Bounded security verification¶
Use this optional reference separately from CLI-first arena workflow startup and Arena troubleshooting and known issues diagnosis; it is not a test checklist for every routine create. It is targeted containment verification, not comprehensive penetration testing, proof against kernel exploits, or absence of vulnerabilities. Containers within one security arena are deliberately mutually reachable and share a trust domain. Different arenas still share the host kernel and administrator. Separate VMs/hosts are the concrete stronger boundary when container-only separation is insufficient. Fixture passes and network declarations do not confer VM-equivalent isolation.
Current scripts supply bounded procedures; accepted policy governs their authorization and review. Previously recorded observations below are historical evidence, not checks of today’s host. Manual/deployment acceptance remains separate; neither scripts nor documentation establish independent certification. For configuration, owned-resource handling and recovery, use Arena administration reference; image inputs are in Image preparation.
Recorded findings: failed and incomplete boundaries¶
Recorded finding: on the tested rootless Podman host, ordinary fixture peers
reached owned listeners at their bridge gateways 10.96.0.1 and 10.97.0.1.
These listeners ran in Podman’s shared rootless network namespace, not the
physical host’s main namespace. Cross-arena container/broker/proxy TCP and
loopback-published SSH denied in those same fixtures. Strict gateway-host-service
denial remains failed; do not generalize the other passes to all host services.
Avoid sensitive services on arena bridge addresses; audit shared rootless network
namespace services. If gateway service exclusion is required, use separate
VMs/hosts and reverify. Do not automatically alter host firewalls or claim a
network-name change fixes it. See the troubleshooting link below.
The bridge addresses above belong to the specific prior fixture, not reserved
addresses or current arena defaults. Cross-arena denials do not erase the
failed/unresolved gateway-service objective. Also retain the tested Codex
file-tools blocker, bwrap: Can't mount proc on /proc: Operation not permitted:
text/SSE success is not file-tool acceptance. OpenCode’s local-mock file/exec
success is separate from real-provider acceptance. See Privilege and debugging evidence limits,
Standalone verification commands and evidence boundary and Known issues and assurance limits for the scoped tool findings.
Need |
Section / evidence boundary |
|---|---|
Choose safe scope before running anything |
Verification modes and authority; fixture and inspection scopes differ |
Interpret a denial or missing control |
Classify evidence before accepting a result and Compact results record |
Find a goal’s vantage/control/applicability |
|
Run explicitly authorized disposable checks |
Default: disposable controlled fixtures and Standalone verification commands and evidence boundary |
Review registered resources, then select live checks |
Explicit provisioned-arena inspection; plan by default, |
Review maintenance/client/host acceptance |
Maintenance and manual boundaries and Privilege and debugging evidence limits |
Classify evidence before accepting a result¶
For an applicable negative-path goal, validate the exact setup/identities and a healthy correlated positive control. A missing listener, unrelated DNS failure, unexpectedly absent route or uncorrelated timeout can mimic denial; none by itself establishes that the intended guard worked. A control’s own goal may fail while dependent denial goals are blocked; retain both observations rather than replacing them with an overall green result.
---
config:
flowchart:
nodeSpacing: 22
rankSpacing: 28
---
flowchart TD
G["Select goal / vantage / target<br/>expected forbidden-path denial"] --> C{"Setup + exact positive<br/>control healthy?"}
C -->|"no / unavailable"| B["BLOCKED<br/>no valid denial conclusion"]
C -->|"yes"| T{"Forbidden path<br/>successfully reachable?"}
T -->|"yes"| F["FAIL: forbidden path reached<br/>retain unresolved finding"]
T -->|"credible denial"| P["PASS for this bounded goal only<br/>correlated control healthy"]
B --> E["Record actual observation + control<br/>IDs / hashes / scope / date / versions<br/>private redacted evidence"]
F --> E
P --> E
classDef guard fill:#e4effb,stroke:#35669a,color:#193d62
classDef finding fill:#fbe1dc,stroke:#a74432,color:#54251e
classDef context fill:#eeeeee,stroke:#666666,color:#333333
class G,C,T,P,E guard
class F finding
class B context
Decision for an executed, applicable denial goal; not-run and not-applicable outcomes are defined separately below.¶
Red/orange here labels a detected failure, distinct from the untrusted-role label in the mode diagram. Color alone never determines status.
Status |
Meaning |
|---|---|
|
Expected behavior observed for the specific goal; a negative-path pass requires its healthy correlated positive control. Not universal isolation. |
|
Expected objective violated, such as a reachable forbidden path with credible setup/controls. A recorded failed objective stays failed. |
|
Missing/unhealthy setup or control prevents a supported conclusion; retain diagnostics and the reason, never convert it to pass. |
|
No execution evidence for this goal, including unperformed manual checks and a plan-only inspection. |
|
Goal does not apply to the selected profile, with rationale; for example, scripting developer-debug checks. Not a passing test. |
This is the review contract, not a claim that every harness emits the same JSON
schema. Preserve raw records: the arena fixture uses uppercase PASS/FAIL/
BLOCKED statuses; gateway checks use result fields. Keep any reviewer
classification alongside the original output. Allowed-path goals require their
own observed expected success. IPv4/DNS/routing results do not imply IPv6 endpoint
acceptance without the required controlled listener and permission checks.
Select host inputs and protect evidence¶
Use the trusted tooling checkout, not a checkout writable by the agent. All
commands here run in host Bash as the rootless deployment user; harnesses may
open their own pinned SSH ci sessions. Select variables below independently;
ordinary arena creation needs none of these evidence variables. Stop at a failed
prerequisite or command; do not continue over partial setup or failed acceptance.
No real provider key is required. Evidence directories must be new, private and
outside all execution mounts. Do not publish
logs without reviewing redaction of keys, authorization headers, source, prompts,
URLs and personal paths. Hashes identify bytes; they do not authenticate inputs.
Select explicit local inputs for this optional procedure, from the preparation selection records and status detail. These placeholders must be replaced before running tests; there are no recommended historical image tags:
TOOLS="$PWD/tools/ai"
ROOT="$HOME/.local/share/dev-environment"
ARENA=shyft
IMAGE=REVIEWED_LOCAL_MEMBER_IMAGE
IMAGE_PROFILE=archlinux-dev
SQUID=REVIEWED_LOCAL_SQUID_IMAGE
CADDY=REVIEWED_LOCAL_CADDY_IMAGE
EVIDENCE=$(mktemp -d /tmp/shyft-security.XXXXXX)
Keep this private evidence directory outside every mount. Select OTHER_ARENA
only if inspecting a second existing arena. See Arena troubleshooting and known issues
for known issues and diagnosis.
Default: disposable controlled fixtures¶
Choose four unused canonical IPv4 /24s (two arenas, two endpoint/control networks), checking current Podman and host/VPN routes. These examples are not reservations. The harness prints unique resources, addresses and bounded probe scope before creating anything. Only owned listeners, synthetic data and fake secrets are used. Fixtures convert actual generator output to disposable containers; they do not install or exercise user-systemd services.
CHECK_A=10.96.0.0/24
CHECK_B=10.97.0.0/24
CONTROL_A=10.98.0.0/24
CONTROL_B=10.99.0.0/24
"$TOOLS/networks.sh" check --subnet "$CHECK_A"
"$TOOLS/networks.sh" check --subnet "$CHECK_B"
"$TOOLS/networks.sh" check --subnet "$CONTROL_A"
"$TOOLS/networks.sh" check --subnet "$CONTROL_B"
python3 -B "$TOOLS/containment.py" fixture \
--image "$IMAGE" --image-profile "$IMAGE_PROFILE" \
--squid "$SQUID" --caddy "$CADDY" --subnets "$CHECK_A" "$CHECK_B" \
--fixture-subnets "$CONTROL_A" "$CONTROL_B" \
--results "$EVIDENCE/containment-fixture" --gateways
Expected: separate names/networks/state, healthy within-arena peer/gateway controls, bounded cross-arena and external-side probes, then the existing local HTTPS gateway/agent suite. Review every matrix row and cleanup record, not just exit 0. A reachable forbidden path is fail; failed connections lacking a healthy positive control are blocked, never isolation passes. The external-side mock network has no Internet route. No public DNS/TCP/UDP endpoint is probed.
