Summary / The 27 components
24 Execution sandbox
Stopping generated code and commands from harming the host, its secrets or the network.
Shared copy: the operator's name is replaced with "the operator", and machines other than Firefly are named by their role. Nothing else is changed.
What is built now
Bubblewrap execution for every harness-run command (see 11), proven by 10 escape probes: network, secret reads (two), write outside the workspace, path traversal, fork bomb, CPU/wall/file-size limits, huge output, the argv allowlist, environment leak. All 10 passed on 10-04. Since 10-04 the bench worker's own shell is fenced as well: every bench pi session runs under the same Landlock wrapper her production delegates use, so the model's commands can write only the task workspace and the session's trail directory, and cannot read her secret store or credential files. A live session confirmed all three: workspace write allowed, write to home refused, secret read refused. Docker is reached only through a root-owned broker that accepts benchmark images, fixed bind mounts and no host-escape flags. Her account no longer has the Docker socket or general sudo.
What is missing
Network access and the provider key stay reachable to workers, because the model calls need both. The other bench hosts don't have the wrapper yet; their session records say confinement.applied: false. The hostile corpus still has no probes that run through a worker session's bash.
Reviewer Claude, 2026-10-04
Reviewer's read: Harness runs and bench workers both fenced on Firefly
The gap the 09-07 review led with is closed on Firefly. The old scoped Docker wrapper read as stronger than it was: it was a check inside the account that the account itself could step around, and other privileges on the account made it moot anyway. The boundary now sits outside the account, in a root service with its own allowlist and tests. Wiring the bench into the Landlock wrapper also turned up a real bug in the wrapper. A git worktree's .git is a file, not a directory, so the wrapper failed closed on every forked session, which is exactly what the multi-session vote (h1) uses. It was fixed in worker_confine 1.4.1. Production delegates never run in worktrees, so they were not affected.
How it is measured fenced (Firefly)
Hostile corpus on every change (40 of 40), the broker's policy tests (19 allowed forms, 48 refused) and the bench confinement tests (4). Next: add probes that run through a worker session's bash.
Adoption rules shared by every arm: How the tests work.
Research & attempts
Score history
No scores yet. The first entry is the baseline for suite v1.
Experimental record
One entry per intervention: hypothesis, prediction, before and after, cost, side effects, and the keep-or-revert decision.
No interventions recorded yet.