From 61cd36a64cbf463dd4951bce0afa314664ff0cbf Mon Sep 17 00:00:00 2001 From: Error Lover Date: Sat, 1 Aug 2026 02:09:31 +0300 Subject: [PATCH 1/2] docs: select sandbox and freeze R7 protocol --- docs/BUILD_LOG.md | 9 ++ docs/PROJECT_STATE.md | 11 +- docs/v0.3/ADR-003-DOCKER-DESKTOP-SANDBOX.md | 93 ++++++++++++++++ docs/v0.3/R7_PREREGISTRATION.md | 111 ++++++++++++++++++++ docs/v0.3/README.md | 20 ++-- 5 files changed, 231 insertions(+), 13 deletions(-) create mode 100644 docs/v0.3/ADR-003-DOCKER-DESKTOP-SANDBOX.md create mode 100644 docs/v0.3/R7_PREREGISTRATION.md diff --git a/docs/BUILD_LOG.md b/docs/BUILD_LOG.md index d9dbf84..eedc26e 100644 --- a/docs/BUILD_LOG.md +++ b/docs/BUILD_LOG.md @@ -2,6 +2,15 @@ This is a concise chronological record of material implementation work and runtime evidence. It is not a substitute for Git history; it captures intent, verification, and blockers that a commit alone may not explain. +## 2026-07-31 — R7 sandbox selection and corpus preregistration + +- Selected digest-pinned Linux containers through Docker Desktop/WSL2 as the first replaceable Phase-B backend in ADR-003. The decision fixes prerequisite detection, explicit provisioning, mount policy, read-only oracle delivery, resource limits, cancellation/cleanup, image identity, and fail-closed behavior. +- Started Docker Desktop through its supported CLI and ran a real disposable Windows capability audit against `node@sha256:b04ce4ae4e95b522112c2e5c52f781471a5cbc3b594527bcddedee9bc48c03a0`. The probe observed network failure under `network=none`, read-only root, no undeclared mounts, `EROFS` on the oracle with unchanged host hash, 128 MiB/0.5 CPU/64 PID limits, all capabilities dropped, `no-new-privileges`, terminal container kill, and exact removal. +- Froze the R7 sampling and analysis protocol before compiler outcomes: deterministic first-parent eligibility, 30 patches across at least three repositories, hash-assigned 12-patch development and 18-patch held-out sets, two independent human raters, Wilson intervals, adversarial cases, thresholds, and explicit narrowing rules. +- No Docker `SandboxRunner`, corpus patch, compiler result, or human rating exists yet. Arbitrary code remains disabled and R7 has not passed. + +Evidence: `docs/v0.3/ADR-003-DOCKER-DESKTOP-SANDBOX.md`, `docs/v0.3/R7_PREREGISTRATION.md`, local Docker Desktop/Engine/image inspection, and the disposable capability output recorded in ADR-003. + ## 2026-07-31 — R4.5 fixture-only Control Pulse accepted - Implemented exact bounded Change Claim, participant/internal probe, Side Coach capsule/proposal, attempt, and result contracts. Claim, probe, attempt, command result, and probe result identities use their normative domain-separated hashes. diff --git a/docs/PROJECT_STATE.md b/docs/PROJECT_STATE.md index 1f446b5..2292917 100644 --- a/docs/PROJECT_STATE.md +++ b/docs/PROJECT_STATE.md @@ -2,7 +2,7 @@ Last updated: 2026-07-31 -## Current branch milestone — R4.5 fixture-only Control Pulse accepted +## Current branch milestone — R7 sandbox selected and corpus protocol frozen Branch `codex/shadow-cockpit-rnd` resets the product R&D thesis around **Dual-Control Development**. @@ -27,6 +27,9 @@ Branch `codex/shadow-cockpit-rnd` resets the product R&D thesis around **Dual-Co - R4.5 now implements bounded `ChangeClaim`, participant/internal probe, Side Coach capsule/proposal, attempt, and result contracts with exact schemas and domain-separated hashes. The deterministic no-model path commits a developer prediction before observation and resolves only one extension-owned fixture state/check pair. - Participant serialization contains no fixture binding, command, state, revision, oracle, controller handle, or production path. Capsule construction reopens only participant-visible project evidence, caps and scrubs excerpts, and treats every model proposal as non-executable text plus an optional existing input ID. - Six R4.5 tests cover cross-platform golden claim/probe/attempt hashes, strict projection and catalog isolation, unstable/cross-project/hidden/malformed evidence rejection, capsule path/secret/ID redaction, precommitted prediction, prose-invariant observation, replay/late/identity failures, and timeout/cancellation/runner-error invalidation. The full local Windows extension suite passes 63/63; `npm run check`, production build, and VSIX packaging pass. Protected PR #15 run `30671499103` passed `extension`, `extension-windows`, `contract`, `web`, and `jules-rnd-policy`, so R4.5 acceptance is complete. +- ADR-003 selects digest-pinned Linux containers through Docker Desktop/WSL2 as the replaceable Phase-B backend. A real local Windows probe verified outbound network failure, a read-only root, zero undeclared mounts, an unchanged `EROFS` oracle, memory/CPU/PID limits, dropped capabilities, `no-new-privileges`, descendant-container kill, and exact removal on Docker Desktop 4.61 / Engine 29.2.1. +- `R7_PREREGISTRATION.md` freezes the repository/patch sampling algorithm, eligibility and exclusions, 12/18 development/held-out split, two-rater protocol, metrics, confidence intervals, adversarial cases, thresholds, and narrowing rules before corpus outcomes are inspected. +- The Docker `SandboxRunner` itself and the 30-patch corpus are not implemented. The local primitive probe is backend-selection evidence, not permission to execute arbitrary participant or repository code. - The readiness ledger and v0.3 cockpit do not exist yet. R0–R4.5 remain a closed reviewed-fixture mechanism and do not execute arbitrary participant or workspace code. - No skill-retention or speed metric has been measured. Values in the PRD are predeclared R&D targets. - A new implementation audit found five R0 ambiguities: candidate-diff identity, pre-store fixture blobs, runtime identity, check IDs, and Git object format. The normative contract closes them with structured diffs, catalog-owned blobs, standalone Node `v22.17.0`, declared test IDs, and SHA-1 Git initialization; R0a/R0b now implement and verify that complete substrate. @@ -125,7 +128,7 @@ The repository contains no verified evidence that the owner submitted the final | Input | Impact | Resolution | | --- | --- | --- | | The first live adapter is selected but no accessible Codex CLI is configured for this checkout | ADR-006 selects Codex App Server over local stdio, but the Microsoft Store packaged executable discovered here returns `Access denied` when launched from the repository shell | Keep replay R&D independent; the live spike must preflight a separately accessible, exact-version user-installed Codex CLI and fail closed when unavailable | -| Untrusted-code sandbox backend is not selected | R7 corpus and human pilots cannot execute third-party or arbitrary participant code; R0–R4.5 can validate only finite reviewed fixture states, controller-owned repair, and catalog probes | After the fixture slice, select and verify a Windows-capable backend in a separate ADR; never fall back to direct execution | +| Docker backend is selected but `SandboxRunner` is not implemented or protected-tested | R7 corpus and human pilots still cannot execute third-party or arbitrary participant code; R0–R4.5 remain fixture-only | Implement ADR-003 request validation, digest catalog, mounts, consent, evidence, timeout/cancel, and Linux/Windows capability tests; never fall back to host execution | | Technical patch corpus is not assembled | Automatic episode-generation rate cannot be measured | Collect at least 30 consented or open-source test-backed TypeScript patches for R7 | | Human participants are not recruited | Takeover and delayed-transfer claims cannot be tested | Complete the technical gate, then recruit for the preregistered pilot | | Default-branch Jules scheduler awaits explicit merge approval | Scheduled/manual continuation is not installed on `main`; draft PR #8 remains isolated and the enable variable stays off | Owner explicitly says `merge #8`; then merge through protected `main`, remove the temporary infrastructure branch, and run one guarded canary through the protected R&D branch | @@ -145,8 +148,8 @@ No external input blocks the repository-owned fixture R0–R4.5 mechanism in `do ## Next ordered actions -1. Run the 30-patch recovery-plus-probe technical corpus audit before expanding the product surface. -2. Select and verify the Windows-capable Phase-B sandbox required by R7; fail closed if none meets ADR-003. +1. Implement and protected-test the ADR-003 Docker `SandboxRunner` without a host-execution fallback. +2. Collect and freeze the preregistered 30 eligible patches, then run the recovery-plus-probe audit. 