Merge pull request #54 from hututuQQQ/codex/perf

Implement Sigma Code V5 fast durable agent and scalable sandbox

Author: hututuQQQ

.github/workflows/ci.yml

@@ -153,8 +153,8 @@ jobs:
           --cli .artifacts/agent-cli-linux-x64/packages/agent-cli/dist/index.js
       - name: 100k-file repository performance
         run: node scripts/perf-repository-100k.mjs
-      - name: 100k-event V4 replay and snapshot gate
-        run: pnpm perf:replay-v4-100k
+      - name: 100k-event V5 replay and snapshot gate
+        run: pnpm perf:replay-v5-100k
       - name: Package Harbor runtime
         run: pnpm package:harbor-runtime
       - name: Product readiness
@@ -175,7 +175,7 @@ jobs:
             .artifacts/sandbox-smoke-linux-x64.json
             .artifacts/lsp-sandbox-smoke-linux-x64.json
             .artifacts/sigma-exec-branch-coverage.json
-            .artifacts/replay-v4-100k.json
+            .artifacts/replay-v5-100k.json
             .artifacts/product-readiness-linux-x64.*
 
   windows-release:
@@ -281,8 +281,8 @@ jobs:
           python scripts/ci/tui-real-terminal-smoke.py
           --node .artifacts/agent-cli-win32-x64/bin/node.exe
           --cli .artifacts/agent-cli-win32-x64/packages/agent-cli/dist/index.js
-      - name: 100k-event V4 replay and snapshot gate
-        run: pnpm perf:replay-v4-100k
+      - name: 100k-event V5 replay and snapshot gate
+        run: pnpm perf:replay-v5-100k
       - name: Product readiness
         run: pnpm product:readiness -- --target-platform win32 --target-arch x64
       - name: Upload Windows x64 preview evidence
@@ -300,5 +300,5 @@ jobs:
             .artifacts/sandbox-smoke-win32-x64.json
             .artifacts/lsp-sandbox-smoke-win32-x64.json
             .artifacts/sigma-exec-branch-coverage.json
-            .artifacts/replay-v4-100k.json
+            .artifacts/replay-v5-100k.json
             .artifacts/product-readiness-win32-x64.*

README.md

@@ -189,7 +189,7 @@ The production package dependency graph is checked for cycles and packages commu
 
 `agent-execution` is the only production package allowed to start arbitrary processes. It talks to the bundled Rust `sigma-exec` broker over a framed protocol. On Windows, each sandboxed command uses an AppContainer identity with scoped filesystem ACLs, a kill-on-close Job Object, capability-gated networking, and ConPTY for interactive processes. Linux uses the native namespace sandbox and a watchdog for process-tree cleanup.
 
-Configuration schema v4 defaults to `sandbox=required`, `read_scope=host`, `network=full`, and `process_handoff=allow`. These defaults expand only declared read and socket capabilities: working directories and every write remain workspace-contained, and required isolation never falls back to unsafe host execution. In `ask` mode, `filesystem.read.external`, `network`, and `process.handoff` require a fresh confirmation for each call; `auto` issues a fresh runtime-bound grant, while `deny` rejects them.
+Configuration schema v5 defaults to `permission_mode=workspace-auto`, `sandbox=required`, `read_scope=workspace`, `network=none`, and the native sandbox backend. Workspace-scoped offline reads and declared writes run automatically; external reads, full network, and repository metadata writes remain separately authorized. Required isolation never falls back to host execution, and `container` mode fails with `container_unavailable` until a real OCI backend is installed.
 
 Absolute external inputs are read through stable no-follow traversal and produce `input_access` evidence with path, digest, and size. Process calls mount only their declared stable read roots. A failed goal input remains an unresolved completion obligation until the same external path is read successfully; a run-created fixture cannot replace it.
 
