Repository navigation
Qualify real managed writable execution for Cursor, Claude Code, and Gemini CLI #693
Description
Proposal
Qualify one substantive terminal-Worker managed-worktree execution route for each registered Cursor, Claude Code, and Gemini CLI runtime. Admit a route only through a versioned, verified launch contract with supervisor-owned result and usage evidence. Retain explicit refusal for combinations that have not been qualified.
Background
At main revision 43d5bec351032848af141e1a4fde06c88a3a32ce, all three runtimes are selectable adapters, but their descriptors retain SideEffectConfinement::Unverified and UsageReporting::None in src/runtime_adapter/capabilities.rs. worktree_writable_refusal rejects unverified confinement. These restrictions are unchanged in the nested-execution candidate 6cc23fcd69cb7ed0e1f75ccd3c4e940294610141.
#328 accepted a documented and tested durable refusal as an alternative to usable writes. This proposal is the follow-up for actual execution; it does not invalidate that closure or imply that installing or authenticating a CLI is sufficient. Existing read-only audit dispatch is a separate capability.
Acceptance
- For each runtime, bind the actual CLI version, executable, supported model/effort, rendered arguments, cwd, declared paths, output schema and no-delegation contract to the selected launch. Configuration or catalog membership alone must not grant writable authority.
- Demonstrate a bounded substantive assignment under Linux managed containment, with actual tracked edits confined to the candidate, authentic command/result observations, complete observed usage, independent acceptance and no surviving owned process after terminal settlement.
- Exercise negative cases for widened paths, incompatible launch contracts, missing or mismatched identity/usage, invalid result schema and attempted native delegation. Missing evidence must remain a typed refusal or failed run.
- Preserve primary-worktree publication restrictions, Codex/Fake contracts, exact budget settlement and independent review. Qualifying a terminal Worker does not grant orchestrator, callback or publication authority.
- Document the exact supported runtime/protocol/model lanes and remaining refused combinations. Keep source tests, real-provider qualification and production cost claims distinct.
Advantages
The registered runtime choices can support useful isolated work instead of stopping at capability admission. Explicit qualification also makes the supported delegation routes identifiable without weakening existing safety gates.
Disadvantages and costs
Three CLI protocols require separate launch, result and usage handling, version compatibility checks and maintenance. Real qualification requires authenticated capacity for each runtime and consumes provider usage; deterministic transport tests cannot replace those receipts. No capacity or cost comparison is implied by this proposal.
Affected scope
src/runtime_adapter/, src/external_agent.rs, supervised assignment integration, relevant contract tests and operator documentation. Grok qualification remains tracked in #616 and #688; durable target receipt evidence remains tracked in #660.
Activity
Meta-Develop commentedon Sep 28, 2026
A source-bound Claude hosted-callback obstacle is identified at controller revision
7cde662f343cf49f7aae43ea281166bd45134550.hosted_callback.rswrites its journal before emitting the permission decision underset -eu, while attachment verification promotes coverage from files and matcher configuration. A journal-write error exits without a decision. Official command-hook semantics make ordinary hook errors and timeouts nonblocking, so attachment alone cannot establish effective interception or argument/path authorization.The installed Claude Code 2.1.137 engine contains SDK callback registration, but
createHookCallbackcatches a rejected control request and returns an empty decision. A disconnected callback cannot be assumed to deny an otherwise approved action on this pin. This is executable-source evidence, not a live runtime test; newer SDK documentation does not establish this pin's behavior.For a hosted All claim, the minimum prerequisite is a compatible source-bound callback contract that denies before an action on error, malformed response, timeout, EOF or host loss. A shell exit-code fix or SDK replacement alone is insufficient. Keep that optional coverage unverified.
Managed-child writes are a separate contract:
RuntimeCapabilities::worktree_writable_refusalexplicitly requires verified side-effect confinement without requiring hosted All. The callback defect therefore does not make an All repair a prerequisite for every contained Claude Worker. The managed route is being evaluated through a constrained native launch, Linux containment and private raw stream observations. Whole-invocation usage/identity and genuine scoped execution remain unproven; no writable capability is promoted here.Primary references: hook semantics, SDK hooks, permission ordering.