3. Add the local readiness ledger and minimal cockpit only after the R7 gate passes. 4. Run the preregistered delayed-transfer pilot before making any skill-retention claim. diff --git a/docs/v0.3/ADR-003-DOCKER-DESKTOP-SANDBOX.md b/docs/v0.3/ADR-003-DOCKER-DESKTOP-SANDBOX.md new file mode 100644 index 0000000..3c155b8 --- /dev/null +++ b/docs/v0.3/ADR-003-DOCKER-DESKTOP-SANDBOX.md @@ -0,0 +1,93 @@ +# ADR-003 — Phase-B sandbox backend + +**Status:** selected for R7 implementation; local Windows capability probe passed, corpus execution not started +**Date:** 2026-07-31 + +## Decision + +Use Linux containers in Docker Desktop on Windows through its WSL2 backend as the first `SandboxRunner`. Linux CI uses the same Docker Engine contract. PureFlow addresses the image by digest and invokes the Docker CLI as an argument array; it does not build a container runtime, accept a socket from participant code, or fall back to host execution. + +The first toolchain is: + +```text +node@sha256:b04ce4ae4e95b522112c2e5c52f781471a5cbc3b594527bcddedee9bc48c03a0 +Node 22.17.0 / Debian bookworm-slim +``` + +The digest is an implementation-owned catalog value. A tag is allowed only during explicit provisioning; every execution reopens the local image by digest and verifies its image identity. An offline R&D machine may import a controller-provided `docker save` archive only after its resulting digest matches the catalog. + +Docker Desktop is an R&D prerequisite, not a bundled PureFlow dependency. If the daemon, Linux engine, exact image, or any capability probe is unavailable, `SandboxRunner.capabilities()` returns a false capability and arbitrary code remains disabled. + +## Why this backend + +- It supplies the same Linux process and filesystem model on the current Windows workstation and Linux CI. +- `--network none`, a read-only root filesystem, read-only bind mounts, tmpfs, dropped capabilities, `no-new-privileges`, memory/CPU/PID limits, and container-scoped kill/remove map directly to the five normative capabilities. +- The current machine already has Docker Desktop and WSL2. No hidden VM installer or privileged helper must be added by PureFlow. +- It is replaceable behind `SandboxRunner`; the Experience Compiler, judge, and evidence contracts do not gain Docker-specific fields. + +Docker containers are not treated as a proof against a compromised Docker daemon, host administrator, kernel exploit, or a participant with Docker API access. PureFlow never mounts the Docker socket, home directory, production checkout, extension storage, credential stores, device paths, or parent directories. + +## Prerequisite detection + +The runner must fail closed unless all checks pass: + +1. `docker desktop status` reports running on Windows; Linux requires a reachable Docker Engine. +2. `docker version` reports a Linux server and a supported API version. +3. `docker image inspect ` resolves exactly the catalog digest. +4. A disposable capability probe verifies network-none, root read-only, zero undeclared mounts, read-only oracle behavior, resource limits, kill, and removal. +5. Per-project execution consent is current and the VS Code workspace is trusted. + +Provisioning is an explicit owner action: start Docker Desktop and pull or import the pinned image. PureFlow must never silently install Docker, enable WSL/Hyper-V, switch container engines, accept a license, or pull a different tag during an episode. + +## Execution profile + +Every run starts a uniquely named container with: + +- `--network none` and no published ports; +- `--read-only`, `--tmpfs /tmp:rw,noexec,nosuid`, and no Docker socket; +- a