fix(acp): harden runtime and workspace boundaries - #360
Merged
Conversation
Signed-off-by: Sertac Ozercan <sozercan@gmail.com>
- grant the chart controller role the admit/use verbs the restored workspace admission policies check, and regenerate staging - remove the 39 branch-added files under deploy/ and charts/orka so the promoted snapshots exactly match the released state - bound symlink chain validation at the kernel resolution depth so graph validation stays linear in the number of links - replace the recursive ** matcher with greedy last-star backtracking so allowedPaths matching stays O(pattern x path) - fail closed for namespace-less internal callers in the remaining authorization test and normalize security store timestamps to UTC at the store boundary Signed-off-by: Sertac Ozercan <sozercan@gmail.com>
…nt mode
Repository-monitor read-only presets now translate per runtime into the
exact surface each built-in runtime can enforce: claude projects the
{Glob, Grep, Read} allowlist (the path-scoped preset previously failed
session configuration), opencode keeps its Read/Glob permissions, and
codex maps the same surface onto its upstream read-only agent mode,
whose kernel-enforced sandbox confines every command to reads with no
network access while the controller rejects all elevation requests.
Codex reviewers are admitted again by the monitor API and reconciler,
and read-only agent task validation accepts codex; any other restricted
codex tool policy still fails closed, as does the read-only surface on
write-intent sessions.
Also extracts create_agent_task argument parsing helpers to satisfy
gocyclo and wraps the egress proxy copyBuffered signature for lll.
Signed-off-by: Sertac Ozercan <sozercan@gmail.com>
Read tasks without Bash now carry the restricted {Read,Glob,Grep} tool
policy for every provider, so the nightly and dispatched live ACP e2e
executes codex's native read-only agent mode instead of skipping the
restricted path. The blocking timeout and cancellation tasks keep the
codex carve-out because codex cannot express restricted policies that
include Bash.
Signed-off-by: Sertac Ozercan <sozercan@gmail.com>
…less successes Live ACP validation caught two undeletable-Task bugs in prompt attempt reclamation: - terminal validation compared the per-prompt Session mutation-lease generation against the RuntimeSession incarnation generation, which only coincide for a session's first prompt, so every continuation Task wedged forever on its cleanup finalizer - completeSuccessWithDelivery emitted only the sparse terminal execution classification, so every successful sessionless Task failed the projection identity checks at reclamation The finalized SessionTurn now binds to the Task by session UID with lease-generation fencing against the PromptAttempt, and success projections carry the complete frozen execution identity with volatile fields cleared so retried settlements stay byte-identical. The live kind e2e also now passes end to end for the first time: the validator adopts the harness-v2 watch namespace in shared mode (the isolated controller only serves Tasks there), stamps its namespace with the controller-mode claim, probes chat completions with max_completion_tokens, supports publishing a local Vekil build through the run registry ahead of the Vekil deploy, and pins Vekil v0.14.1, whose direct-bearer fallback accepts fine-grained Copilot PATs noninteractively. Signed-off-by: Sertac Ozercan <sozercan@gmail.com>
Codex's own sandbox is bubblewrap, which needs unprivileged user namespaces the runtime Pod forbids, so selecting the upstream read-only agent mode made every command fail and only the release-gate result content check caught it: reads never executed. Read-only sessions now keep the orka-external agent mode and rely on the boundary that actually holds in-Pod: safe read commands execute, every elevation request is rejected by the controller, file writes are mediated by the supervisor, and the read-intent workspace delta classification fails any modifying turn. Comments and docs no longer claim kernel enforcement. Also fixes two shared watch-namespace gates the release gate exposed: write-task settlement for remote cleanup and failure diagnostics both required a validator-created namespace and skipped the adopted orka-system namespace. Live release-gate evidence: codex read results now carry independently verified repository content, and the clean-room publication chain (branch push to a distinct fork, PR creation, exact-head verification) completed with delivery VerifiedExact. Signed-off-by: Sertac Ozercan <sozercan@gmail.com>
…evidence Tasks without a repository workspace freeze the protocol-only "empty" revision in their projected delivery evidence, while the outbox projector strips that value before the schema-validated Task status. Reclamation compared the two shapes byte-for-byte, so every no-workspace Task with delivery evidence became undeletable once its finalizer ran. Compare through the projector's normalization and pin the protocol constant in taskterminal so both sides stay coupled.
Recovery scenarios run apply-acp-production.sh twice into one shared fake-kubectl log, so whole-log ordering asserts compared the recovery run's dependency rollouts against the aborted run's endpoint waves and failed for every post-dependency crash scenario. Scope the phase-order asserts to the final converged invocation, which the aborted run's state-file guards already fence.
Repository-monitor reviewers must omit spec.secretRef because provider credentials come from the controller-managed runtime proxy; the CLI security/monitor suite still created its Claude reviewer with a local credential Secret and failed monitor creation.
Sertaç Özercan (sozercan)
marked this pull request as ready for review
August 13, 2026 19:36
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1d0cdff579
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "Codex (@codex) review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".
The kind wrapper now adopts the shared orka-system namespace by default, but the smoke-mode EXIT handler only invoked delete_test_namespace_now for namespaces the run created, so shared runs leaked their run-scoped Tasks, Agents, and RuntimePools on retained clusters. Route shared namespaces through the existing shared-mode cleanup branch, which removes run-labeled resources and leaves the namespace in place.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Testing
git diff --cached --check(passed before commit)internal/apiTestInternalCallerAuthorizerVerifyNamespace/non_service_account_without_namespace_remains_allowedexpects HTTP 204 but now receives HTTP 403Stack