Repository navigation

custody: role isolation behind [security].role_isolation (X-1, N-6, N-7, G-5; ADR-2122) - #12

Merged

jjohare merged 68 commits into

mainfrom

custody/integration

Oct 3, 2026

Merged

custody: role isolation behind [security].role_isolation (X-1, N-6, N-7, G-5; ADR-2122)#12
jjohare merged 68 commits into
mainfrom
custody/integration

Commits on Oct 3, 2026
- docs(security): prompt egress register (N-7), rendered from egress-policy.json
  
  claude
  and
  jjohare
  committed
  a10f336
- docs(adr): re-verify ADR-2013 and ADR-2026 after the egress register
  
  claude
  and
  jjohare
  committed
  2f06596
- docs(adr): ADR-2103 re-verified after the chain-event announce change
  
  claude
  and
  jjohare
  committed
  7d5fd47
- test(runtime-contract): RC-X1-01..05, red: the three custody bypasses (W0)
  
  claude
  and
  jjohare
  committed
  495f29c
- test(pod-bridge): pin the live-mirror child key to the JS derivation (G-5)
  
  claude
  and
  jjohare
  committed
  35f5466
- docs(config): b4165401 is the operator's decision signer, not visionclaw-server (Q15)
  
  claude
  and
  jjohare
  committed
  d3ff8e9
- docs(adr): re-verify nine records at d3ff8e9a8 (G-5 Q15 comment correction, mirror KAT dep)
  
  claude
  and
  jjohare
  committed
  710ec7b
- docs(closeout): G-5 key-split owner handoff — Q15 answered, minting held on D1-D3
  
  claude
  and
  jjohare
  committed
  bf5dc34
- fix(entrypoint): root boot PATH is store-only and Stage B is one-shot (custody W0, bypass 2)
  
  claude
  and
  jjohare
  committed
  b44e78b
- fix(image)!: devuser leaves group root (custody W0; REBUILD to apply, REBUILD to undo)
  
  claude
  and
  jjohare
  committed
  8070c10
- docs(closeout): G-5 handoff — D2 decided, the operator creates K_admin in NIP-07
  
  claude
  and
  jjohare
  committed
  59379c8
- feat(security): flag-gated Docker socket and a GET-only read proxy (custody W0, bypass 1)
  
  claude
  and
  jjohare
  committed
  6a433e6
- test(custody): X-1 role-isolation rehearsal, red on today's image (W6a)
  
  claude
  and
  jjohare
  committed
  3cd5614
- docs(closeout): X-1 rehearsal baseline on today's image — STAGED, 35 rows would fail
  
  claude
  and
  jjohare
  committed
  bbdf41d
- test(custody): G-5 dual-admit verifier tests driven by public keys in config
  
  claude
  and
  jjohare
  committed
  30e3341
- test(pod-bridge): pin the live-mirror child key to the JS derivation (G-5)
  
  claude
  and
  jjohare
  committed
  86fc90e
- feat(security): role service accounts, a root-owned /run/secrets and the isolated supervisor config (custody W1)
  
  claude
  and
  jjohare
  committed
  b8c6662
- feat(manifest): [security].role_isolation, off (custody W1, ADR-2122)
  
  claude
  and
  jjohare
  committed
  49961f8
- feat(pod-bridge): the identity port — serve-identity and sign-request (custody W3)
  
  claude
  and
  jjohare
  committed
  a44ea41
- feat(pods): sign through the identity port under role_isolation (custody W3)
  
  claude
  and
  jjohare
  committed
  9e87ae4
- chore(supervisor): identity-port program block as a fragment for W1 (custody W3)
  
  claude
  and
  jjohare
  committed
  26fc543
- docs(adr): re-verify ADR-2030 and ADR-2078 against the identity port (custody W3)
  
  claude
  and
  jjohare
  committed
  3d94152
- feat(image): ship config/role-accounts.json at /etc/agentbox for the rehearsal (custody W1)
  
  claude
  and
  jjohare
  committed
  055c06f
- fix(rehearsal): check (c) targets the identity port W3 built (custody W3 follow-up)
  
  claude
  and
  jjohare
  committed
  57ea350
- merge: rehearsal (c) targets the identity port (custody W3)
  
  claude
  and
  jjohare
  committed
  ba64109
- docs(adr): ADR-2122 role service accounts, /run/secrets and the identity port (proposed, partial, inactive)
  
  claude
  and
  jjohare
  committed
  4a81144
- Merge remote-tracking branch 'origin/custody/w0-bypasses' into custody/integration
  claude
  committed
  dcc1365
- merge: custody/w1-role-accounts (custody W1)
  
  claude
  and
  jjohare
  committed
  652b536
- Merge remote-tracking branch 'origin/custody/w3-identity-port' into custody/integration
  claude
  committed
  882065b
- merge: custody/w7a-egress-register (custody N-7)
  
  claude
  and
  jjohare
  committed
  668e8ed
- merge: custody/w8-key-split (custody G-5)
  
  claude
  and
  jjohare
  committed
  50cd534
- test(custody): env-secret inventory and RC-X1-06, red: role secrets in every process's env (W2)
  
  claude
  and
  jjohare
  committed
  0965a9c
- fix(security): the role supervisor config is /etc/supervisord.roles.conf (custody integration)
  
