Consolidate sandbox provider contributions #333–#337 / 收敛沙箱 Provider 贡献

[Maplemx]

目的 / Purpose

#324 继续负责本地沙箱与 ExecutionResourceProvider 的总体架构方向。本 Issue 负责收敛同一贡献者提交的 provider 草案、维护贡献归属，并按一次一个 provider 的顺序完成真实机制验收。

This issue tracks the contributor sandbox-provider drafts, preserves attribution, and requires one-at-a-time integration with real mechanism evidence.

当前状态 / Current status

Provider	原贡献 / Original contribution	接受结果 / Accepted result	状态
gVisor/runsc	#335 / #345	#350；Skills AgentEra/Agently-Skills#12	✅ 已合入 dev，原提交与作者保留
macOS Seatbelt	#327 / #333	#351；Skills AgentEra/Agently-Skills#13	✅ 已合入 dev，#327/#333 已按 superseded 关闭
Linux Landlock	#337	#353；Skills AgentEra/Agently-Skills#15	✅ 已合入 dev，原提交与作者保留
Linux Bubblewrap	#336	维护者参考草案 #352；Skills 参考草案 AgentEra/Agently-Skills#14	⏳ 修改权已交回 contributor，等待真实环境证据

已接受实现统一遵守：

• code_execution / 既有 ExecutionResourceProvider owner 边界；
• TaskWorkspace grant、immutable bundle、bounded stdout/stderr、timeout/cancellation、health/release；
• 明确 fail closed，不静默回退到 trusted_local 或其他 provider；
• capability 只上报真实观察到的隔离轴；
• 贡献者原提交优先保留，维护者修正追加在其后；
• 用户文档收敛到 execution-environment，Agently-Skills 同步更新。

这些 provider 不属于 4.1.4.6；已接受项进入当前 dev，后续随正常 dev -> main 发布流程处理。

最新 Todo / Updated todo

已完成 / Completed

• gVisor：Docker runtime registry、真实 runsc probe、ensure/health/result metadata 一致、错误/取消清理和 Ubuntu runsc CI。
• Seatbelt：grant-only write policy、真实 macOS sandbox-exec evidence、bounded lifecycle、能力限制如实上报。
• Landlock：移除 preexec_fn 和无界 communicate()，使用独立 helper + bounded process，Ubuntu ABI v7 enforcement evidence。
• 三个已接受 provider 均完成主仓库文档、Agently-Skills 同步及贡献归属说明。
• Bubblewrap 维护者草案已完成结构修正与确定性测试；Ubuntu 24.04/22.04 hosted runners 均真实返回 bwrap_user_namespace_blocked。
• 未通过 sudo、privileged container、关闭 AppArmor 或修改 userns sysctl 伪造 Bubblewrap 成功。
• feat: Bubblewrap (Linux) ExecutionResourceProvider #336 恢复为 contributor-owned active PR；feat: integrate grant-bound Linux Bubblewrap provider #352/Agently python v2.0.0 #14 关闭但保留分支和可复用提交。

需要 contributor 支持 / Contributor support required

@drscrewdriver，请继续负责 #336，或提交一个基于当前 dev 的明确 successor，并完成：

• 确认使用 feat: Bubblewrap (Linux) ExecutionResourceProvider #336 继续，或给出 successor PR 链接；不要同时扩展多个 Bubblewrap PR。
• rebase/merge 当前 dev，保持 provider_id="bubblewrap"、supported_kinds=("code_execution",)。
• 评估并复用维护者参考提交：
  • 1b3cdea3：grant-only mounts、受控 child env、真实 probe/health、truthful capabilities；
  • 33d843d6：统一文档与机制 workflow；
  • e8c2f978：Ubuntu 22.04 默认策略 characterization。
• 在你的 Ubuntu homeserver 或其他代表性普通 Linux host 上记录只读环境事实：
  • OS / kernel：uname -a；
  • Bubblewrap：bwrap --version；
  • 当前 AppArmor / userns 状态（只读取，不修改）；
  • 是否在正常用户、正常宿主策略下运行。
• 在未使用 sudo bwrap、privileged container、关闭 AppArmor、修改 userns sysctl 的情况下运行：
  • python -m pytest tests/test_bubblewrap_isolation.py -q
  • python -m pytest tests/test_bubblewrap_execution_provider_integration.py -q -rs
• 提供真实观察结果，证明：
  • granted output write 成功；
  • grant 外宿主 read/write 被拒绝；
  • 默认 network namespace 与宿主不同；
  • probe、ensure、health、release 与 result metadata 一致；
  • timeout/cancellation 后无遗留进程或临时资源。
• 附上命令、branch/commit、Python 版本、测试摘要和必要的 bounded 日志；不要只提交手工结论或模拟结果。
• 如正常宿主策略仍不允许 unprivileged Bubblewrap，请原样报告 blocker，不降低安全策略。

