Skip to content

Qualify packaged worker hostile inputs and cancellation #53

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dovvnloading merged 1 commit into from
Jul 29, 2026
+322 −134
Merged

Qualify packaged worker hostile inputs and cancellation #53

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 9 additions & 2 deletions docs/adr/0001-capability-tiered-agentic-execution-harness.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -952,8 +952,10 @@ pass without executing code.
authenticated broker loop is implemented. The release-only signer now covers the
complete one-folder dependency closure with inert resource entries and refuses to
produce metadata without an external key; signed-worker end-to-end broker
execution remains blocked. Collect opt-in aggregate reliability metrics, never
content, only after the provider is sandbox-qualified.
packaged-worker qualification now passes the fixed transform, hostile decoder,
and in-flight cancellation corpus. Collect opt-in aggregate reliability metrics,
never content, only after the remaining release gates close and the provider is
sandbox-qualified.

**Implementation gate:** parser, artifact-boundary, qualification-provider,
worker-provenance, sandbox-qualification, and native-launcher-policy regression
Expand All @@ -964,6 +966,11 @@ executed inside the worker, OS sandbox qualification, signed provenance, broker
identity, resource/watchdog accounting, external review, and fixed-function provider
lifecycle health must pass before any provider is enabled.

The 2026-07-28 packaged qualification evidence closes the hostile decoder corpus,
signed provenance, broker identity, and in-flight cancellation portions of this
gate. Parser fuzzing, artifact security review, resource/watchdog accounting,
external review, and production lifecycle health remain open.

### Phase 3 — `scratch.auto.v1` arbitrary WebAssembly code

- Add the narrow compute tool to qualified tool-capable models.
Expand Down
22 changes: 19 additions & 3 deletions docs/adr/0001-phase2-evidence.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# ADR-0001 Phase 2 evidence log

- **Phase:** 2 — signed image recipes and calculator/check primitives
- **Status:** Typed contract, signed-manifest verification, native broker transport, authenticated worker loop, signed bundle installation, trusted artifact boundary, signed worker launch/broker qualification, and packaged provider transform qualification complete; watchdog/hostile-decoder evidence, external review, and lifecycle release gates remain open
- **Status:** Typed contract, signed-manifest verification, native broker transport, authenticated worker loop, signed bundle installation, trusted artifact boundary, signed worker launch/broker qualification, and packaged transform/hostile-decoder/cancellation qualification complete; parser fuzzing, resource/watchdog accounting, artifact security review, external review, and lifecycle release gates remain open
- **Scope:** Provider-independent contracts plus a qualification-only fixed-function core
- **Source decision:** [Capability-tiered agentic execution harness](0001-capability-tiered-agentic-execution-harness.md)
- **Contract ADR:** [Phase 2 typed recipe and primitive contract](0001-phase2-recipe-contract.md)
Expand All @@ -24,9 +24,9 @@
| Native named-pipe adapter/DACL/peer-token binding | **Complete (transport-only)** | Protected local pipe, expected PID, OS token identity, X25519/HKDF handshake, direction keys, and close-on-error lifecycle are covered by native broker tests. |
| User-artifact copy-in, output validation, and publication | **Complete (boundary only)** | Explicit owner/turn grants, bounded stable snapshots, link/reparse/hardlink/sparse/ADS rejection, byte-derived MIME policy, exact output claims, quarantine, hash/size limits, atomic repository publication, rollback, and cleanup categories are covered by `tests/test_phase2_artifact_boundary.py`. |
| Fixed-function image provider core | **Complete (qualification-only)** | `RecipeImageProvider` validates allowlisted PNG/JPEG/WebP bytes, verifies/loads one frame with Pillow bomb/resource limits, applies only parsed steps, strips metadata, revalidates encoded output, checks cancellation, and remains disabled until external sandbox health passes. |
| Windows recipe sandbox qualification harness | **Complete (signed launch/broker/provider transform)** | `recipe_worker_e2e_qualification.py` signs a disposable package with an in-memory key, installs/verifies one immutable generation, binds the live AppContainer identity to the broker, and exercises the fixed PNG grayscale corpus through `collect_output`. The native broker uses bounded availability polling before reads so the cancellation reader remains live while the packaged provider transforms. |
| Windows recipe sandbox qualification harness | **Complete (signed launch/broker/hostile/cancellation)** | `recipe_worker_e2e_qualification.py` signs a disposable package with an in-memory key, installs/verifies one immutable generation, binds the live AppContainer identity to the broker, and exercises the fixed PNG transform, truncated-PNG decoder rejection, active-SVG decoder rejection, and in-flight cancellation corpus. The native broker uses bounded availability polling before reads so the cancellation reader remains live while the packaged provider transforms. |
| Suspended native launcher/resource policy | **Complete (factory + binder + ACL cleanup + qualification evidence)** | `NativeWin32ProcessFactory` grants only inherited read/execute access to the fresh AppContainer SID on the verified package root, applies and verifies Job Object policy before resume, and removes the per-launch ACE during cleanup. `NativeBrokerIdentityBinder` pins the live server to the worker PID/AppContainer SID and launcher cleanup closes it on failure. |
| OS sandbox provider and provider-produced image outputs | **Blocked / release gate** | Signed installation, provenance, AppContainer/job identity, broker handshake, `prepare`, `input_chunk`, `input_complete`, and `collect_output` are live-qualified inside the packaged worker. The remaining gate is watchdog/cancellation and hostile-decoder evidence, external review, and production lifecycle wiring. |
| OS sandbox provider and provider-produced image outputs | **Blocked / release gate** | Signed installation, provenance, AppContainer/job identity, broker handshake, `prepare`, `input_chunk`, `input_complete`, `collect_output`, hostile decoder rejection, and in-flight cancellation acknowledgement are live-qualified inside the packaged worker. The remaining gate is parser fuzzing, artifact security review, resource/watchdog accounting, external review, and production lifecycle wiring. |

