feat(runtime): fail-closed confine, optional boxlite, PTY, trajectory - #85
Merged
Conversation
Add confine(argv) around exec with explicit runner vs denial dialects and no silent pass-through. Optional boxlite isolation stays off by default and denies when required isolation cannot find an isolator. Give exec a PTY worker for process_id / write_stdin, and subscribe rx4 ToolExecution and guardrail events into existing trajectory recording through rotary_bridge. Co-authored-by: Max Carter 祁明思 <max@tsc.hk>
Restore the main-branch rs_ai pin so this change does not mix a dependency downgrade into the runtime work. Co-authored-by: Max Carter 祁明思 <max@tsc.hk>
undivisible
marked this pull request as ready for review
September 2, 2026 14:16
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_27f119c2-7a36-4fe4-a3a3-e4973778c07e) |
|
Tick the box to add this pull request to the merge queue (same as
|
crates.io has no 0.2.32, so clippy (unlocked) failed to resolve ^0.2.32. Keep the lockfile pin and replace catalog::find/env_key with a local lookup for the providers apollo actually constructs. Co-authored-by: Max Carter 祁明思 <max@tsc.hk>
clippy 1.98 denies chunks_exact with a constant size under -D warnings, which is the CI gates command. Co-authored-by: Max Carter 祁明思 <max@tsc.hk>
Keep published rs_ai 0.2.31 and as_chunks decode. Take main's MCP dead-code and scheduler cycle-detection fixes. Co-authored-by: Max Carter 祁明思 <max@tsc.hk>
Keep default-features = false with providers, skills, and graph-memory. Leave rs_ai_providers on published 0.2.31. Co-authored-by: Max Carter 祁明思 <max@tsc.hk>
Subscribe RetryReason, ProcessStdin, RequestPermissions, PatchHunk, and SelfHealing into the existing trajectory recorder. Escalate denies stay fail-closed at GitReadOnly. Co-authored-by: Max Carter 祁明思 <max@tsc.hk>
Rotary has no Spill event; it rewrites ToolExecutionEnd content with a locator footer. Parse that footer and record action spill. Co-authored-by: Max Carter 祁明思 <max@tsc.hk>
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_61a5b13d-3a78-4137-b20c-2814aba3e499) |
Keep default-features = false with providers, skills, and graph-memory. Trajectory already records RetryReason, ProcessStdin, and RequestPermissions on this Event shape. Co-authored-by: Max Carter 祁明思 <max@tsc.hk>
Keep default-features = false with providers, skills, and graph-memory. Trajectory event recording is unchanged. Co-authored-by: Max Carter 祁明思 <max@tsc.hk>
Keep default-features = false with providers, skills, and graph-memory. Trajectory event recording is unchanged. Co-authored-by: Max Carter 祁明思 <max@tsc.hk>
PtyWorker now accepts an already-confined ConfineOutcome::Runner and does not wrap isolation again. run_via_rotary attaches the shell PtyWorker so bridge.write_stdin reaches the live exec session. Co-authored-by: Max Carter 祁明思 <max@tsc.hk>
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_86d11142-6925-4bb2-96db-6fd92a863129) |
Keep default-features = false with providers, skills, and graph-memory. Trajectory event recording is unchanged. Co-authored-by: Max Carter 祁明思 <max@tsc.hk>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Apollo-side harvest of harness isolation and exec session hooks.
rx4is pinned to rotary3aab31e794a49f9d2ae399232441439ae3f35823(default-features = false, featuresproviders,skills,graph-memory). No second engine.What landed
confine(argv)around shell/exec, with explicit runner vs denial dialects. Empty argv, catastrophic commands, and a missing isolator are denials. There is no silent pass-through of an unconfined argv.boxlitecargo feature (off by default; not a crate). Default runtime stays hostbash -c. When isolation is required and the isolator is missing (APOLLO_BOXLITE/ configured path /boxliteonPATH), confine denies.process_id/write_stdin, wired throughShellToolandRotaryAgentBridge.rotary_bridge: tool start/end, guardrail warning/stop, errors, budget,RetryReason,ProcessStdin,RequestPermissions,PatchHunk,SelfHealing(recovery), and spill (locator parsed from rotary's truncatedToolExecutionEndpreview).tests/rx4_engine.rscovers a real turn, escalate fail-closed, and spill.Review fixes
PtyWorker::spawnaccepts an already-confinedConfineOutcomeand does not callconfineagain, soIsolation::Requiredwraps the isolator exactly once. Covered by unit tests with a fake isolator binary.run_via_rotary/RotaryAgentBridge::newattach the shellPtyWorkerviaruntime_pty_worker.bridge.write_stdinhits that worker.rx4_bridge_write_stdin_uses_the_pty_workernow drivesbridge.write_stdinon the rotary construction path.CI / deps
rs_ai*stays on published 0.2.31. Local catalog env-key lookup replacesrs_ai_providers::catalog.as_chunksfor clippy 1.98-D warnings.main. No remaining conflict.Validation
MPL-2.0. No secrets.
Device-first
This stays on the local bot path: apollo still owns everything around the rx4 loop.