--gateways reruns the existing TLS mock, Squid ACL, streaming/cancellation,
credential replacement, text-agent and disruptive fail-closed cases only in
fixtures. Omit it when exact unchanged image/template evidence remains valid;
current host/kernel/network conditions still require the arena checks. No builds
are part of this procedure. Same-image recreation proves saved-file persistence,
not a changed-image upgrade. A reviewed distinct replacement can instead be passed
directly to the existing arena harness; see the standalone verification commands below.
Failures do not authorize host firewall changes, extra capabilities, relaxed seccomp/SELinux, wider proxy ACLs or sandbox bypasses. Consult Arena troubleshooting and known issues. If the rootless architecture cannot close a path, retain the finding and use separate VMs/hosts before claiming that boundary.
Explicit provisioned-arena inspection¶
This is deliberately a smaller non-disruptive procedure. It resolves only selected existing arena records and prints exact containers, addresses, ports, hashes, shared paths and scope. The default is plan only: no helper containers, SSH sessions, policy writes or service changes. Altered recorded policy/SSH material or a conflicting setup lock causes refusal, not an automatic repair.
python3 -B "$TOOLS/containment.py" inspect --root "$ROOT" --arena "$ARENA"
# For a deliberate two-arena review, set OTHER_ARENA to its registered name:
: "${OTHER_ARENA:?select one existing arena, not an address range}"
python3 -B "$TOOLS/containment.py" inspect --root "$ROOT" \
--arena "$ARENA" --arena "$OTHER_ARENA"
Expected: reviewable JSON plan, no mutation. Paths and endpoints come from validated configuration, not user-supplied scan ranges. Do not run the second block unless two selected arenas exist and you are authorized to inspect both.
After reviewing the plan, authorize only those fixed checks. For a single arena
omit the second --arena entirely:
python3 -B "$TOOLS/containment.py" inspect --root "$ROOT" \
--arena "$ARENA" --arena "$OTHER_ARENA" --execute \
--results "$EVIDENCE/provisioned-inspection"
jq '.[] | {goal,vantage,target,expected,status,actual,evidence}' \
"$EVIDENCE/provisioned-inspection/matrix.json"
Expected: filtered live inventory and pinned SSH ci observations, own gateway
TCP health plus a denied unknown broker route (no upstream inference), selected
foreign gateway TCP/name checks with owning-arena health correlation, permissions,
routes and disabled IPv6 state. No service stop/restart, mock injection, workspace
content read, secret-value dump, log collection, root session or re-enablement
attempt occurs. Presence checks cannot prove that user-supplied source contains
no credentials; exposure review remains a host-side responsibility.
Inspection leaves external TCP/UDP/DNS, host-service listeners, IPv6 endpoints, negative SSH/tunnel tests, agent tools, TLS inference and lifecycle not run. Complete those with the disposable fixtures and the manual boundary checks below; do not equate this smaller inspection with the whole matrix. A missing/stopped target or unhealthy control is blocked. Exit 1 means a finding, exit 2 means inspection could not complete; exit 0 alone is not full acceptance. Blocked rows can coexist with exit 0, so review every recorded status and its control.
