feat(agent-sandbox): integrate hypervisor ring enforcement into sandbox providers by rsd-darshan · Pull Request #2732 · microsoft/agent-governance-toolkit

Darshan Poudel (rsd-darshan) · 2026-06-01T11:10:48Z

Summary

Closes #2666. Paired with #2667 — ships atomically per maintainer note.

Add ring: ExecutionRing field to SandboxConfig (default RING_3_SANDBOX) so callers can express an agent's privilege level at session-creation time; fail-closed by default
DockerSandboxProvider.create_session(): reads RING_CONSTRAINTS and overrides network_enabled=False / read_only_fs=True when the ring forbids it — ring wins over whatever policy or caller requested. execute_code(): calls RingEnforcer.check_resource(SUBPROCESS) before running code, giving Ring 3 agents a clear PermissionError
HyperLightSandboxProvider.create_session(): clears tool_allow and net_allow when the ring's constraints deny subprocess/network access; ring is stored per-session in _session_rings for use at execute time. execute_code(): pre-checks RingEnforcer.check_resource(SUBPROCESS) before guest invocation
ACASandboxProvider.create_session(): forces allow_hosts=[] and net_default="deny" for Ring 3, ensuring _apply_egress_policy sets a deny-all Azure egress rule even when no policy object is supplied
Add agent_hypervisor>=4.0.0,<5.0 to package dependencies

Test plan

Existing DockerSandboxProvider, HyperLightSandboxProvider, and ACASandboxProvider test suites pass (no existing behaviour changed when ring is not explicitly set, as RING_3_SANDBOX is already the most restrictive default)
Manual: create_session(ring=ExecutionRing.RING_3_SANDBOX) with network_enabled=True in config → session created with network disabled
Manual: execute_code() on a Ring 3 session → PermissionError before code reaches container
Manual: create_session(ring=ExecutionRing.RING_2_STANDARD) → tools and network behave as before
ACA: Ring 3 session without a policy → egress policy is still applied deny-all

…ox providers Closes microsoft#2666. - Add `ring: ExecutionRing` field to `SandboxConfig` (default `RING_3_SANDBOX`) so callers can express an agent's privilege level when provisioning a session. - `DockerSandboxProvider.create_session()`: consults `RING_CONSTRAINTS` and overrides `network_enabled=False` / `read_only_fs=True` when the ring forbids network or write-filesystem access. `execute_code()`: calls `RingEnforcer.check_resource(SUBPROCESS)` before running code, surfacing a clear `PermissionError` for Ring 3 agents. - `HyperLightSandboxProvider.create_session()`: clears `tool_allow` and `net_allow` when the ring's constraints deny subprocess/network; stores the ring per-session in `_session_rings` for use at execute time. `execute_code()`: checks `RingEnforcer.check_resource(SUBPROCESS)` before guest invocation. - `ACASandboxProvider.create_session()`: forces `allow_hosts=[]` and `net_default="deny"` for Ring 3, ensuring `_apply_egress_policy` sets a deny-all Azure egress rule even when no policy is supplied. - Add `agent_hypervisor>=4.0.0,<5.0` to package dependencies.

github-actions · 2026-06-01T11:11:38Z

🤖 AI Agent: contributor-guide — View details

AI-generated review output. Treat it as untrusted analysis and verify before acting.

Welcome, and thank you for your contribution! Great job on the detailed implementation and documentation of the new ring feature.

Before merging, please address the following:

Ensure that all new imports (e.g., hypervisor.rings.enforcer, hypervisor.models) are included in the project dependencies and properly documented.
Verify that the added dependency agent_hypervisor>=4.0.0,<5.0 is compatible with the existing dependencies and does not introduce conflicts.

For more details on contributing, please review our CONTRIBUTING.md. Let us know if you have any questions!

github-actions · 2026-06-01T11:11:38Z

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	NONE
Overall	MEDIUM

Automated check by AGT Contributor Check.

docker_config_from_policy and aca_config_from_policy constructed a new SandboxConfig without forwarding the ring field, so any caller passing ring=RING_2_STANDARD alongside a policy would have the ring silently reset to the RING_3_SANDBOX default before ring enforcement ran.

Darshan Poudel (rsd-darshan) · 2026-06-02T03:54:32Z

Imran Siddique (@imran-siddique) Thanks for syncing main in. Ready on my end whenever you want to proceed.