@@ -202,7 +202,7 @@ Linux advertises `processHandoff` only when safe transfer is available. A `deliv
 Runtime state is stored outside the agent-writable workspace under a workspace-derived user-state directory:
 
 ```text
-<user-state>/sigma/workspaces/<workspace-sha256>/stores/v4/sessions/<session-id>/
+<user-state>/sigma/workspaces/<workspace-sha256>/stores/v5/sessions/<session-id>/
   meta.json
   events/000001.jsonl
   snapshots/000000000250.json
@@ -213,7 +213,7 @@ Event records have checksums and monotonic sequence numbers. Segments rotate at
 
 ### Completion is a protocol action
 
-A provider `stop` with substantive text is treated as completion intent, and `complete_task` accepts only a summary plus optional warnings. The runtime—not the model—derives plan completion and evidence from the current mutation frontier. Failed, stale, or incomplete semantic validation keeps the run open with a structured repair diagnostic.
+A provider `stop` is only `model_stopped`. The Completion Coordinator independently derives assurance and review requirements from the current mutation frontier and emits `run.completed` only when `model_stopped`, `assurance_satisfied`, and `review_satisfied` are all true. Failed, stale, weak, or incomplete semantic validation produces structured repair guidance or a typed blocker; the model has no completion tool that can bypass the gate.
 
 All net changes require passed semantic validation on the current state. Sealed no-op checkpoints do not advance that frontier; mutating validation is rebound after its checkpoint seals. The standard profile runs independent review as advisory and records findings as warnings; the strict profile requires approval. Active non-detached children are joined before completion, and an unintegrated writer worktree keeps the parent open.
 
@@ -251,19 +251,19 @@ Stable process exit codes are `0` for `Completed`, `2` for `NeedsInput`, `130` f
 Precedence is **CLI flags → environment → workspace `.agent/config.toml` → home `~/.sigma/config.toml` → defaults**. Unknown flags and TOML keys fail immediately. Workspace-authored MCP servers and executable hooks require an explicit digest-bound trust grant.
 
 ```toml
-schema_version = 4
+schema_version = 5
 
 [model]
 provider = "deepseek"
 name = "auto"
 
 [permissions]
-mode = "ask"
+mode = "workspace-auto"
 
 [security]
 sandbox = "required"
-read_scope = "host"
-network = "full"
+read_scope = "workspace"
+network = "none"
 process_handoff = "allow"
 
 [runtime]
@@ -284,19 +284,19 @@ output_format = "text"
 fps = 30
 ```
 
-To restore the strict pre-v4 capability posture, use:
+To opt into broader per-call capabilities, use:
 
 ```toml
-schema_version = 4
+schema_version = 5
 
 [security]
 sandbox = "required"
-read_scope = "workspace"
-network = "none"
+read_scope = "host"
+network = "full"
 process_handoff = "deny"
 ```
 
-Existing schema v2/v3 files can be checked with `agent config migrate --workspace . --check` and atomically upgraded with `agent config migrate --workspace . --write`. Migration keeps the original as `.agent/config.toml.v2.bak` or `.v3.bak`. Workspace configuration may narrow these capabilities but cannot widen a stricter home policy. The equivalent one-run CLI overrides are `--read-scope workspace --network none --process-handoff deny`.
+Older configuration files can be checked with `agent config migrate --workspace . --check` and atomically upgraded with `agent config migrate --workspace . --write`. Durable V5 sessions are written only to `stores/v5`; V5 never reads or falls back to a V4 session store.
 
 DeepSeek uses `DEEPSEEK_API_KEY`. The runtime also recognizes `GLM_API_KEY`, `ZAI_API_KEY`, or `BIGMODEL_API_KEY` for the experimental GLM/Z.ai path, but formal Sigma evaluation remains DeepSeek-only.
 

README.zh-CN.md

@@ -179,7 +179,7 @@ flowchart TB
 
 `agent-execution` 是生产代码中唯一允许启动任意进程的 Package。它通过分帧协议与正式包中的 Rust `sigma-exec` Broker 通信。在 Windows 上，每条沙箱命令都使用独立的 AppContainer 身份和范围化文件 ACL，并通过 kill-on-close Job Object 限制整个进程树；网络能力按调用授予，交互进程使用 ConPTY。Linux 使用原生 Namespace 沙箱和进程树清理 Watchdog。
 
-配置 Schema v4 默认使用 `sandbox=required`、`read_scope=host`、`network=full` 和 `process_handoff=allow`。放宽的只有已声明只读路径和 Socket 能力：工作目录与所有写入仍限制在工作区，必需沙箱绝不会回退到不安全的宿主机执行。`ask` 模式对 `filesystem.read.external`、`network` 和 `process.handoff` 逐次确认；`auto` 每次签发与调用绑定的运行时授权；`deny` 直接拒绝。
+配置 Schema v5 默认使用 `permission_mode=workspace-auto`、`sandbox=required`、`read_scope=workspace` 和 `network=none`。工作区内离线读取与声明范围内写入自动执行；外部读取、完整网络和仓库元数据写入仍单独授权。沙箱失败绝不回退宿主执行；`container` 模式在真实 OCI 后端不可用时返回 `container_unavailable`。
 
 绝对外部输入通过不跟随链接的稳定遍历读取，并生成包含路径、摘要和大小的 `input_access` 证据；进程只挂载已声明的稳定读取根。目标中读取失败的输入会持续阻止完成，直到同一路径稳定读取成功，本轮生成的替代 Fixture 不能清除义务。
 
@@ -192,7 +192,7 @@ Linux 仅在安全转交可用时公布 `processHandoff`。`deliverable` 进程
 运行状态保存在 Agent 无法写入的工作区之外，目录按工作区哈希隔离：
 
