Skip to content

followup(validation): on-box Docker stdio-broker smoke before enabling AUTOBOT_CODEEXEC_ENABLED #11596

Closed

Description

@mrveiss

Gate before flipping the code-exec flag (#11568 / PR #11595). secure_sandbox_executor._pump_broker_io drives real Docker attach_socket duplex stdio + 8-byte frame demux; unit tests use the design's fake-runner, so the real container path is unexercised. Deliverable: integration smoke on a box with the autobot/secure-sandbox image — compose script calling 2 read-only tools returns a merged result in one dispatch; verify no-network, budget abort kills the container, frame demux handles a multi-frame reply. Must pass before AUTOBOT_CODEEXEC_ENABLED=1 in any environment.

Activity

  1. mrveiss commented on Jul 11, 2026

    @mrveiss
    OwnerAuthor

    Harness merged to Dev_new_gui in PR #11614, squash commit a206ff4: autobot-backend/tests/integration/test_codeexec_docker_smoke.py — 4 skip-gated integration tests (two-tool merge, no-network, budget abort, multi-frame demux) over the REAL executor+broker+Docker path.

    This is a GATE, not a passing check — it CANNOT run in CI or this environment (no Docker); it self-skips unless AUTOBOT_CODEEXEC_DOCKER_SMOKE=1 + a reachable daemon + the autobot/secure-sandbox:latest image. Run on a box:
    AUTOBOT_CODEEXEC_DOCKER_SMOKE=1 python3 -m pytest autobot-backend/tests/integration/test_codeexec_docker_smoke.py -v

    Two blockers remain before AUTOBOT_CODEEXEC_ENABLED=1 anywhere:

    1. discovery(code-exec): compose script has no clean result channel — stdout is owned by the broker RPC stream #11613 (HIGH) — writing the smoke surfaced a real gap: the compose script has no clean result channel (broker owns stdout for RPC), so the merged result is polluted. test_smoke_two_readonly_tools_merge_in_one_dispatch will FAIL on-box until discovery(code-exec): compose script has no clean result channel — stdout is owned by the broker RPC stream #11613 is fixed — by design.
    2. This smoke passing green on an actual box.

    Closing the deliverable (harness written+merged); the two blockers above remain tracked and gate enablement.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions