Confine each L1 worker's writes to its own staging dir

Open
  • Is something wrong?
#169 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
35/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
shell
Domain
security

Research direction

Start by tracing where the runner launches each L1 engine and writes to findings/; inspect the existing l1_timeout_bin handling in run-stats for how a missing isolation tool is reported. Compare macOS sandbox-exec and Linux bwrap support, including the Claude state directory requirement. Done means workers can write only to their own staging directory and the runner copies their answer into findings/<date>/, with isolation status reported when unavailable.

Written by the indexing model from the issue text.

Description

Every L1 worker can write any path the user can, so no check on files in the findings dir can tell the runner's writes from a worker's. Fix the access, not the check: run each L1 engine under an OS sandbox that can write only its own staging directory, and have the runner copy the answer into findings/<date>/.

The workers hold Read and Write (claude: --tools Read Write under bypassPermissions; omp: --tools=Read,Write --allow-home). What that reaches today:

A worker for session B can write Effect
session A's <hash>.json and .served together A's findings are forged or suppressed, and AUTODREAM_L1_REQUIRE_SERVED=1 cannot tell
A's file in the window between A's engine exiting and the runner signing it the runner vouches for B's bytes as A's answer
a chunk answer between the merge and the check that reads its verdict the merged findings carry a forged chunk under a match
a new <anything>.json in the findings dir after the pre-L1 pass L2 reads every *.json there
$AUTODREAM_DIR/config, or any script the runner executes the next run executes it as the runner

https://github.com/STRML/autodream/pull/168 closed the two shapes https://github.com/STRML/autodream/issues/167 reported (key-shaped provenance, two-value files). A follow-up design that bound a SHA-256 digest of each answer into .served went to a four-vendor review panel and was dropped. The first three rows above survive any marker scheme, because the runner writes into the same directory the workers can.

The shape of the fix:

runner ─▶ sandbox(writes: staging/<hash>/ only) ─▶ engine
   │                                                  │
   └── copies staging/<hash>/out.json ─▶ findings/<date>/<hash>.json
  • macOS: sandbox-exec with a profile that denies file-write* outside the staging dir and what the CLI itself needs (claude writes its own state under ~/.claude, so that list is the open question).
  • Linux CI: bwrap, or no isolation with l1_isolation: none in run-stats, the way l1_timeout_bin: none reports a missing bound today.
  • Once writes are confined, .served and the runner marker can stay where they are. Only the runner can reach them.
Dominant language
Shell
Stars
0
Forks
2
Avg merge
11h 31m
Merged PRs (30d)
26

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from STRML/autodream

All issues in STRML/autodream

Similar issues

More Shell/Bash issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.