 ```text
-<user-state>/sigma/workspaces/<workspace-sha256>/stores/v4/sessions/<session-id>/
+<user-state>/sigma/workspaces/<workspace-sha256>/stores/v5/sessions/<session-id>/
   meta.json
   events/000001.jsonl
   snapshots/000000000250.json
@@ -203,7 +203,7 @@ Linux 仅在安全转交可用时公布 `processHandoff`。`deliverable` 进程
 
 ### “完成”是协议动作
 
-Provider 返回 `stop`，或者模型写出一段自信的总结，都不代表任务已经完成。模型必须调用 `complete_task`，提供非空总结、明确验收标准，并逐项引用当前运行证据账本中的精确记录。未知、失败、过期或语义不匹配的证据会被拒绝，运行继续，并收到结构化修复诊断。
+Provider 返回 `stop` 只会产生 `model_stopped`。Completion Coordinator 独立推导当前变更所需的 assurance 与 review；只有 `model_stopped`、`assurance_satisfied` 和 `review_satisfied` 同时成立才会写入 `run.completed`。失败、过期、弱化或不完整的语义验证会进入修复或 typed blocker，模型没有可以绕过完成门的工具。
 
 所有净变更都需要当前状态上的语义验证。已密封的 no-op 检查点不会推进 frontier；会写文件的验证在检查点密封后重新绑定最终 frontier。标准 Profile 的独立审查为建议模式，严格 Profile 要求通过。所有非 Detached 子 Agent 会在父任务结束前 Join；仍未集成的 Writer Worktree 也会让父任务保持未完成状态。
 
@@ -241,19 +241,19 @@ Provider 返回 `stop`，或者模型写出一段自信的总结，都不代表
 优先级为 **CLI 参数 → 环境变量 → 工作区 `.agent/config.toml` → Home `~/.sigma/config.toml` → 默认值**。未知参数和未知 TOML Key 会立即报错。由仓库提供的 MCP Server 和可执行 Hook 必须获得与内容摘要绑定的显式信任。
 
 ```toml
-schema_version = 4
+schema_version = 5
 
 [model]
 provider = "deepseek"
 name = "auto"
 
 [permissions]
-mode = "ask"
+mode = "workspace-auto"
 
 [security]
 sandbox = "required"
-read_scope = "host"
-network = "full"
+read_scope = "workspace"
+network = "none"
 process_handoff = "allow"
 
 [runtime]
@@ -274,19 +274,19 @@ output_format = "text"
 fps = 30
 ```
 
-如需恢复 v4 之前的严格能力姿态：
+如需逐次申请更宽的外部能力：
 
 ```toml
-schema_version = 4
+schema_version = 5
 
 [security]
 sandbox = "required"
-read_scope = "workspace"
-network = "none"
+read_scope = "host"
+network = "full"
 process_handoff = "deny"
 ```
 
-现有 Schema v2/v3 配置可用 `agent config migrate --workspace . --check` 检查，再用 `agent config migrate --workspace . --write` 原子升级；原文件保留为 `.agent/config.toml.v2.bak` 或 `.v3.bak`。工作区配置只能收紧这些能力，不能放宽更严格的 Home 策略。单次运行对应参数为 `--read-scope workspace --network none --process-handoff deny`。
+旧配置可用 `agent config migrate --workspace . --check` 检查，再用 `agent config migrate --workspace . --write` 原子升级。V5 会话只写入 `stores/v5`，不会读取或回退到 V4 会话存储。
 
 DeepSeek 使用 `DEEPSEEK_API_KEY`。实验性的 GLM/Z.ai 路径也可以读取 `GLM_API_KEY`、`ZAI_API_KEY` 或 `BIGMODEL_API_KEY`，但 Sigma 的正式评估仍然只覆盖 DeepSeek。
 

SECURITY.md

@@ -54,17 +54,15 @@ sidecars as development outputs rather than official releases.
 
