Repository navigation
acq: host-authoritative sandbox config — migrate guest-writable state off /var/lib/acq (ADR-0030) #503
Description
Goal
Complete the host-authoritative lifecycle migration: acq must not make configuration or lifecycle decisions from guest-writable state. Because sandbox agents have passwordless sudo, guest ownership is not a trust boundary.
The provider-input path delivered by #600 and #601 is the proven pattern:
host validates state
→ host materializes immutable generation
→ guest receives read-only mount or host-side exec injection
→ acq trusts host state only
Delivered Slice
- Host config directory helpers and read-only mounts.
- Provider facts/catalog projection and immutable generations.
- Host-side provider selection provenance, including authoritative empty sets.
- Several host-authoritative agent/workspace/SSH/kit-environment and readiness paths.
Remaining Scope
Migrate every remaining guest-writable /var/lib/acq/* marker or guest-resident restart artifact that acq trusts:
- Session identity/state: agent, workspace, SSH socket, and kit environment where backend parity is incomplete.
- Provisioning/readiness gates: install, agent-ready, OCI, and related presence gates.
- Trusted restart execution: stage pinned startup code in host config and invoke it from the read-only path.
- Remove legacy guest-marker reads after migration, with compatibility/migration handling for existing sandboxes.
- Offline focused SBX/MSB coverage plus real host validation for each migrated slice.
Constraints
- No host execution of kit-supplied code.
- Do not remove passwordless sudo; change what acq trusts instead.
- Preserve fail-soft behavior only where it cannot create a trust bypass.
- New trusted state must be host-resident and read-only in the guest, or injected by acq at exec time.
Priority
This is the next major security/release work after the provider-neutral OpenCode adoption path. Future provider refresh and new harness work should build on this complete lifecycle trust boundary.
AI-assisted tracker re-scope (OpenCode). Human review required.
Activity
docs(adr): add ADR-0035 host-authoritative sandbox configuration (#504)
feat(sbx): trust host state for built-in kit heal; add MSB forged-mar…
mogul commentedon Oct 28, 2026
Closing as delivered for this round. The remaining scope is tracked below, so nothing is lost.
Delivered
builtin-kitsrecord instead of guest probes (feat(sbx): trust host state for built-in kit heal; add MSB forged-marker and legacy-sandbox coverage #637).ro-host-configrecord,msb inspectshowing exactly one read-only Bind at the host-config path with no writable overlap, and msb 0.7.7 or newer. Seedocs/adr/0035-host-authoritative-sandbox-config.mdfor what this proves and does not (it trusts msb upstream for enforcement; the optional canary corroborates it).Remaining scope (tracked)
PATTERNS_KIT_REFto the Patterns release that marks root startup scriptsreadonly: true(blocked on the Patterns 1.18.0 release).jqCRLF (separate defect).AI-assisted tracker entry (OpenCode). Human review required.