Goals, controls and applicability¶
Goal / vantage |
Target / expected |
Control / evidence |
Scope limit |
|---|---|---|---|
Within-arena DNS and peers, ordinary ci |
Own names/IPs reachable: one trust domain |
Healthy controlled peer plus own .2/.3; probe JSON |
Not tenant isolation |
Cross-arena, both directions |
Known peer/broker/proxy IPs and names denied |
Owning-arena successful connections; exact address records |
Name failure alone insufficient |
Host SSH publication and gateway paths |
Only intended workstation loopback boundary; no unintended peer path |
Owned host listeners and successful host SSH; port/mount inspection |
Other host services not scanned |
Dev and broker namespace external TCP/UDP/DNS |
Owned external-side endpoint inaccessible directly |
Healthy endpoint/control namespace response; route/attachment inventory |
Namespace probe is not a Caddy-process privilege test |
IPv6, ordinary ci |
Every interface disabled, no addresses; re-enablement denied |
Per-interface procfs/routes and actual permission failure |
Endpoint probe blocked if no controlled IPv6 listener |
Squid source/destination/method/port |
Only broker .3 exact provider TLS CONNECT; all dev/HTTP/other targets denied |
Working mock tunnel and explicit 403/log outcomes |
CONNECT does not constrain encrypted payloads |
Broker routes/TLS/credentials/streaming |
Fixed upstream, replaced dummy Authorization; forbidden routes and TLS deny |
Local HTTPS transcript, incremental SSE/cancel/error/fail-closed controls |
Fake credentials; no real-provider readiness |
Image privilege and sandbox contract |
No intended sudo/admin path; protected policy and system tools |
Matching immutable-image privilege evidence; current ci/OCI configuration |
Codex file tools blocked; not exhaustive escalation audit |
SSH and client tunnel boundary |
Dedicated key/pin; root/password/wrong-key deny; forwarding restrictions |
Effective sshd/host config plus owned loopback tunnel target |
Real IDE/workstation connection remains manual |
Mounts, private cache/agent/IDE state |
Only reviewed mounts; no management/client-key/broker mounts; explicit sharing |
Config/unit hashes, ownership and live filtered inventory |
Filesystem aliases/credential-bearing task content need review |
Developer compiler/GDB/Valgrind/cache |
Required only for developer profiles |
Matching developer evidence; Arch Memcheck remains blocked |
Scripting: not applicable, never passed |
App Python/Shyft |
Applicable to corrected app scripting image |
App image optional imports and synthetic arithmetic |
Inventory is not complete package coverage |
For each row retain image IDs, resource IDs, config/source hashes and exact evidence paths. Historical reports are not rewritten. Reuse immutable-image evidence only when its identity matches; rerun affected checks for image/agent/runtime changes. Network, proxy, SSH, mounts, security policy, tunnels, kernel/Podman changes and every new deployment host require renewed relevant path checks. Do not rebuild all images for a documentation-only edit.
Compact results record¶
Use one record per goal/vantage/target. Status is one of pass, fail,
blocked, not run or not applicable. Retain the control observation next
to each negative probe; timeouts alone do not prove an enforcing firewall.
{
"goal": "cross-arena broker TCP",
"vantage": "SELECTED-ci-SSH-session",
"target": "CONFIGURED-PEER-.3:8080",
"expected": "denied; owning broker healthy",
"status": "not run",
"actual": null,
"control": "EXACT-POSITIVE-CONTROL-EVIDENCE",
"image_id": "RECORD-FULL-ID",
"resource_id": "RECORD-FULL-ID",
"config_sha256": "RECORD-HASH",
"evidence": "PRIVATE-REDACTED-RELATIVE-PATH",
"date_host_versions": "RECORD-DEPLOYMENT-DETAILS"
}
Capture only allowlisted inventory, not full podman inspect environment or
secret-bearing adapted Caddy configuration. Production logs are not automatically
collected by inspection. The mock logs are synthetic but still require review.
Keep useful evidence; cleanup removes only resources created by that fixture run.
If cleanup fails, use its exact owned-resource record, never storage reset/pruning.