 ## Runtime capability defaults
 
-Configuration schema v4 keeps `sandbox=required` and workspace-only writes, but
-defaults declared read access to `read_scope=host`, sandbox networking to
-`network=full`, and Linux process transfer to `process_handoff=allow`. External
-reads, network access, and handoff are sensitive per-call effects: `ask` requires
-confirmation for each call, `auto` issues a fresh call-bound grant, and `deny`
-rejects them. These settings never authorize unsafe host execution.
+Configuration schema v5 defaults to `permission_mode=workspace-auto`,
+`sandbox=required`, `read_scope=workspace`, and `network=none`. Workspace-scoped
+offline work is automatic; external reads, full network, and repository metadata
+writes remain separately authorized. No setting enables unsafe host execution.
 
 Use the following configuration for the strict capability posture:
 
 ```toml
-schema_version = 4
+schema_version = 5
 
 [security]
 sandbox = "required"

native/sigma-exec/README.md

@@ -21,5 +21,5 @@ network access, and ConPTY for interactive background processes. Run
 `agent sandbox setup` once per Windows user to create and verify the base
 profile. A failed setup or self-test is never replaced with host execution.
 
-Unsafe host execution requires both the broker launch flag
-`--allow-unsafe-host-exec` and `unsafeHostExecApproved: true` on every request.
+V5 has no unsafe host-execution switch. Commands must use the native sandbox;
+an OCI execution mode must be backed by a real container runtime or fail closed.

native/sigma-exec/src/main.rs

@@ -34,6 +34,12 @@ struct HelloParams {
     redaction_secrets: Vec<RedactionSecret>,
 }
 
+#[derive(serde::Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct SandboxWorkspaceParams {
+    workspace_path: std::path::PathBuf,
+}
+
 fn decode<T: DeserializeOwned>(value: Value, label: &str) -> Result<T, RpcError> {
     serde_json::from_value(value).map_err(|error| {
         RpcError::new("broker_protocol_error", format!("invalid {label}: {error}"))
@@ -55,6 +61,15 @@ fn dispatch(state: &BrokerState, request: Request) -> Result<Value, RpcError> {
         }
         "doctor" => Ok(sandbox::doctor_report()),
         "sandbox.setup" => sandbox::setup_sandbox(),
+        "sandbox.repair" => sandbox::repair_sandbox(),
+        "sandbox.status" => {
+            let params = decode::<SandboxWorkspaceParams>(request.params, "sandbox status params")?;
+            sandbox::sandbox_lease_status(&params.workspace_path)
+        }
+        "sandbox.revoke" => {
+            let params = decode::<SandboxWorkspaceParams>(request.params, "sandbox revoke params")?;
+            sandbox::revoke_sandbox(&params.workspace_path)
+        }
         "exec" => state.execute(
             request.request_id,
             decode::<ProcessParams>(request.params, "exec params")?,
@@ -254,10 +269,9 @@ fn main() {
     if let Some(code) = try_run_mcp_readonly_probe() {
         std::process::exit(code);
     }
-    let allow_unsafe = std::env::args()
-        .skip(1)
-        .any(|argument| argument == "--allow-unsafe-host-exec");
-    let state = Arc::new(BrokerState::new(instance_id(), allow_unsafe));
+    // V5 has no host-execution escape hatch. Unsafe policy requests remain
+    // fail-closed in the lower layer, and no command-line switch can enable them.
+    let state = Arc::new(BrokerState::new(instance_id(), false));
     let writer: SharedWriter = Arc::new(Mutex::new(Box::new(io::stdout())));
     let mut stdin = io::stdin().lock();
     loop {

native/sigma-exec/src/process.rs

@@ -832,6 +832,7 @@ mod tests {
                 execution_roots: Vec::new(),
                 executable_sha256: None,
                 protected_paths: Vec::<PathBuf>::new(),
+                #[cfg(test)]
                 unsafe_host_exec_approved: true,
             },
             max_output_bytes: 1024,