From dab92f12560f4ea75cf31f737d4c15018e32b1c6 Mon Sep 17 00:00:00 2001 From: PhysShell <45852143+PhysShell@users.noreply.github.com> Date: Sun, 5 Jul 2026 12:26:56 +0500 Subject: [PATCH 1/3] docs(sandboy): cross-link 007 loop-canvas for the gate/run integration contract The "Wiring into 007" section already describes the per-step wrap; point it at 007/docs/loop-canvas.md, where the same slot is framed as the canvas Actions/Limits/Observability fields. Docs only. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01VNgUjrvwqwtXqe8URbJaQN --- sandboy/README.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/sandboy/README.md b/sandboy/README.md index 591beac4..ba9a244a 100644 --- a/sandboy/README.md +++ b/sandboy/README.md @@ -98,6 +98,14 @@ Per-step policies let a `fmt` step run with no network and RO toolchain, while a which is exactly what `007/docs/security-layers.md` marks as the missing layer in the `run`/gate slot. +The same slot, framed as a loop-engineering design surface (the canvas +**Actions** boundary + **Limits** timeout + **Observability** evidence per gate +step), is in `007/docs/loop-canvas.md`. The wiring hook on the 007 side is a +per-step `sandbox_policy` field on `GateStep` — forward-compatible, not yet +added. An optional `--report ` from sandboy (enforcement status, exit +code, duration) is what turns confinement into the machine-readable evidence +that doc's Observability field asks for. + ## Kernel requirements - Landlock FS scoping: kernel ≥ 5.13. From 7f89d5410d0f701a9fa0b73423a94d49ffc35893 Mon Sep 17 00:00:00 2001 From: PhysShell <45852143+PhysShell@users.noreply.github.com> Date: Sun, 5 Jul 2026 12:32:33 +0500 Subject: [PATCH 2/3] docs(sandboy): label --report and sandbox_policy as not-yet-implemented Codex review (PR #183): the wiring note described `sandboy --report ` as if available, but `parse_args` accepts only `run`/`--policy`/`--` and rejects any other flag (exit 2). Mark both integration hooks (`--report` on sandboy, `sandbox_policy` on 007's GateStep) explicitly as Floor-1 work that does not exist yet, and note the current stderr enforcement status. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01VNgUjrvwqwtXqe8URbJaQN --- sandboy/README.md | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/sandboy/README.md b/sandboy/README.md index ba9a244a..2e1e6ba8 100644 --- a/sandboy/README.md +++ b/sandboy/README.md @@ -100,11 +100,20 @@ in the `run`/gate slot. The same slot, framed as a loop-engineering design surface (the canvas **Actions** boundary + **Limits** timeout + **Observability** evidence per gate -step), is in `007/docs/loop-canvas.md`. The wiring hook on the 007 side is a -per-step `sandbox_policy` field on `GateStep` — forward-compatible, not yet -added. An optional `--report ` from sandboy (enforcement status, exit -code, duration) is what turns confinement into the machine-readable evidence -that doc's Observability field asks for. +step), is in `007/docs/loop-canvas.md`. Two hooks make that real, and **neither +exists yet** — both are Floor-1 work, not current behaviour: + +- **007 side — `sandbox_policy` on `GateStep`.** A per-step policy path so the + gate runner knows to wrap the step. Forward-compatible with the current + manifest parser (unknown fields are tolerated), but **not yet added**. +- **sandboy side — `--report `.** A flag emitting enforcement status / + exit code / duration, the machine-readable evidence the Observability field + asks for. **Not implemented today:** `parse_args` (`src/main.rs`) accepts only + `run`, `--policy `, and `--`, so passing `--report` now is a usage error + (exit 2). Enforcement status *is* already surfaced, but only to **stderr** + (`FullyEnforced` silently / `PARTIALLY enforced` warning / `NOT enforced` + refusal); `--report` would make it structured so 007 can persist it into + `gate/.sandbox.json`. ## Kernel requirements From dbe8702f2389bd7e3dae6f2f331bbf668c27e477 Mon Sep 17 00:00:00 2001 From: PhysShell <45852143+PhysShell@users.noreply.github.com> Date: Sun, 5 Jul 2026 12:35:22 +0500 Subject: [PATCH 3/3] docs(sandboy): sandbox_policy must fail closed, matching 007 loop-canvas Keep the two sides of the contract consistent: the 007-side bullet framed `sandbox_policy` as plain "forward-compatible", but 007/docs/loop-canvas.md now requires it to fail closed (schema bump) since silent unknown-field tolerance fails open on a security control. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01VNgUjrvwqwtXqe8URbJaQN --- sandboy/README.md | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/sandboy/README.md b/sandboy/README.md index 2e1e6ba8..6401bbbd 100644 --- a/sandboy/README.md +++ b/sandboy/README.md @@ -104,8 +104,13 @@ step), is in `007/docs/loop-canvas.md`. Two hooks make that real, and **neither exists yet** — both are Floor-1 work, not current behaviour: - **007 side — `sandbox_policy` on `GateStep`.** A per-step policy path so the - gate runner knows to wrap the step. Forward-compatible with the current - manifest parser (unknown fields are tolerated), but **not yet added**. + gate runner knows to wrap the step. **Not yet added.** The manifest parser + tolerates unknown fields, but this is a **security control**, so it must + **fail closed** when it lands: a manifest `schema` bump (or explicit presence + check) so an older `o7` that can't enforce a `sandbox_policy` **refuses the + step** rather than silently running it bare under `bypassPermissions`. Relying + on unknown-field tolerance here would fail *open*. See + `007/docs/loop-canvas.md`. - **sandboy side — `--report `.** A flag emitting enforcement status / exit code / duration, the machine-readable evidence the Observability field asks for. **Not implemented today:** `parse_args` (`src/main.rs`) accepts only