Maintenance and manual boundaries¶
Gateway-stop, recreation, missing-secret/configuration, certificate-failure and agent-file fixtures can interrupt work. They are not inspection-mode checks. Prefer the disposable suite. On a real arena, first schedule a maintenance window, save work, stop all writers, preserve valuable files and follow the main guide’s reviewed lifecycle; do not transplant mock configuration/keys into production.
Client/host manual tunnel review: keep host pins and use only owned harmless
backend-loopback services. PermitOpen deliberately allows backend loopback
ports for the remote IDE; it is an explicit client boundary crossing, not an
arbitrary remote-forward/agent/X11 permission. The client owns its listening port:
ssh -G -F "$ROOT/ssh/$ENVIRONMENT/config" "$ENVIRONMENT" \
| awk '/^(hostname|port|user|forwardagent|stricthostkeychecking|userknownhostsfile) /'
# Review configured server policy without printing keys:
awk '/^(PermitRootLogin|AuthenticationMethods|PasswordAuthentication|AllowAgentForwarding|X11Forwarding|AllowTcpForwarding|PermitOpen|PermitListen|PermitTunnel|GatewayPorts) /' \
"$TOOLS/shared/sshd_config"
Expected: pinned loopback client identity, no agent forwarding; server key-only ci login, local-only forwarding to backend loopback, no remote forwarding/tunnels. Source inspection is not an actual tunnel test. During optional IDE acceptance, record the actual listening addresses on workstation and backend, reconnect and attempt only authorized negative destinations. Do not expose an artifact server or client tunnel broadly. See Optional IDE provisioning and named members.
Enforcing SELinux, actual user-systemd lifecycle, real provider, licensing and GUI/RDP checks remain deployment actions. A non-SELinux host supplies no enforcing LSM acceptance. Finish the six ordered unchecked phases at CLI-first arena workflow; no fixture result checks those boxes automatically.
Privilege and debugging evidence limits¶
The disposable privilege harness uses generated keep-id/SSH policy and dedicated
keys, compiles as ci and checks a GDB-launched inferior’s breakpoint,
observed=37 variable and backtrace under default capabilities/seccomp.
System executables, SSH policy, read-only server mounts and namespace IPv6
settings remain ci-unwritable. Its helper/path audit is not exhaustive escalation
resistance. Runtime/provisioning ci sudo denial is intentional; install OS
packages only in reviewed root-only image construction.
A previously tested Arch image inherits the unresolved Valgrind 3.25.1 mandatory memcmp
resolution failure in stripped ld-linux-x86-64.so.2 from glibc
2.44+r50+g1848099f063e-1. Both Valgrind fixtures fail before execution; the
inherited input fails identically. Record nonzero outcomes, supply approved
matching loader debug symbols/preloaded input and retest separately. No download,
weakened fixture or privilege exception was used. The previously tested Fedora development image’s Memcheck
clean fixture passes; invalid fixture must report invalid-write/leak diagnostics
and exit 42. Scripting developer-debug fixtures are N/A.
GDB’s ASLR Function not implemented warning did not prevent launch debugging.
Ordinary same-user sibling attach fails ptrace: Operation not permitted:
Yama scope 1, default seccomp allowing ptrace and zero effective ci capabilities.
A fixture-only target using PR_SET_PTRACER to nominate its existing session
parent permits attach/backtrace/detach, not arbitrary product-process attach.
Prefer GDB launch; application opt-in needs review. Never add SYS_PTRACE,
SYS_ADMIN, NET_ADMIN, privileged/host namespaces, unconfined seccomp or disabled
SELinux for acceptance. GUI debugging remains manual.
Standalone verification commands and evidence boundary¶
These are operator-invoked reference tests, not run by this documentation
change and not a deployment checklist. Use Bash on the Linux rootless test
host with Podman/Buildah, working keep-id storage, Quadlet, Python 3.11+, jq,
OpenSSH/OpenSSL and supplied fixture dependencies. Select TOOLS from a
trusted checkout; select IMAGE/IMAGE_PROFILE/SQUID/CADDY from
Image preparation and inspected local storage. EVIDENCE must be a private
host-controlled directory outside mounts; each child result directory must be
new. Tests own disposable resources; do not run against live services.
TEST_SUBNET, MOCK_SUBNET and SECOND_TEST_SUBNET are three distinct
unused IPv4 /24s selected from host/VPN/Podman inventory, not production subnets.
Run network checks just before tests. They reject current overlaps and non-default
IPv4 routes across tables, but cannot reserve space or see future VPNs/other users’
storage. FIXTURE_REPLACEMENT_IMAGE must be a reviewed preloaded distinct ID
with the same profile. Scripting distinct replacement acceptance needs a separately supplied fixture.
Image checks and synthetic dispatch/artifact/setup/seed/arena tests:
: "${TOOLS:?absolute trusted tools/ai path}" "${EVIDENCE:?existing private evidence directory}"
: "${IMAGE:?selected preloaded image}" "${IMAGE_PROFILE:?matching embedded profile}"
: "${SQUID:?selected preloaded Squid}" "${CADDY:?selected preloaded Caddy}"
"$TOOLS/tests/verify-image.sh" "${IMAGE_PROFILE#*-}" "$IMAGE"
"$TOOLS/tests/verify-image.sh" squid "$SQUID"
"$TOOLS/tests/verify-image.sh" caddy "$CADDY"
python3 -B "$TOOLS/tests/profiles.py" -v
python3 -B "$TOOLS/tests/artifacts.py" -v
python3 -B "$TOOLS/tests/setup.py" -v
python3 -B "$TOOLS/tests/jetbrains.py" -v
python3 -B "$TOOLS/tests/arenas.py" -v
"$TOOLS/tests/networks.sh"
The Buildah tampered-bundle negative test requires the complete reviewed OpenCode bundle from Fedora agents: explicitly selected local bundles and a new results child:
: "${OPENCODE_BUNDLE:?absolute reviewed complete OpenCode bundle directory}"
python3 -B "$TOOLS/tests/artifact-build.py" --bundle "$OPENCODE_BUNDLE" \
--results "$EVIDENCE/artifact-build-negative"
Select individual live harnesses sequentially; stop/record each failed outcome, do not continue as though acceptance passed. The file-tool and Arch privilege gates have known blockers below. Gateway cases use synthetic credentials and mock TLS trust/hostname; mock-side networking is internal without an Internet route. No real provider call is required.
: "${TEST_SUBNET:?unused checked test IPv4 /24}" "${MOCK_SUBNET:?distinct unused mock IPv4 /24}"
: "${FIXTURE_REPLACEMENT_IMAGE:?reviewed distinct same-profile preloaded ID}"
"$TOOLS/networks.sh" check --subnet "$TEST_SUBNET"
"$TOOLS/networks.sh" check --subnet "$MOCK_SUBNET"
AI_TEST_SUBNET="$TEST_SUBNET" bash "$TOOLS/tests/gateway-configs.sh"
python3 -B "$TOOLS/tests/gateways.py" --ssh-runtime --dev-image "$IMAGE" \
--image-profile "$IMAGE_PROFILE" --squid-image "$SQUID" --caddy-image "$CADDY" \
--subnet "$TEST_SUBNET" --external-subnet "$MOCK_SUBNET" --results "$EVIDENCE/mock-text"
python3 -B "$TOOLS/tests/gateways.py" --ssh-runtime --agent-tools --dev-image "$IMAGE" \
--image-profile "$IMAGE_PROFILE" --squid-image "$SQUID" --caddy-image "$CADDY" \
--subnet "$TEST_SUBNET" --external-subnet "$MOCK_SUBNET" --results "$EVIDENCE/mock-tools"
python3 -B "$TOOLS/tests/privileges.py" --image "$IMAGE" --image-profile "$IMAGE_PROFILE" \
--subnet "$TEST_SUBNET" --results "$EVIDENCE/privileges"
python3 -B "$TOOLS/tests/runtime.py" --image "$IMAGE" --image-profile "$IMAGE_PROFILE" \
--replacement-image "$FIXTURE_REPLACEMENT_IMAGE" --subnet "$TEST_SUBNET" --results "$EVIDENCE/runtime"
python3 -B "$TOOLS/tests/runtime.py" --image "$IMAGE" --image-profile "$IMAGE_PROFILE" \