… lazy imports agent_hypervisor v4.0.0 is not published to PyPI (latest is 3.7.0), so adding it as a core dependency caused pip to fail during CI install. - Remove agent_hypervisor from core dependencies; keep as optional [hypervisor] extra at >=3.7.0,<5.0 for users who want ring enforcement - Change sandbox_provider.py to TYPE_CHECKING-only import; SandboxConfig.ring is now Optional[Any] = None (None resolves to RING_3_SANDBOX at enforcement) - All providers resolve ring=None → RING_3_SANDBOX inside lazy import blocks

…d-darshan/agent-governance-toolkit into feat/sandbox-ring-enforcement

…mports agent_hypervisor 4.0.0 does not exist on PyPI (latest: 3.7.0), so the hard dependency broke the CI install step for agent-sandbox. - Move agent_hypervisor to optional extras as >=3.7.0,<5.0 (mirrors the pattern used in agent-mesh after microsoft#2761) - Guard every hypervisor import behind `if ring is not None:` so the package is never imported when ring enforcement is not configured - SandboxConfig.ring defaults to None; providers skip ring enforcement when None, preserving all existing behaviour unchanged

Darshan Poudel (rsd-darshan) · 2026-06-02T08:24:33Z

Imran Siddique (@imran-siddique) — heads up, auto-merge got disabled when I pushed the dep fix (GitHub disables it automatically on fork pushes). You may need to re-enable it.

github-actions · 2026-06-06T16:50:32Z

PR Review Summary

Check	Status	Details
🔍 Code Review	⚠️ Missing	No current-run comment
🛡️ Security Scan	⚠️ Missing	No current-run comment
🔄 Breaking Changes	⚠️ Missing	No current-run comment
📝 Docs Sync	⚠️ Missing	No current-run comment
🧪 Test Coverage	⚠️ Missing	No current-run comment

Verdict: ⚠️ AI review incomplete; ready for human review

AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims.

Imran Siddique (imran-siddique)