## Security invariants

Expand Down Expand Up @@ -96,6 +96,9 @@
26. Native broker reads poll bounded pipe availability before synchronous reads so a
cancellation reader cannot starve the provider transform; pipe errors still fail
closed and do not bypass framing, authentication, or sequence checks.
27. Hostile decoder bytes are rejected inside the signed worker, and cancellation is
sent only after `input_complete` over the authenticated broker; a missing or
ambiguous terminal response remains a blocked qualification result.

## Re-run target

Expand Down Expand Up @@ -150,3 +153,16 @@ closed the broker, binder, worker, and profile; no `recipe_worker.exe` process
remained. This closes the packaged provider-transform qualification gate but does
not close the remaining watchdog/hostile-decoder, external-review, or lifecycle
release gates.

**Packaged hostile/cancellation qualification result (2026-07-28):** The full
`recipe_worker_e2e_qualification.py --json --timeout-seconds 10 --strict` run
passed all four signed-worker cases: normal fixed PNG transform with
`collect_output`, truncated PNG rejection, active SVG rejection, and an
in-flight eight-step bounded transform that returned `cancel_ack` after
`input_complete`. Each case used a fresh authenticated broker binding and
disposable worker; the run reported no worker process or binding cleanup
residue. The optional `--case cancellation` path reproduces the cancellation
gate in isolation. These results close the packaged hostile-decoder and
cancellation qualification evidence, but do not enable the provider or close
parser fuzzing, resource/watchdog accounting, artifact security review,
external review, or production lifecycle health gates.
30 changes: 17 additions & 13 deletions tools/execution_spikes/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,25 +68,29 @@ disposable end-to-end check:
```powershell
python tools/execution_spikes/recipe_worker_e2e_qualification.py --json
python tools/execution_spikes/recipe_worker_e2e_qualification.py --json --strict
# Optional: rerun one release-gate case in isolation.
python tools/execution_spikes/recipe_worker_e2e_qualification.py --case cancellation --json --strict
```

It creates an in-memory ephemeral Ed25519 trust root, signs the already-built
one-folder package, installs one immutable generation, verifies provenance,
launches the worker through the native AppContainer/job-policy factory, and
exercises only the fixed 4x3 PNG grayscale corpus over the authenticated broker.
It accepts no user files, model text, commands, or production trust material.
`--strict` returns exit code `2` unless every stage passes. Full package closure
verification can take several minutes on Windows; the protocol timeout applies
after launch and is fail-closed.

The current evidence result passes the packaged provider transform:
exercises a fixed PNG transform, truncated-PNG and active-SVG hostile decoder
cases, and an in-flight eight-step cancellation corpus over the authenticated
broker. It accepts no user files, model text, commands, or production trust
material. `--strict` returns exit code `2` unless every selected stage passes.
Use `--case` to rerun one case during diagnosis; the default runs the full
corpus. Full package closure verification can take several minutes on Windows;
the protocol timeout applies after launch and is fail-closed.

The current evidence result passes the complete packaged-worker corpus:
signed installation, provenance, AppContainer/job identity binding, broker
handshake, `prepare`, `input_chunk`, `input_complete`, and `collect_output` all
complete through the authenticated broker. The native read path polls
`PeekNamedPipe` with a bounded 5 ms wait before `ReadFile`, keeping the worker's
cancellation reader live without starving the provider transform. The harness
still does not close the remaining watchdog/hostile-decoder, external-review, or
production-lifecycle release gates.
handshake, normal `collect_output`, hostile decoder rejection for truncated PNG
and active SVG bytes, and an in-flight `cancel_ack` after `input_complete`. The
native read path polls `PeekNamedPipe` with a bounded 5 ms wait before `ReadFile`,
keeping the worker's cancellation reader live without starving the provider
transform. Parser fuzzing, resource/watchdog accounting, artifact security review,
external review, and production-lifecycle release gates remain open.

## What the probes prove

Expand Down
Loading
Loading