  claude
  and
  jjohare
  committed
  760ed01
- feat(security): ROLE secrets leave PID 1's environment under role_isolation (custody W2, bypass 3)
  
  claude
  and
  jjohare
  committed
  0421154
- fix(rehearsal): read W1's role table and plan; drop the derived numbering (custody integration)
  
  claude
  and
  jjohare
  committed
  860f58f
- feat(sidechain): the producer runs a read-only bake of upstream-pins (custody W5)
  
  claude
  and
  jjohare
  committed
  e103f81
- docs(adr): ADR-2103 re-verified — the producer runs the baked upstream (custody W5)
  
  claude
  and
  jjohare
  committed
  a75491d
- fix(security): align the W2 env scrub with W1's delivery plan (custody W2 on W1)
  
  claude
  and
  jjohare
  committed
  275e123
- docs(security): environment classes, ADR-2122 §3a (W2 env scrub), and 23 re-verified records
  
  claude
  and
  jjohare
  committed
  1472d60
- feat(browsercontainer): pin and verify the Podkey CI artefact
  
  claude
  and
  jjohare
  committed
  53079e9
- feat(browsercontainer): ship Podkey, keep the Chrome profile on a volume
  
  claude
  and
  jjohare
  committed
  7c10e50
- feat(security): serve-identity under ab-identity; the socket group comes from the role table (custody integration)
  
  claude
  and
  jjohare
  committed
  b49c622
- docs(adr): fold the identity port (W3) and the integration resolutions into ADR-2122
  
  claude
  and
  jjohare
  committed
  3a33a1b
- docs(manifest): role-accounts group help names the shared groups (custody integration)
  
  claude
  and
  jjohare
  committed
  9287724
- test(custody): shellcheck-clean W1's boot and supervisor tests (custody integration)
  
  claude
  and
  jjohare
  committed
  f65e726
- merge: custody/w5-producer-bake (custody W5)
  
  claude
  and
  jjohare
  committed
  71b4972
- merge: custody/w2-env-scrub (custody W2, bypass 3)
  
  claude
  and
  jjohare
  committed
  6bd3da7
- fix(custody): W2's inventory knows the identity port; the rehearsal classifies by W2's ROLE class (custody integration)
  
  claude
  and
  jjohare
  committed
  31aa27f
- Merge remote-tracking branch 'origin/custody/w9-sidecar-podkey' into custody/integration
  claude
  committed
  5034fde
- test(rehearsal): devuser can neither rename the socket's directory nor plant one beside it (custody integration)
  
  claude
  and
  jjohare
  committed
  ab55fbf
- fix(entrypoint): shellcheck SC2174 in W2's role-env capture (custody integration)
  
  claude
  and
  jjohare
  committed
  3b54129
- docs(adr): re-verify 25 records at the custody integration head (3b5412963)
  
  claude
  and
  jjohare
  committed
  d03defb
- fix(ci): clippy and statix clean on the custody integration head
  
  claude
  and
  jjohare
  committed
  32cedf9
- docs(adr): re-verify 11 records after the CI fix (32cedf992)
  
  claude
  and
  jjohare
  committed
  fba7fb1
- docs(custody): describe what the role-isolation branch enforces, and how the owner turns it on
  
  claude
  and
  jjohare
  committed
  31a54c2
- docs(adr): re-verify ADR-2118 after the custody docs pass (31a54c2f3)
  
  claude
  and
  jjohare
  committed
  c1a6586
- fix(custody): compose passes no ROLE-class secret through environment:
  
  claude
  and
  jjohare
  committed
  248d36f
- fix(rehearsal): check (d) takes chains from the manifest tables and the plan
  
  claude
  and
  jjohare
  committed
  e54bde5
- ci(custody): run the RC-X1 suites, the identity port and the rehearsal
  
  claude
  and
  jjohare
  committed
  e9f5cd6
- fix(custody): devuser loses wheel and its NOPASSWD drop-in under role isolation
  
  claude
  and
  jjohare
  committed
  dc91e09
- docs(adr): ADR-2122 records the W10 gap fixes; re-verify 16 records (dc91e092a)
  
  claude
  and
  jjohare
  committed
  3629d91
- feat(security): at-rest custody migrate/revert and the sidechain state move (custody W2b, W4)
  
  claude
  and
  jjohare
  committed
  f93586b
- docs(adr): re-verify 18 records after the at-rest custody and state move (f93586b9e)
  
  claude
  and
  jjohare
  committed
  0dc1aca
- merge: custody/w2b-r (custody W2b, W4: at-rest migrate/revert, sidechain state move)
  
  claude
  and
  jjohare
  committed
  2952469
- fix(custody): shellcheck-clean the W2b/W10 scripts (SC2034)
  
  claude
  and
  jjohare
  committed
  ad5d0b9
- docs(adr): re-verify ADR-2122 after the shellcheck fix (ad5d0b91a)
  
  claude
  and
  jjohare
  committed
  e1dbf9d
- test(custody): the migrate and host-half tests pass off-container (CI runner uid 1001, a VM)
  
  claude
  and
  jjohare
  committed
  5c787fe
- docs(adr): re-verify ADR-2122 after the CI-portability test seam (5c787fedc)
  
  claude
  and
  jjohare
  committed
  e41358c

Commits

Commits on Oct 3, 2026