维护者后续 / Maintainer follow-up

• contributor 更新 feat: Bubblewrap (Linux) ExecutionResourceProvider #336 后，按以上矩阵进行逐项 review。
• 真实机制证据通过后，决定直接接受 feat: Bubblewrap (Linux) ExecutionResourceProvider #336 或创建贡献保留的 successor integration。
• 同步主仓库 docs 与 Agently-Skills，再以 merge commit 合入，保留贡献历史。
• Bubblewrap 得出合入或明确不可支持结论后，更新并关闭本 Issue。

Bubblewrap 当前已知限制 / Known blocker

GitHub-hosted Ubuntu 24.04 与 22.04 在默认策略下均阻止 unprivileged Bubblewrap；仓库当前没有 self-hosted Linux runner。因此 #336 需要 contributor 提供代表性普通 Linux 环境证据。环境不允许本身是有效结论，不是要求绕过宿主安全策略的理由。

Related architecture tracker: #324.

[drscrewdriver]

承接方式确认： about #335 /#345 我来选第 2 项——授权维护者接手整合，保留贡献归属。我不再继续维护 #335/#345 分支，合入时请保留原始提交或使用 Co-authored-by 标注，我会配合提供必要上下文。

其他确认：

• 优先推进 gvisor docker runtime 1/2 reuse docker provider way #335/feat: add gVisor (runsc) runtime support to DockerExecutionResourcePr… #345，不提前展开其他 provider
• 分支当前基于 upstream/dev ✅
• fail closed ✅
• 无新依赖 ✅
• 测试覆盖 6 类 20 项 ✅
• 用户文档待合入方向确定后统一收敛到 execution-environment.md

[Maplemx]

维护者接手整合已启动，贡献归属按 #342 的确认保留：

• 草稿整合 PR：feat: integrate fail-closed gVisor Docker execution provider #350（基于 feat: add gVisor (runsc) runtime support to DockerExecutionResourcePr… #345 的原始 head，保留其全部 6 个提交与作者；随后合并当前 dev，再以新的维护者提交修正）。
• gvisor docker runtime 1/2 reuse docker provider way #335 已关闭；feat: add gVisor (runsc) runtime support to DockerExecutionResourcePr… #345 在 feat: integrate fail-closed gVisor Docker execution provider #350 合入前保持开放，不会以“无价值”为由关闭。
• 配套 Agently-Skills 草稿：docs: describe fail-closed gVisor provider Agently-Skills#12。

本次审查确认 #345 当前 head 不宜直接合入 dev：

1. 合并基点落后当前 dev；
2. 仅检查宿主 runsc binary，不能证明 Docker daemon 已注册或能实际执行该 runtime；
3. 未注册或错误 runtime 会被错误报告为 ready；
4. gVisor 机制逻辑位于通用 Docker provider，且部分验证脚本未被 pytest 收集。

#350 的修正与验收矩阵：

• 专用 gvisor provider/resource 复用 Docker 的 grant、镜像、健康、清理和有序选择；通用 Docker provider 恢复机制中立；
• Docker runtime registry、镜像准备后的有界 runsc 探测、ensure、health 与结果 metadata 形成同一 verified runtime 链；
• 显式 sandbox="gvisor" 对缺失、格式错误、未注册或实际不可执行的 runsc fail closed，绝不回退到 runc、auto 或 trusted_local；
• pytest-collected 真实机制测试在缺 Docker/runsc/image 前置条件时明确 skip；
• 已验证：完整 suite 2550 passed、28 skipped（Agently-Stage 0.3.8）；相关严格 RuntimeWarning 检查 129 passed、1 prerequisite skip。

#350 合入后，再在本 Issue 记录替代关系并以 superseded by #350 关闭 #345。

[Maplemx]

Phase 1 completed: gVisor

• Maintainer integration feat: integrate fail-closed gVisor Docker execution provider #350 merged to dev as 4abbbcde2cdaf8d73f9416f146ce8eb3c3aef969.
• All six original feat: add gVisor (runsc) runtime support to DockerExecutionResourcePr… #345 commits and authors remain in merged history.
• GitHub therefore marked feat: add gVisor (runsc) runtime support to DockerExecutionResourcePr… #345 as merged automatically; a superseded/attribution explanation was added to the original PR.
• Agently-Skills companion Update README_CN.md typo #12 merged as 5ba5dfd53df6ad466b32e9a00700fc5a69eeaf27.
• Validation: full suite 2554 passed / 28 skipped; focused lifecycle tests 133 passed / 1 local prerequisite skip; real Ubuntu + Docker + runsc workflow passed.

Next candidate

Per the maintainer sequence, #333 is now the active Seatbelt candidate. #327 is the older duplicate and will not be expanded independently. The maintainer integration will preserve contributor history, merge current dev, and correct the provider around TaskWorkspace-grant-only policy, real macOS mechanism evidence, bounded execution, cancellation/cleanup, and consolidated execution-environment documentation.

After Seatbelt acceptance, this tracker proceeds to #336 Bubblewrap, then #337 Landlock.