--replacement-image "$IMAGE" --subnet "$MOCK_SUBNET" --provision --results "$EVIDENCE/provision"
The ccache harness below is only for Arch/Fedora dev. The shown named-arena fixture command uses its default Arch development profile, requiring distinct reviewed Arch IDs and two unused subnets. It exercises generated disposable containers, not installed user-systemd deployment:
python3 -B "$TOOLS/tests/ccache.py" --image "$IMAGE" --image-profile "$IMAGE_PROFILE" \
--replacement-image "$FIXTURE_REPLACEMENT_IMAGE" --subnet "$TEST_SUBNET" --results "$EVIDENCE/ccache"
: "${SECOND_TEST_SUBNET:?second distinct unused checked IPv4 /24}"
"$TOOLS/networks.sh" check --subnet "$SECOND_TEST_SUBNET"
python3 -B "$TOOLS/tests/arena-runtime.py" --results "$EVIDENCE/arena-smoke" \
--image "$IMAGE" --replacement-image "$FIXTURE_REPLACEMENT_IMAGE" \
--squid "$SQUID" --caddy "$CADDY" --subnets "$TEST_SUBNET" "$SECOND_TEST_SUBNET"
For the selected app scripting image only, bounded offline Python smoke:
podman run --rm -i --pull=never --network=none --user ci \
--entrypoint=/usr/bin/python3 "$IMAGE" -B - < "$TOOLS/tests/scripting-smoke.py"
Inspect evidence, not just timeouts or a final SSE success:
jq '[.[] | select(.result != "pass")]' "$EVIDENCE/mock-text/checks.json"
jq . "$EVIDENCE/mock-text/cleanup.json"
Retain reachability.json, networks.json, mock-transcript.jsonl, check
results and cleanup evidence. Positive controls distinguish denial from broken
connectivity. Mock text checks cover replaced dummy authorization, fixed upstream
despite hostile headers/absolute targets, method/path/destination/source denials,
incremental streaming, cancellation/errors and failure on untrusted TLS or stopped
egress without fallback. Selected agents use Responses/SSE; OpenCode’s comparison
Chat Completions profile is not selected, and POST /v1/chat/completions
remains denied. No wildcard API route is justified.
Historical tests/agents/protocol.sh loopback fixtures include local-file
continuation, but their Codex file-tool case uses a fixture-only sandbox bypass.
That is not production tool acceptance. Production SSH-runtime text cases do
not bypass; --agent-tools requires actual fixture contents. OpenCode passes
on the previously tested development/scripting profiles. Codex fails the nested
proc mount on tested Arch/Fedora (bwrap: Can't mount proc on /proc: Operation not
permitted) despite earlier tool-probe/final SSE success. Retain/report the
blocked result; do not disable its sandbox or grant capabilities.
Runtime harnesses inspect generator output, convert generated podman run
to disposable create commands, remove service-lifecycle flags to retain
stopped records and start containers directly. They do not install source
units, invoke actual systemd start/stop/restart ordering or validate login/logout.
Gateway tests also launch disposable containers. Named-arena evidence covers
local aliases, cross-arena broker denial, IPv6, SSH/SFTP, separate state and
stopped-writer changed-image persistence, not all-protocol containment. Host-service
coverage/source-spoofing/client tunnels remain limited. Use
Goals, controls and applicability and Maintenance and manual boundaries for the bounded checks and
omissions; deployment-host acceptance remains separate.