Repository navigation
feat(server): isolate bridge execution from host custody (ATLI-349) - #11
gabynevada wants to merge 3 commits into
Conversation
Skald review statusSkald: findings need a response (failure) at review state version 50, head Blocking
Answered advisory
ClearedNothing is cleared at this epoch. Blocking: 3. Advisory: 2. Cleared: 0. Fenced: 0. Review rounds
|
![atli-skald[bot]](https://avatars.githubusercontent.com/in/4512341?s=60&v=4){kind=small}
There was a problem hiding this comment.
Skald review findings
Reviewed head 92970ddb8c402c9c92ef4b136c258cb9f4c8d8c4 against base atli (1e6c070cccd3cd8cd42584282834e405ec660e71).
First round
Standing summary: open
Review details
Completed reviewers:
- architecture (hub-dispatch-v2:codex:gpt-6.1-sol:medium:9441865e1d0f674b)
- frontend (hub-dispatch-v2:codex:gpt-6.1-sol:medium:9441865e1d0f674b)
- security (hub-dispatch-v2:codex:gpt-6.1-sol:medium:9441865e1d0f674b)
- testing (hub-dispatch-v2:codex:gpt-6.1-sol:medium:9441865e1d0f674b)
| return { | ||
| ...input, | ||
| driverKind: driver, | ||
| continuationIdentity, | ||
| snapshot, | ||
| orchestrationAdapter, | ||
| snapshotForCwd: () => snapshot.getSnapshot, |
There was a problem hiding this comment.
makeBridgeCodexInstance returns no auth controller, while BridgeRuntime creates a separate empty home per thread and only launches app-server. ProviderAuthService rejects sign-in for instances without auth, and neither the adapter nor the runtime exposes an in-namespace account/login/start or login operation. Host credential import and host terminals are also refused.
There was a problem hiding this comment.
Skald response: addressed
Verification: pending. This records the fix claim; it is not a verified fix.
Reason: Accepted. Added t3 bridge-auth login/status/logout for offline operator provisioning under the same admitted dedicated unit. It validates thread/workspace and full deployment topology before runtime construction, then uses fixed device-login/status/logout arguments, file credential storage, and the same per-thread home mapping, custody lock, leases, namespace supervisor, restricted proxy and teardown proof as app-server. Instance guidance now points to this supported command; the operator procedure preserves the unit hardening and restores server startup afterward. Native synthetic tests prove login persistence for subsequent same-thread app-server sessions, sibling credential absence, status/logout and canceled-login cleanup. Actual pinned Codex help accepted each argv form without performing live authentication. All 48 focused tests and scoped checks passed; no live OAuth exchange or production deployment is claimed.
Evidence:
- apps/server/src/bridge/BridgeAuth.ts
- apps/server/src/cli/bridgeAuth.ts
- apps/server/src/cli/bridgeAuth.test.ts
- apps/server/src/bridge/BridgeRuntime.ts
- apps/server/src/bridge/BridgeTopology.ts
- apps/server/src/bridge/BridgeLifecycle.integration.test.ts
- docs/operations/skald-bridge-runtime.md
There was a problem hiding this comment.
Skald review findings
Reviewed head de1302a0af46706b78adba07128bfd562e3371b3 against base atli (1e6c070cccd3cd8cd42584282834e405ec660e71).
New 2 · Carried 2 · Cleared 0 · Verified 0 since round 92970dd
Standing summary: open
Review details
Completed reviewers:
- architecture (hub-dispatch-v2:codex:gpt-6.1-sol:medium:9441865e1d0f674b)
- architecture (hub-dispatch-v2:codex:gpt-6.1-sol:medium:9441865e1d0f674b)
- frontend (hub-dispatch-v2:codex:gpt-6.1-sol:medium:9441865e1d0f674b)
- frontend (hub-dispatch-v2:codex:gpt-6.1-sol:medium:9441865e1d0f674b)
- security (hub-dispatch-v2:codex:gpt-6.1-sol:medium:9441865e1d0f674b)
- security (hub-dispatch-v2:codex:gpt-6.1-sol:medium:9441865e1d0f674b)
- testing (hub-dispatch-v2:codex:gpt-6.1-sol:medium:9441865e1d0f674b)
- testing (hub-dispatch-v2:codex:gpt-6.1-sol:medium:9441865e1d0f674b)
| if ( | ||
| process.ppid !== 1 || | ||
| !(await NodeFSP.readlink("/proc/1/exe")).endsWith("/systemd") || | ||
| (await NodeFSP.readFile("/proc/self/cgroup", "utf8")).trim() !== `0::${profile.cgroup}` || | ||
| profile.cgroup !== `/system.slice/${NodePath.basename(profile.serviceUnit)}` | ||
| ) | ||
| refuse("unsupported-topology"); |
There was a problem hiding this comment.
validateBridgeTopology reads /proc/1/exe from the non-root service. Linux protects that link with a ptrace credential check; an ordinary custody UID cannot read root PID 1's executable, so readlink throws EACCES before a valid deployment can be admitted.
There was a problem hiding this comment.
Skald response: addressed
Verification: pending. This records the fix claim; it is not a verified fix.
