docs(adr): 0003 — confined shell is a stub today (honest confinement state + the embedder fail-open allowance)#27
Merged
Conversation
… + the embedder fail-open allowance
Records the CURRENT operational state of the exec-confinement path so the ADR
0002 contract isn't read as a description of today:
- The brush-backed confined shell is a STUB — ShellTool fails closed on every
invocation ("shell tool is temporarily unavailable in this build"; tested),
brush deps removed, pending reubeno/brush#1184 + agent-bridle#20.
- sandbox_kind honestly reports None (I9); the LandlockSandbox backstop (I10) is
not exercised while the shell is stubbed.
- So today's operative exec floor is fail-closed (I5 doing its job); the usable
confined shell + Landlock are the TARGET. No invariant moves down the ladder.
Documents the embedder fail-open allowance: bridle fails closed by construction;
whether to offer an escape — and how loudly — is the embedder's explicit,
disclosed choice. newt-agent provides --yolo/--disable-ocap (routes run_command
around bridle to the host shell, sandbox_kind=none) and discloses it. Cross-links
newt-agent/docs/decisions/ocap_confinement_model.md.
Extends ADR 0002 (#26). Refs reubeno/brush#1184, agent-bridle#20.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QuysMycvvtHeFnY6Astj4u
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Mirrors the OCAP confinement honesty doctrine into agent-bridle, where the confined shell + the
--yolo-style bypass live. Docs only (one new ADR).Why
ADR 0002 states the invariant contract (what MUST hold). A reader can mistake it for a description of today. With the brush
CommandInterceptornot yet upstream (reubeno/brush#1184), the exec-confinement path is not what the contract describes yet — and the project's own rule is "never overclaim" (I9). This ADR timestamps the current operational state.What ADR 0003 records (all verified against the code)
ShellTool::invokereturns "shell tool is temporarily unavailable in this build" (tested:invoke_returns_unavailable_error); brush deps removed inCargo.toml("STUB RELEASE … pending feat(core): add CommandInterceptor exec/open hook to ShellExtensions reubeno/brush#1184"). This is I5 (fail closed) doing its job — exec is denied, not waved through.sandbox_kindhonestly reportsNone(I9). TheLandlockSandboxbackstop (I10) is not exercised while the shell is stubbed (no permitted program runs through it).The embedder fail-open allowance
bridle fails closed by construction; whether to offer a fail-open escape — and how loudly — is the embedder's explicit, disclosed choice. newt-agent provides
--yolo/--disable-ocap(NEWT_DISABLE_OCAP=1), which routesrun_commandaround bridle to the host shell (sandbox_kind = none) — the human's per-invocation choice to unbridle. agent-bridle never opens silently.Cross-links
newt-agent/docs/decisions/ocap_confinement_model.md(the downstream view, opened in newt-agent#561) so bridle and its hosts tell one consistent, honest story about what confinement buys today vs. at target.Extends ADR 0002 (#26). Refs reubeno/brush#1184, agent-bridle#20.
🤖 Generated with Claude Code