Why: EXT-16 abstracts the interpreter launch point into an ExecBackend port so execution can return behind isolation: direct = byte-identical status quo, sandbox = bwrap (ro system root, tmpfs over /home and /tmp, session/skills-only writable mounts, no network, ulimit -u 256 fork cap, timeout kills the namespace). Config: execBackend key, AGENT_SYSTEM_EXEC_BACKEND, --exec-backend; extension.Options.ExecBackend (SurfaceVersion 2.6.0-experimental). DisableExecTools stays the top-priority fail-closed switch; RDM keeps it true until G3-7.
Evidence (task card .task/feature-ext-16-exec-backend.md, rows by make evidence): Dev make test green at this head; local escape negatives all blocked (home secret, sibling session, network, 400-proc spawn storm, 60s-sleep killed at 3s, orphans die with namespace) — bwrap 0.11.1, skip-guarded where bwrap is absent; Backend #119 head CI success (GATE).
Impact: umbrella gitlink only (modules/backend 1a55089). Workflow ScriptCommand and squad ExecConfig stay direct (follow-up scope).
Why: EXT-16 abstracts the interpreter launch point into an ExecBackend port so execution can return behind isolation: direct = byte-identical status quo, sandbox = bwrap (ro system root, tmpfs over /home and /tmp, session/skills-only writable mounts, no network, ulimit -u 256 fork cap, timeout kills the namespace). Config: execBackend key, AGENT_SYSTEM_EXEC_BACKEND, --exec-backend; extension.Options.ExecBackend (SurfaceVersion 2.6.0-experimental). DisableExecTools stays the top-priority fail-closed switch; RDM keeps it true until G3-7.
Evidence (task card .task/feature-ext-16-exec-backend.md, rows by make evidence): Dev make test green at this head; local escape negatives all blocked (home secret, sibling session, network, 400-proc spawn storm, 60s-sleep killed at 3s, orphans die with namespace) — bwrap 0.11.1, skip-guarded where bwrap is absent; Backend #119 head CI success (GATE).
Impact: umbrella gitlink only (modules/backend 1a55089). Workflow ScriptCommand and squad ExecConfig stay direct (follow-up scope).
Refs: proposal modules/documents docs/proposals/2026-10-09-ext-g1-b1-b3-exec-backend.md §4 (EXT-16); Backend #119/#110.
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-ext-16-exec-backend.md; R0=13e03ab15d89d13e0b1cc6848d76776c723a6f96.
Impact: task metadata only; the feature workspace starts at 13e03ab15d.
Refs: .task/feature-ext-16-exec-backend.md
Why: EXT-16 abstracts the interpreter launch point into an ExecBackend
port (direct = byte-identical status quo; sandbox = bwrap isolation:
ro root, tmpfs /home+/tmp, session/skills-only writable mounts, no
network, ulimit -u fork cap, timeout kills the namespace) with config
key execBackend, env AGENT_SYSTEM_EXEC_BACKEND, CLI --exec-backend and
extension.Options.ExecBackend (SurfaceVersion 2.6.0-experimental).
DisableExecTools stays the top-priority fail-closed switch; RDM keeps
DisableExecTools=true until G3-7.
Evidence: Backend #119 head 4badecb vet-and-test CI success, merged as
1a55089; local escape negatives all blocked (home secret, sibling
session, network, 400-proc spawn storm, 60s-sleep timeout kill,
orphan die-with-namespace) recorded in the task card evidence rows;
full make test at this head recorded on the card.
Impact: umbrella gitlink only; no source edits outside modules/backend.
Refs: proposal modules/documents docs/proposals/2026-10-09-ext-g1-b1-b3
(EXT-16); Backend #119; Backend #110 (DisableExecTools).
Why: the EXT-16 acceptance is escape-negative driven; the tool-written
evidence row captures the local bwrap run (all probes blocked, product
task visible) and the card summary states scope and follow-ups.
Evidence: go test -run 'TestSetExecBackendValidation|TestSandboxArgvShape|
TestSandbox|TestDirect' via CMD=... make evidence exit 0 (10 tests,
bwrap 0.11.1); make test row recorded earlier at this head.
Impact: task card only.
Refs: proposal 2026-10-09-ext-g1-b1-b3 (EXT-16); Backend #119.
Why: git receive-pack runs 'gc --auto' in the background after a push;
the fixture's TemporaryDirectory teardown then races the gc writer and
fails with OSError 39 (remote.git not empty) — observed on the PR #285
runner (job 1967). The fixture remote holds no durable value, so auto-gc
is pure flake surface.
Evidence: the failing test passes 5/5 locally after the fix; full
make test-governance green (104 tests).
Impact: test fixture only; no governance-script behavior change.
Refs: Dev CI run 1438 job 1967; same race family as the upload-host
TempDir flake fixed earlier.
weichen
merged commit 7d52861f15 into main2026-10-09 17:14:11 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Why: EXT-16 abstracts the interpreter launch point into an ExecBackend port so execution can return behind isolation: direct = byte-identical status quo, sandbox = bwrap (ro system root, tmpfs over /home and /tmp, session/skills-only writable mounts, no network, ulimit -u 256 fork cap, timeout kills the namespace). Config: execBackend key, AGENT_SYSTEM_EXEC_BACKEND, --exec-backend; extension.Options.ExecBackend (SurfaceVersion 2.6.0-experimental). DisableExecTools stays the top-priority fail-closed switch; RDM keeps it true until G3-7.
Evidence (task card .task/feature-ext-16-exec-backend.md, rows by make evidence): Dev make test green at this head; local escape negatives all blocked (home secret, sibling session, network, 400-proc spawn storm, 60s-sleep killed at 3s, orphans die with namespace) — bwrap 0.11.1, skip-guarded where bwrap is absent; Backend #119 head CI success (GATE).
Impact: umbrella gitlink only (modules/backend 1a55089). Workflow ScriptCommand and squad ExecConfig stay direct (follow-up scope).
Refs: proposal modules/documents docs/proposals/2026-10-09-ext-g1-b1-b3-exec-backend.md §4 (EXT-16); Backend #119/#110.