feat: add BoundaryAttest-gated export handoff

Author: css521

.github/workflows/ci.yml

@@ -73,3 +73,27 @@ jobs:
           go-version: '1.26'
       - name: sync + export/import round trips
         run: bash scripts/verify-portability.sh
+
+  integration-boundaryattest:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7
+        with:
+          repository: cullenmeyers/BoundaryAttest
+          ref: 89c6c4706b368651c2549d7e43de08c24f3079e5
+          path: boundaryattest
+      - uses: actions/setup-go@v7
+        with:
+          go-version: '1.26'
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.13'
+      - name: install BoundaryAttest Python interop dependency
+        run: python -m pip install -r boundaryattest/examples/python-interop-v0.1/requirements.txt
+      - name: signed export/import handoff
+        run: |
+          go build -ldflags "-X main.version=boundaryattest-ci" -o /tmp/agentenv .
+          bash examples/boundaryattest-export/demo.sh \
+            "$GITHUB_WORKSPACE/boundaryattest/examples/python-interop-v0.1" \
+            /tmp/agentenv

CHANGELOG.md

@@ -6,6 +6,14 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+### Added
+- Optional `examples/boundaryattest-export/` integration: signs an exported
+  bundle with BoundaryAttest's strict Python interop envelope, verifies the
+  expected key and agentenv-specific claim semantics, recomputes the received
+  artifact hash, and imports only the same private staged bytes that passed the
+  gate. Its fixture covers a full DAG with two branches and a `winner` tag plus
+  signature, key, envelope, semantic-role, and bundle-tampering failures.
+
 ## [0.4.0] - 2026-07-31
 
 ### Added

Makefile

@@ -9,6 +9,7 @@
 #   make vet               gofmt check + go vet
 #   make verify-rootless   end-to-end rootless E2E (Docker on macOS)
 #   make verify-portability export/import + DAG round trips (Docker on macOS)
+#   make verify-boundaryattest signed export/import handoff (Docker, external checkout)
 #   make verify-btrfs      end-to-end privileged btrfs E2E (Docker, --privileged)
 #   make dev-shell         drop into a persistent dev container (fast inner loop)
 #   make clean             remove built artifacts
@@ -17,7 +18,7 @@ GOOS_LINUX ?= linux
 GOARCH     ?= $(shell uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/;s/arm64/arm64/')
 GOPROXY    ?= $(shell if command -v go >/dev/null 2>&1; then go env GOPROXY; else printf '%s' 'https://proxy.golang.org,direct'; fi)
 
-.PHONY: help demo build test vet verify-rootless verify-portability verify-btrfs verify-supervise verify-mcp verify-rollback openapi-snapshot dev-shell dev-shell-stop clean
+.PHONY: help demo build test vet verify-rootless verify-portability verify-boundaryattest verify-btrfs verify-supervise verify-mcp verify-rollback openapi-snapshot dev-shell dev-shell-stop clean
 
 help:
 	@awk 'BEGIN{FS=":.*##"; printf "Targets:\n"} /^[a-zA-Z_-]+:.*##/ { printf "  %-22s %s\n", $$1, $$2 }' $(MAKEFILE_LIST)
@@ -55,6 +56,17 @@ verify-portability: ## sync + export/import + full-DAG round trips (Docker)
 	  -e CGO_ENABLED=0 -e GOCACHE=/tmp/gocache -e GOMODCACHE=/tmp/gomodcache \
 	  -w /src golang:1.26 bash /src/scripts/verify-portability.sh
 
+verify-boundaryattest: ## signed bundle verification gates import (set BOUNDARYATTEST_DIR)
+	@test -n "$(BOUNDARYATTEST_DIR)" || { \
+	  echo "set BOUNDARYATTEST_DIR to a BoundaryAttest checkout" >&2; exit 2; }
+	@test -f "$(BOUNDARYATTEST_DIR)/examples/python-interop-v0.1/verify_receipt.py" || { \
+	  echo "BoundaryAttest python-interop-v0.1 example not found" >&2; exit 2; }
+	docker build -f examples/boundaryattest-export/Dockerfile \
+	  -t agentenv-boundaryattest-example .
+	docker run --rm \
+	  -v "$(abspath $(BOUNDARYATTEST_DIR)):/boundaryattest:ro" \
+	  agentenv-boundaryattest-example
+
 verify-btrfs: ## end-to-end privileged btrfs E2E (Docker, --privileged)
 	docker run --rm --privileged \
 	  -v "$$PWD":/src -v "$$HOME/go/pkg/mod":/go/pkg/mod \

README.md

@@ -253,6 +253,12 @@ agentenv import snap.agentenv                             # or add a snapshot un
 snapshot bundle adds its node; a whole-repo bundle restores the full DAG into an
 empty `AGENTENV_ROOT`.
 