[Maplemx]

Phase 2 completed: Seatbelt

• Contribution-preserving integration feat: integrate grant-bound macOS Seatbelt provider #351 merged to dev as 71b111120f94310818a1f6256601702ce330b48d.
• All eight seatbelt provider #333 commits and authors remain in the accepted branch history.
• Real local macOS sandbox-exec test passed; GitHub macOS Seatbelt mechanism job passed.
• Full suite: 2561 passed / 28 skipped.
• Agently-Skills companion feat: handle for some bad judgeResponse #13 merged as b3225ffc96763d263cce22d6a8c267c404ad5bd3.
• seatbelt provider #333 and the older duplicate Feature/seatbelt provider #327 are closed with explicit superseded/attribution notes.

The tracker now advances to #336 Bubblewrap. The integration will preserve #336 history, merge current dev, remove arbitrary bind/extra-argv escape hatches, require a real bwrap/user-namespace mechanism probe, keep TaskWorkspace grants authoritative, remove guidance that weakens AppArmor, and add an Ubuntu mechanism job.

[Maplemx]

Bubblewrap status: implementation prepared, merge blocked by mechanism environment

• Contribution-preserving draft feat: integrate grant-bound Linux Bubblewrap provider #352 retains all six feat: Bubblewrap (Linux) ExecutionResourceProvider #336 commits/authors and merges current dev.
• Full suite: 2567 passed / 29 skipped; deterministic/cross-provider tests pass.
• Real Bubblewrap execution fails closed with bwrap_user_namespace_blocked on both GitHub Ubuntu 24.04 and Ubuntu 22.04 hosted runners under default security policy.
• No repository self-hosted Linux runner is available.
• feat: integrate grant-bound Linux Bubblewrap provider #352 and Agently-Skills Agently python v2.0.0 #14 remain draft; feat: Bubblewrap (Linux) ExecutionResourceProvider #336 remains open.
• We will not disable AppArmor, change userns sysctls, use sudo bwrap, or use a privileged container as substitute evidence.

The maintainer sequence now proceeds to #337 Landlock while #352 waits for a representative Linux runner whose normal policy permits unprivileged Bubblewrap.

[Maplemx]

Landlock phase started

• Contribution-preserving branch codex/landlock-provider-integration starts from Feature/landlock provider #337 head b8bdcf07 and merges current dev.
• Baseline: 70 passed / 11 Linux mechanism skips.
• Accepted corrective architecture is recorded locally: remove async-subprocess preexec_fn and unbounded communicate(); launch a provider-owned helper as an ordinary bounded child, apply ABI-aware Landlock rules inside that helper, then exec the adapter argv.
• Rule manifests will contain only provider system/toolchain roots plus TaskWorkspace grant roots. Caller read/write dirs and ABI overrides will be removed.
• Landlock remains filesystem-only with preferred isolation and truthful process/syscall/network limitations.

Implementation and Ubuntu real mechanism evidence are still in progress; #337 remains open.

[Maplemx]

Bubblewrap ownership handed back

Per maintainer direction, #336 is again the active contributor-owned Bubblewrap PR.

• @drscrewdriver has been asked to resume the branch or open a current-dev successor and provide real evidence from a representative Linux host under its normal security policy.
• Maintainer draft feat: integrate grant-bound Linux Bubblewrap provider #352 and companion Skills Agently python v2.0.0 #14 are closed without merge.
• Their remote branches and commits remain available for reuse; no contribution or diagnostic work was deleted.
• The required evidence and reusable commit ids are recorded on feat: Bubblewrap (Linux) ExecutionResourceProvider #336.
• Maintainers will review promptly when contributor evidence is ready.

The Landlock #337 maintainer architecture work continues. If its real environment is likewise unavailable, the same contributor handback rule will apply.

[Maplemx]

Phase 3 completed: Landlock

• Contribution-preserving integration feat: integrate bounded-helper Linux Landlock provider #353 merged to dev as 0e8d2b6a975bbc67305b92bb03d133eaab7c0ebb.
• All seven Feature/landlock provider #337 commits and authors remain in accepted history.
• Unsafe async-subprocess preexec_fn and unbounded communicate() were replaced by a provider-owned helper plus the existing bounded-process carrier.
• Real Ubuntu evidence passed on Landlock ABI v7: helper enforcement, granted output write, and denied /etc/shadow read.
• gVisor and Seatbelt regression mechanism jobs also passed.
• Full suite: 2568 passed / 29 skipped.
• Agently-Skills companion feat: handle for some bad judgeResponse #15 merged as 3229e7e90d1d335e52f5cbbdc9551b2c97ce5867.
• Feature/landlock provider #337 closed with an explicit retained-attribution/superseded explanation.

Current tracker outcome:

• gVisor: merged.
• Seatbelt: merged.
• Landlock: merged.
• Bubblewrap: ownership handed back to contributor feat: Bubblewrap (Linux) ExecutionResourceProvider #336; awaiting representative unprivileged Linux evidence.