|---| |---|---|---|
| 2026-09-17 | The roles table gained a one-sentence Purpose column, and the crates that are not roles got a purpose table under Code constraints. No behaviour changed. | Owner's request: a reader, human or agent, should learn what each piece is for before what it holds. | | 2026-09-17 | The roles table gained a one-sentence Purpose column, and the crates that are not roles got a purpose table under Code constraints. No behaviour changed. | Owner's request: a reader, human or agent, should learn what each piece is for before what it holds. |
| 2026-09-18 | P14, State: the list gained `broker/sessions/<id>.json`, each session's taint and untrusted flag, written only by `brokerd`. | The M3a spec keeps this state in files the list did not name. It can be rebuilt from the audit log's `result` records, so the audit log stays the record of truth. Owner: a plain file also makes debugging easier. | | 2026-09-18 | P14, State: the list gained `broker/sessions/<id>.json`, each session's taint and untrusted flag, written only by `brokerd`. | The M3a spec keeps this state in files the list did not name. It can be rebuilt from the audit log's `result` records, so the audit log stays the record of truth. Owner: a plain file also makes debugging easier. |
| 2026-09-22 | P13, Authority contract 4: tool containers run from one image built from source by Nix and named by digest; nothing is pulled at call time. | Approved with the M3 design (2026-09-18); applied when the M3b spec came to rely on it. A pull at call time would be unlisted egress. |
## Proposed changes to the design brief ## Proposed changes to the design brief
| # | Change | Reason | None pending.
|---|---|---|
| P13 | Authority contract 4: add "Tool containers run from one image built from source by Nix and named by digest; nothing is pulled at call time." | The brief does not say where tool images come from; a pull at call time would be unlisted egress. Decided 2026-09-18 above. |
docs/design.md
+2 -1
View File
@@ -145,7 +145,8 @@ a multi-turn tool conversation and tool parsing had no failures in 20 trials.
3. No matching grant means deny. `ask` routes an approval request to the owner through `gatewayd` 3. No matching grant means deny. `ask` routes an approval request to the owner through `gatewayd`
and the turn suspends until answered or expired. and the turn suspends until answered or expired.
4. Each approved call runs in a fresh rootless container: no network unless granted, only granted 4. Each approved call runs in a fresh rootless container: no network unless granted, only granted
paths mounted, only the granted secret injected. paths mounted, only the granted secret injected. Tool containers run from one image built from
source by Nix and named by digest; nothing is pulled at call time.
5. **Audit log**: append-only JSONL, hash-chained, one record per decision including denials. 5. **Audit log**: append-only JSONL, hash-chained, one record per decision including denials.
6. **Data classes**: every tool result is labelled `public`, `private`, or `secret`. A session's 6. **Data classes**: every tool result is labelled `public`, `private`, or `secret`. A session's
taint is the union of labels it has seen. The cloud-consult tool is refused for tainted sessions taint is the union of labels it has seen. The cloud-consult tool is refused for tainted sessions