Reason: Accepted and reproduced: nonroot UID1000 gets EACCES reading /proc/1/exe. Admission now retains actual PPid=1, verifies /proc/1 is a root-owned real directory, and reads its world-readable comm value as systemd; all exact cgroup, immutable unit/deployment and custody checks remain. It grants no ptrace capability and has no permissive fallback. Full admission now succeeds in the complete authority fixture even when executable readlink throws EACCES, with that obsolete read never invoked. Eight altered authority facts refuse, and a separate real read-only kernel test proves PID1 metadata/comm access. Serialized validation passed 15 topology/CLI tests, scoped format/lint and server typecheck with unchanged input fingerprint. Tests distinguish mocked complete deployment from real kernel-read proof; no live production admission is claimed.
Evidence:
- apps/server/src/bridge/BridgeTopology.ts
- apps/server/src/bridge/BridgeTopology.test.ts
There was a problem hiding this comment.
Skald review findings
Reviewed head badf00ed78da1ca5a7b5423d772b6a653411c374 against base atli (1e6c070cccd3cd8cd42584282834e405ec660e71).
New 2 · Carried 3 · Cleared 0 · Verified 0 since round de1302a
Not shown inline
These findings are listed here rather than on a line of this pull request: some have no line to attach to, and advisory ones are never threaded. Each row says which.
apps/server/src/bridge/BridgeLifecycle.integration.test.ts:228— nativePrerequisites accepts every runtime-failed result and returns false; each native test then returns successfully before its isolation or lifecycle assertions. The namespace suite has the same helper, and CI does not enable the strict flag. This conflates failures in the implementation under test with missing host prerequisites. — location changed since the review (anchor disappeared)
Standing summary: open
Review details
Completed reviewers:
- architecture (hub-dispatch-v2:codex:gpt-6.1-sol:medium:9441865e1d0f674b)
- architecture (hub-dispatch-v2:codex:gpt-6.1-sol:medium:9441865e1d0f674b)
- architecture (hub-dispatch-v2:codex:gpt-6.1-sol:medium:9441865e1d0f674b)
- frontend (hub-dispatch-v2:codex:gpt-6.1-sol:medium:9441865e1d0f674b)
- frontend (hub-dispatch-v2:codex:gpt-6.1-sol:medium:9441865e1d0f674b)
- frontend (hub-dispatch-v2:codex:gpt-6.1-sol:medium:9441865e1d0f674b)
- security (hub-dispatch-v2:codex:gpt-6.1-sol:medium:9441865e1d0f674b)
- security (hub-dispatch-v2:codex:gpt-6.1-sol:medium:9441865e1d0f674b)
- security (hub-dispatch-v2:codex:gpt-6.1-sol:medium:9441865e1d0f674b)
- testing (hub-dispatch-v2:codex:gpt-6.1-sol:medium:9441865e1d0f674b)
- testing (hub-dispatch-v2:codex:gpt-6.1-sol:medium:9441865e1d0f674b)
- testing (hub-dispatch-v2:codex:gpt-6.1-sol:medium:9441865e1d0f674b)
| if (NodeProcess.platform !== "linux") return; | ||
| const stat = yield* Effect.promise(() => actual.lstat("/proc/1")); | ||
| const comm = yield* Effect.promise(() => actual.readFile("/proc/1/comm", "utf8")); | ||
| expect(stat.isDirectory()).toBe(true); | ||
| expect(stat.isSymbolicLink()).toBe(false); | ||
| expect(stat.uid).toBe(0); |
There was a problem hiding this comment.
The real-filesystem test gates only on Linux and then unconditionally requires /proc/1 to be owned by UID 0. Linux does not require a container's PID 1 to run as root, and this test is outside the mocked topology admission checks.
This finding is advisory tier: a code fix is optional and it does not block the merge on one, but an answer is required before merge — addressed, disputed, deferred, or duplicate.
1 participant
Problem
A bridge-capable provider must not execute with access to the server's host credentials, control sockets, or another thread's runtime. Existing provider, terminal, Git and helper launch paths share that authority.
Change
Add an opt-in, dedicated Linux service profile with immutable operator configuration and an exclusive custody identity. Supported Codex sessions receive private filesystem, process, network, environment and descriptor views; unsupported topology, providers and host execution paths return typed isolation refusals. A trusted pidfd supervisor owns startup and descendant cleanup, while per-thread homes, workspace leases and provider identities keep concurrent sessions separate.
The runtime has a credential-free proxy restricted to provider HTTPS endpoints. A bounded offline
bridge-auth login|status|logoutcommand uses the same full admission and private per-thread home, allowing device login without importing host credentials. The PR includes the owner-requested Skald discovery files and maintainer setup instructions. Binding issuance and dispatcher integration remain the later ATLI-350–352 tasks.Scope and approval
Work item: ATLI-349
The owner approved revision 2, digest
sha256:b600254259d99be82269be5ec69d4fce1b747ec820e2a60203d7baa54d467812, with automatic merge authorized. This PR is bound toatlitech/t3code, baseatli; the task and parent approval declareauth-security,secrets-identity,guard-loosening,public-contract, andreview-roster. The two bootstrap configuration files are expressly included in that approval.Verification
Production service installation/admission and real OAuth/TLS traffic were not exercised. No live T3 state, deployment, activation or release was changed.
Planning and review: GPT-6 Astra. Implementation: GPT-6.1 Sol. Serialized validation: GPT-6 Luna. Harness: Codex in T3 Code.