Two blockers:\n\n1. HyperLight net_allow cleared unconditionally\n\nIn , sits outside the block. It will clear network access for every ring that has , including RING_2_STANDARD. The assignment needs to be indented under the condition:\n\n\n\n2. No automated tests\n\nThe test plan is 100% manual steps. These ring-override code paths need unit tests — at minimum: (a) RING_3 config with gets network disabled, (b) RING_2 leaves network enabled, (c) on a RING_3 session raises . Existing CI suites passing doesn't cover the new branches.\n\nMinor (non-blocking): extra doesn't include , so Defaulting to user installation because normal site-packages is not writeable
Collecting agt-sandbox[full]
Downloading agt_sandbox-4.0.1-py3-none-any.whl.metadata (13 kB)
Collecting agent-governance-toolkit-cli<5.0,>=4.0.0 (from agt-sandbox[full])
Downloading agent_governance_toolkit_cli-4.0.0-py3-none-any.whl.metadata (4.2 kB)
Collecting agent-governance-toolkit-core<5.0,>=4.0.0 (from agt-sandbox[full])
Downloading agent_governance_toolkit_core-4.0.0-py3-none-any.whl.metadata (7.2 kB)
Collecting docker<8.0,>=7.1.0 (from agt-sandbox[full])
Downloading docker-7.1.0-py3-none-any.whl.metadata (3.8 kB)
Collecting hyperlight-sandbox<0.5,>=0.4.0 (from agt-sandbox[full])
Downloading hyperlight_sandbox-0.4.0-py3-none-any.whl.metadata (2.8 kB)
Collecting croniter<7.0,>=2.0 (from agent-governance-toolkit-cli<5.0,>=4.0.0->agt-sandbox[full])
Downloading croniter-6.2.2-py3-none-any.whl.metadata (22 kB)
Collecting opentelemetry-api<2.0,>=1.20 (from agent-governance-toolkit-cli<5.0,>=4.0.0->agt-sandbox[full])
Downloading opentelemetry_api-1.42.1-py3-none-any.whl.metadata (1.4 kB)
Collecting opentelemetry-sdk<2.0,>=1.20 (from agent-governance-toolkit-cli<5.0,>=4.0.0->agt-sandbox[full])
Downloading opentelemetry_sdk-1.42.1-py3-none-any.whl.metadata (1.7 kB)
Requirement already satisfied: pydantic<3.0,>=2.4.0 in C:\Users\imran\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages (from agent-governance-toolkit-cli<5.0,>=4.0.0->agt-sandbox[full]) (2.13.4)
Requirement already satisfied: pyyaml<7.0,>=6.0 in C:\Users\imran\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages (from agent-governance-toolkit-cli<5.0,>=4.0.0->agt-sandbox[full]) (6.0.3)
Collecting aiohttp<4.0,>=3.13.4 (from agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full])
Downloading aiohttp-3.14.1-cp312-cp312-win_amd64.whl.metadata (8.5 kB)
Requirement already satisfied: click<9.0,>=8.1.0 in C:\Users\imran\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages (from agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full]) (8.4.1)
Requirement already satisfied: cryptography<49.0,>=46.0.7 in C:\Users\imran\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages (from agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full]) (48.0.0)
Requirement already satisfied: httpx<1.0,>=0.27.0 in C:\Users\imran\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages (from agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full]) (0.28.1)
Requirement already satisfied: jsonschema<5.0,>=4.0.0 in C:\Users\imran\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages (from agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full]) (4.26.0)
Collecting pynacl<2.0,>=1.5.0 (from agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full])
Downloading pynacl-1.6.2-cp38-abi3-win_amd64.whl.metadata (10 kB)
Requirement already satisfied: python-dateutil<3.0,>=2.8.0 in C:\Users\imran\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages (from agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full]) (2.9.0.post0)
Requirement already satisfied: rich<16.0,>=13.0.0 in C:\Users\imran\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages (from agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full]) (15.0.0)
Collecting structlog<26.0,>=24.1.0 (from agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full])
Downloading structlog-25.5.0-py3-none-any.whl.metadata (9.5 kB)
Collecting aiohappyeyeballs>=2.5.0 (from aiohttp<4.0,>=3.13.4->agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full])
Downloading aiohappyeyeballs-2.6.2-py3-none-any.whl.metadata (5.9 kB)
Collecting aiosignal>=1.4.0 (from aiohttp<4.0,>=3.13.4->agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full])
Downloading aiosignal-1.4.0-py3-none-any.whl.metadata (3.7 kB)
Requirement already satisfied: attrs>=17.3.0 in C:\Users\imran\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages (from aiohttp<4.0,>=3.13.4->agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full]) (26.1.0)
Collecting frozenlist>=1.1.1 (from aiohttp<4.0,>=3.13.4->agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full])
Downloading frozenlist-1.8.0-cp312-cp312-win_amd64.whl.metadata (21 kB)
Collecting multidict<7.0,>=4.5 (from aiohttp<4.0,>=3.13.4->agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full])
Downloading multidict-6.7.1-cp312-cp312-win_amd64.whl.metadata (5.5 kB)
Collecting propcache>=0.2.0 (from aiohttp<4.0,>=3.13.4->agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full])
Downloading propcache-0.5.2-cp312-cp312-win_amd64.whl.metadata (17 kB)
Requirement already satisfied: typing_extensions>=4.4 in C:\Users\imran\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages (from aiohttp<4.0,>=3.13.4->agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full]) (4.15.0)
Collecting yarl<2.0,>=1.17.0 (from aiohttp<4.0,>=3.13.4->agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full])
Downloading yarl-1.24.2-cp312-cp312-win_amd64.whl.metadata (97 kB)
Requirement already satisfied: colorama in C:\Users\imran\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages (from click<9.0,>=8.1.0->agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full]) (0.4.6)
Requirement already satisfied: cffi>=2.0.0 in C:\Users\imran\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages (from cryptography<49.0,>=46.0.7->agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full]) (2.0.0)
Collecting pywin32>=304 (from docker<8.0,>=7.1.0->agt-sandbox[full])
Downloading pywin32-312-cp312-cp312-win_amd64.whl.metadata (11 kB)
Requirement already satisfied: requests>=2.26.0 in C:\Users\imran\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages (from docker<8.0,>=7.1.0->agt-sandbox[full]) (2.34.2)
Requirement already satisfied: urllib3>=1.26.0 in C:\Users\imran\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages (from docker<8.0,>=7.1.0->agt-sandbox[full]) (2.7.0)
Requirement already satisfied: anyio in C:\Users\imran\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages (from httpx<1.0,>=0.27.0->agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full]) (4.13.0)
Requirement already satisfied: certifi in C:\Users\imran\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages (from httpx<1.0,>=0.27.0->agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full]) (2026.5.20)
Requirement already satisfied: httpcore==1.* in C:\Users\imran\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages (from httpx<1.0,>=0.27.0->agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full]) (1.0.9)
Requirement already satisfied: idna in C:\Users\imran\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages (from httpx<1.0,>=0.27.0->agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full]) (3.18)
Requirement already satisfied: h11>=0.16 in C:\Users\imran\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages (from httpcore==1.*->httpx<1.0,>=0.27.0->agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full]) (0.16.0)
Requirement already satisfied: jsonschema-specifications>=2023.03.6 in C:\Users\imran\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages (from jsonschema<5.0,>=4.0.0->agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full]) (2025.9.1)
Requirement already satisfied: referencing>=0.28.4 in C:\Users\imran\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages (from jsonschema<5.0,>=4.0.0->agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full]) (0.37.0)
Requirement already satisfied: rpds-py>=0.25.0 in C:\Users\imran\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages (from jsonschema<5.0,>=4.0.0->agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full]) (2026.5.1)
Collecting opentelemetry-semantic-conventions==0.63b1 (from opentelemetry-sdk<2.0,>=1.20->agent-governance-toolkit-cli<5.0,>=4.0.0->agt-sandbox[full])
Downloading opentelemetry_semantic_conventions-0.63b1-py3-none-any.whl.metadata (2.4 kB)
Requirement already satisfied: annotated-types>=0.6.0 in C:\Users\imran\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages (from pydantic<3.0,>=2.4.0->agent-governance-toolkit-cli<5.0,>=4.0.0->agt-sandbox[full]) (0.7.0)
Requirement already satisfied: pydantic-core==2.46.4 in C:\Users\imran\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages (from pydantic<3.0,>=2.4.0->agent-governance-toolkit-cli<5.0,>=4.0.0->agt-sandbox[full]) (2.46.4)
Requirement already satisfied: typing-inspection>=0.4.2 in C:\Users\imran\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages (from pydantic<3.0,>=2.4.0->agent-governance-toolkit-cli<5.0,>=4.0.0->agt-sandbox[full]) (0.4.2)
Collecting email-validator>=2.0.0 (from pydantic[email]<3.0,>=2.5.0->agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full])
Downloading email_validator-2.3.0-py3-none-any.whl.metadata (26 kB)
Requirement already satisfied: six>=1.5 in C:\Users\imran\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages (from python-dateutil<3.0,>=2.8.0->agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full]) (1.17.0)
Requirement already satisfied: markdown-it-py>=2.2.0 in C:\Users\imran\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages (from rich<16.0,>=13.0.0->agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full]) (4.2.0)
Requirement already satisfied: pygments<3.0.0,>=2.13.0 in C:\Users\imran\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages (from rich<16.0,>=13.0.0->agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full]) (2.20.0)
Requirement already satisfied: pycparser in C:\Users\imran\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages (from cffi>=2.0.0->cryptography<49.0,>=46.0.7->agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full]) (3.0)
Collecting dnspython>=2.0.0 (from email-validator>=2.0.0->pydantic[email]<3.0,>=2.5.0->agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full])
Downloading dnspython-2.8.0-py3-none-any.whl.metadata (5.7 kB)
Requirement already satisfied: mdurl~=0.1 in C:\Users\imran\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages (from markdown-it-py>=2.2.0->rich<16.0,>=13.0.0->agent-governance-toolkit-core<5.0,>=4.0.0->agt-sandbox[full]) (0.1.2)
Requirement already satisfied: charset_normalizer<4,>=2 in C:\Users\imran\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages (from requests>=2.26.0->docker<8.0,>=7.1.0->agt-sandbox[full]) (3.4.7)
Downloading agt_sandbox-4.0.1-py3-none-any.whl (49 kB)
Downloading agent_governance_toolkit_cli-4.0.0-py3-none-any.whl (283 kB)
Downloading agent_governance_toolkit_core-4.0.0-py3-none-any.whl (1.7 MB)
---------------------------------------- 1.7/1.7 MB 44.9 MB/s 0:00:00
Downloading aiohttp-3.14.1-cp312-cp312-win_amd64.whl (479 kB)
Downloading croniter-6.2.2-py3-none-any.whl (45 kB)
Downloading docker-7.1.0-py3-none-any.whl (147 kB)
Downloading hyperlight_sandbox-0.4.0-py3-none-any.whl (5.7 kB)
Downloading multidict-6.7.1-cp312-cp312-win_amd64.whl (46 kB)
Downloading opentelemetry_api-1.42.1-py3-none-any.whl (61 kB)
Downloading opentelemetry_sdk-1.42.1-py3-none-any.whl (170 kB)
Downloading opentelemetry_semantic_conventions-0.63b1-py3-none-any.whl (203 kB)
Downloading pynacl-1.6.2-cp38-abi3-win_amd64.whl (239 kB)
Downloading structlog-25.5.0-py3-none-any.whl (72 kB)
Downloading yarl-1.24.2-cp312-cp312-win_amd64.whl (92 kB)
Downloading aiohappyeyeballs-2.6.2-py3-none-any.whl (15 kB)
Downloading aiosignal-1.4.0-py3-none-any.whl (7.5 kB)
Downloading email_validator-2.3.0-py3-none-any.whl (35 kB)
Downloading dnspython-2.8.0-py3-none-any.whl (331 kB)
Downloading frozenlist-1.8.0-cp312-cp312-win_amd64.whl (44 kB)
Downloading propcache-0.5.2-cp312-cp312-win_amd64.whl (42 kB)
Downloading pywin32-312-cp312-cp312-win_amd64.whl (6.9 MB)
---------------------------------------- 6.9/6.9 MB 53.2 MB/s 0:00:00
Installing collected packages: structlog, pywin32, propcache, opentelemetry-api, multidict, hyperlight-sandbox, frozenlist, dnspython, aiohappyeyeballs, yarl, pynacl, opentelemetry-semantic-conventions, email-validator, docker, croniter, aiosignal, opentelemetry-sdk, aiohttp, agent-governance-toolkit-core, agent-governance-toolkit-cli, agt-sandbox