+For cross-trust-domain handoffs, the optional
+[`boundaryattest-export`](./examples/boundaryattest-export/) example signs the
+exact bundle digest and refuses to import until the BoundaryAttest signature,
+expected key, agentenv claim semantics, and received bytes all verify. Python
+and cryptography stay outside the agentenv binary.
+
 ## Agent integration (socket API)
 
 `agentenv daemon` serves a newline-delimited JSON protocol over a unix socket, so

examples/README.md

@@ -5,7 +5,7 @@ agentenv is **language-agnostic** on both sides:
 - **Workloads**: capture/rollback happens at the *filesystem* level, so the agent
   can build/run anything — `go build`, `mvn package`, `pip install`, `cargo build`,
   `npm i` — and it's all snapshotted regardless of language.
-- **Drivers**: three ways to drive agentenv, each language-neutral:
+- **Drivers**: four ways to drive agentenv, each language-neutral:
   1. **CLI** — `agentenv checkout <id>`, `agentenv log`, `agentenv delete <id>`,
      `agentenv tournament …`. When a `daemon`/`supervise` holds the lock,
      mutating commands auto-route through its socket — same command works
@@ -79,3 +79,10 @@ one `docker run -it ghcr.io/css521/rewindable-claude` lands you in a sandbox
 where Claude Code can edit, install, and **roll back its OWN environment** via
 the `agentenv__checkout` / `agentenv__delete` MCP tools — without exiting the
 session.
+
+## Signed export handoff
+
+[`boundaryattest-export/`](./boundaryattest-export/) is an optional host-side
+adapter and full-DAG fixture. It uses BoundaryAttest's Python reference signer
+and verifier, binds the receipt to the exact exported bytes, and only then calls
+`agentenv import`. Neither Python nor signing-key custody enters agentenv core.

examples/boundaryattest-export/Dockerfile

@@ -0,0 +1,21 @@
+FROM golang:1.26 AS build
+
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN CGO_ENABLED=0 go build \
+    -ldflags "-X main.version=boundaryattest-example" \
+    -o /out/agentenv .
+
+FROM python:3.13-slim
+
+# Same range as BoundaryAttest's python-interop-v0.1 requirements.txt.
+RUN python3 -m pip install --no-cache-dir "cryptography>=41,<47"
+COPY --from=build /out/agentenv /usr/local/bin/agentenv
+COPY examples/boundaryattest-export /opt/agentenv-boundaryattest
+
+ENV HOME=/tmp
+USER 1001:1001
+ENTRYPOINT ["bash", "/opt/agentenv-boundaryattest/demo.sh"]
+CMD ["/boundaryattest/examples/python-interop-v0.1", "/usr/local/bin/agentenv"]

examples/boundaryattest-export/README.md

@@ -0,0 +1,78 @@
+# BoundaryAttest-gated export/import
+
+This optional example signs an exact `agentenv export` bundle with
+[BoundaryAttest's Python Interop Profile v0.1 example][interop], then refuses to
+run `agentenv import` until all of these checks pass:
+
+1. BoundaryAttest accepts the strict three-field envelope, expected Ed25519
+   public key, canonical claim, and signature.
+2. The claim says `server_attested`, `agentenv.export_bundle`, `success`, and a
+   supported `export_kind` (`full_dag` or `snapshot`).
+3. SHA-256 of the received bundle bytes matches `claim.artifact_hash`.
+4. `agentenv import` reads the same private staged copy that was hashed.
+
+The final step avoids a check/use race: changing the received path after it was
+hashed cannot switch the bytes that agentenv imports.
+
+## Run the fixture
+
+Keep BoundaryAttest as a separate checkout; no Python or crypto dependency is
+added to the agentenv binary. This example is tested against BoundaryAttest
+commit `89c6c4706b368651c2549d7e43de08c24f3079e5`.
+
+```bash
+git clone https://github.com/cullenmeyers/BoundaryAttest.git /tmp/BoundaryAttest
+git -C /tmp/BoundaryAttest checkout 89c6c4706b368651c2549d7e43de08c24f3079e5
+
+make verify-boundaryattest BOUNDARYATTEST_DIR=/tmp/BoundaryAttest
+```
+
+The Docker target creates a parent with two branch tips, tags candidate B as
+`winner`, exports the complete DAG, signs its digest, verifies and imports it
+into an empty root, and checks that HEAD, both branches, the tag, and their files
+survived. It also proves that import is not reached for:
+
+- a one-byte bundle change (`artifact_hash_mismatch`);
+- an edited signed claim (`invalid_signature`);
+- a different expected key (`public_key_id_mismatch`);
+- an extra envelope field (strict-envelope rejection); and
+- a validly signed `client_observed` claim (agentenv semantic-policy rejection).
+
+On Linux, the same fixture can run without Docker:
+
+```bash
+python3 -m venv /tmp/agentenv-boundaryattest-venv
+/tmp/agentenv-boundaryattest-venv/bin/pip install \
+  -r /tmp/BoundaryAttest/examples/python-interop-v0.1/requirements.txt
+go build -o /tmp/agentenv .
+
+PATH=/tmp/agentenv-boundaryattest-venv/bin:$PATH \
+  bash examples/boundaryattest-export/demo.sh \
+  /tmp/BoundaryAttest/examples/python-interop-v0.1 /tmp/agentenv
+```
+
+## Adapter usage
+
+The receiver supplies the bundle, receipt, an independently trusted public key,
+an empty destination root, and a local BoundaryAttest reference checkout:
+
+```bash
+python3 examples/boundaryattest-export/verify_and_import.py \
+  environment.agentenv.gz \
+  environment.agentenv.gz.receipt.json \
+  host-public-key.pem \
+  --interop-dir /path/to/BoundaryAttest/examples/python-interop-v0.1 \
+  --agentenv /usr/local/bin/agentenv \
+  --import-root /fresh/agentenv-root
+```
+
+The signer and receipt store belong outside the rewindable rootfs. The checked-in
+BoundaryAttest demo key is only a deterministic test fixture; use a separately
+managed host/orchestrator key in a real handoff.
+
+Passing this gate proves that the expected key signed the claim and that the
+imported bytes match its artifact digest. It does not prove the claim was true,
+the export was authorized, the internal snapshots are tamper-evident, or either
+runtime was uncompromised.
+
+[interop]: https://github.com/cullenmeyers/BoundaryAttest/tree/main/examples/python-interop-v0.1