Successfully installed agent-governance-toolkit-cli-4.0.0 agent-governance-toolkit-core-4.0.0 agt-sandbox-4.0.1 aiohappyeyeballs-2.6.2 aiohttp-3.14.1 aiosignal-1.4.0 croniter-6.2.2 dnspython-2.8.0 docker-7.1.0 email-validator-2.3.0 frozenlist-1.8.0 hyperlight-sandbox-0.4.0 multidict-6.7.1 opentelemetry-api-1.42.1 opentelemetry-sdk-1.42.1 opentelemetry-semantic-conventions-0.63b1 propcache-0.5.2 pynacl-1.6.2 pywin32-312 structlog-25.5.0 yarl-1.24.2 silently skips ring enforcement. Either add it or document the gap in the README.

Imran Siddique (imran-siddique)

(duplicate)

…rcement tests - Move `net_allow = []` inside the `if not ring_constraints.network_allowed:` block in hyperlight_provider — previously it was one indent level too high, clearing network access for RING_2_STANDARD and any ring where network is permitted (reported by imran-siddique in PR review) - Add TestRingEnforcement to test_hyperlight_sandbox.py with four cases driven by a fake hypervisor stub (no real SDK required): • RING_3 with non-empty network_allowlist gets all domains cleared • RING_2 leaves the network_allowlist intact • execute_code on a RING_3 session raises PermissionError • ring=None skips enforcement entirely - Add README note that [full] does not include [hypervisor]; callers who want SandboxConfig.ring enforcement must install [full,hypervisor]

…d-darshan/agent-governance-toolkit into feat/sandbox-ring-enforcement

Darshan Poudel (rsd-darshan) · 2026-06-08T16:32:04Z

Imran Siddique (@imran-siddique) Both blockers addressed in the latest push:

net_allow scope bug — moved net_allow = [] inside the if not ring_constraints.network_allowed: block; RING_2_STANDARD and above now correctly preserve their network allowlist.
Automated tests — added TestRingEnforcement to tests/test_hyperlight_sandbox.py (fake hypervisor stub, no real SDK needed): RING_3 clears domains, RING_2 preserves domains, RING_3 execute_code raises PermissionError, ring=None skips enforcement.

Also added a README note on the [full] vs [full,hypervisor] distinction (minor). CI is green on all non-gated checks.

Imran Siddique (imran-siddique) · 2026-06-11T17:03:00Z

Thank you for this contribution, and apologies for the duplication. We are delivering hypervisor ring enforcement for the sandbox providers via #2868 (which was already in progress against issue #2666), so I am closing this as a duplicate. Your approach was sound and the review discussion here was useful. Please do keep contributing, and feel free to review #2868 when it lands.

github-actions Bot added dependencies Pull requests that update a dependency file size/M Medium PR (< 200 lines) labels Jun 1, 2026

github-actions Bot added the needs-review:MEDIUM Contributor check flagged MEDIUM risk label Jun 1, 2026

Darshan Poudel (rsd-darshan) and others added 3 commits June 1, 2026 17:23

Merge branch 'main' into feat/sandbox-ring-enforcement

70722ba

Merge branch 'main' into feat/sandbox-ring-enforcement

c0cd9a8

Imran Siddique (imran-siddique) enabled auto-merge (squash) June 2, 2026 07:33

Darshan Poudel (rsd-darshan) added 2 commits June 2, 2026 13:37

Merge branch 'feat/sandbox-ring-enforcement' of https://github.com/rs…

9245d03

…d-darshan/agent-governance-toolkit into feat/sandbox-ring-enforcement

auto-merge was automatically disabled June 2, 2026 07:52
Head branch was pushed to by a user without write access

Darshan Poudel (rsd-darshan) added 2 commits June 2, 2026 13:39

Merge branch 'main' into feat/sandbox-ring-enforcement

ac00d68

Merge branch 'main' into feat/sandbox-ring-enforcement

fd9150d

Darshan Poudel (rsd-darshan) requested a review from MohammadHaroonAbuomar as a code owner June 3, 2026 03:46

Merge branch 'main' into feat/sandbox-ring-enforcement

8b034e7

Imran Siddique (imran-siddique) requested changes Jun 8, 2026

View reviewed changes

Darshan Poudel (rsd-darshan) added 2 commits June 8, 2026 22:15

Merge branch 'feat/sandbox-ring-enforcement' of https://github.com/rs…

8436542

…d-darshan/agent-governance-toolkit into feat/sandbox-ring-enforcement

github-actions Bot added documentation Improvements or additions to documentation tests size/L Large PR (< 500 lines) and removed size/M Medium PR (< 200 lines) labels Jun 8, 2026

Darshan Poudel (rsd-darshan) requested a review from Imran Siddique (imran-siddique) June 8, 2026 16:43

Imran Siddique (imran-siddique) closed this Jun 11, 2026

Navigation Menu

Repository navigation

feat(agent-sandbox): integrate hypervisor ring enforcement into sandbox providers - #2732

feat(agent-sandbox): integrate hypervisor ring enforcement into sandbox providers#2732
Darshan Poudel (rsd-darshan) wants to merge 12 commits into
microsoft:mainfrom
rsd-darshan:feat/sandbox-ring-enforcement

Darshan Poudel (rsd-darshan) commented Jun 1, 2026

Uh oh!

github-actions Bot commented Jun 1, 2026

Uh oh!

github-actions Bot commented Jun 1, 2026

Uh oh!

Darshan Poudel (rsd-darshan) commented Jun 2, 2026

Uh oh!

Darshan Poudel (rsd-darshan) commented Jun 2, 2026

Uh oh!

github-actions Bot commented Jun 6, 2026 •

edited

Loading

Uh oh!

Imran Siddique (imran-siddique) left a comment

Uh oh!

Imran Siddique (imran-siddique) left a comment •

edited

Loading

Uh oh!

Darshan Poudel (rsd-darshan) commented Jun 8, 2026

Uh oh!

Imran Siddique (imran-siddique) commented Jun 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Darshan Poudel (rsd-darshan) commented Jun 1, 2026

Summary

Test plan

Uh oh!

github-actions Bot commented Jun 1, 2026

Uh oh!

github-actions Bot commented Jun 1, 2026

Uh oh!

Darshan Poudel (rsd-darshan) commented Jun 2, 2026

Uh oh!

Darshan Poudel (rsd-darshan) commented Jun 2, 2026

Uh oh!

github-actions Bot commented Jun 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review Summary

Uh oh!

Imran Siddique (imran-siddique) left a comment

Choose a reason for hiding this comment

Uh oh!

Imran Siddique (imran-siddique) left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Darshan Poudel (rsd-darshan) commented Jun 8, 2026

Uh oh!

Imran Siddique (imran-siddique) commented Jun 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Jun 6, 2026 •

edited

Loading

Imran Siddique (imran-siddique) left a comment •

edited

Loading