sanitized snapshot mounted read-only at `/workspace`; +- only declared writable paths backed by bounded tmpfs mounts; +- only allowlisted oracle handles mounted read-only at canonical paths; +- `--cap-drop ALL`, `--security-opt no-new-privileges`, and an unprivileged numeric user; +- fixed memory, memory-swap, CPU, PID, and output/time limits; +- an empty environment plus controller-owned non-secret constants; +- the catalog toolchain entrypoint and registry-frozen argument array, never a shell string. + +The production checkout is never mounted. Input trees reject symlinks, junctions/reparse points, gitlinks, devices, alternate data streams, and unsupported file types before Docker sees them. + +## Cancellation and cleanup + +The controller records `executionId → exact container name/id` before user code starts. IDs are single-use. Cancellation calls `docker kill` only for that recorded container, waits for the terminal state, then removes it. Normal, failed, timed-out, and cancelled runs all verify removal. A missing or mismatched ID is rejected; cleanup never enumerates and removes containers by a broad name pattern. + +On Windows the container VM owns the process namespace, so killing the recorded container terminates its descendant tree. The capability suite also launches a real child process and verifies the container exits and is removed. Locked bind-mount cleanup remains an R7 Windows test. + +## Local Windows evidence + +On 2026-07-31 this workstation reported Docker Desktop `4.61.0`, Engine/CLI `29.2.1`, Linux kernel `6.6.87.2-microsoft-standard-WSL2`, and the pinned image digest above. A disposable probe observed: + +```json +{"network":"network-none","oracleWrite":"EROFS","oracleUnchanged":true,"networkMode":"none","readonlyRoot":true,"mountCount":0,"memory":134217728,"nanoCpus":500000000,"pidsLimit":64,"capDrop":"ALL","noNewPrivileges":"no-new-privileges","afterKill":"exited","removed":true} +``` + +This selects the backend and proves the five primitives on one Windows machine. It does not yet prove the `SandboxRunner` implementation, Linux parity, locked-file behavior, or safe execution of the 30-patch corpus. + +## Required implementation gate + +Before R7 may execute corpus or participant code: + +- implement exact `SandboxCapabilities`, `SandboxRequest`, `IsolatedCommand`, and `CommandResult` validators; +- prove no-network with an active outbound attempt, not container metadata alone; +- prove the mount allowlist and oracle hash before and after execution; +- test output truncation/redaction, timeout, concurrent runs, duplicate IDs, cancellation, descendant kill, locked files, and exact cleanup; +- run the same image and golden command-result vectors on protected Linux and Windows checks; +- record image provisioning separately from execution so tests never substitute an unpinned tag. + +If any required capability fails, the runner reports it false and R7 remains blocked. `TrustedFixtureRunner` remains the only executable path. + +## Primary references + +- [Docker Desktop WSL2 backend](https://docs.docker.com/desktop/features/wsl/) +- [Docker run reference](https://docs.docker.com/reference/cli/docker/container/run/) +- [Docker bind mounts and read-only mounts](https://docs.docker.com/engine/storage/bind-mounts/) +- [Docker Desktop CLI](https://docs.docker.com/desktop/features/desktop-cli/) + diff --git a/docs/v0.3/R7_PREREGISTRATION.md b/docs/v0.3/R7_PREREGISTRATION.md new file mode 100644 index 0000000..f53ca0a --- /dev/null +++ b/docs/v0.3/R7_PREREGISTRATION.md @@ -0,0 +1,111 @@ +# R7 technical corpus audit preregistration + +**Status:** frozen design; corpus not collected and outcomes not inspected +**Protocol version:** `r7-typescript-node-v1` +**Date:** 2026-07-31 + +## Question + +Can the frozen PureFlow compiler produce a causally relevant recovery episode and a bounded executable prediction probe from ordinary test-backed TypeScript patches without per-patch scenario code? + +R7 evaluates mechanism coverage and integrity. It does not estimate developer learning, productivity, market value, or skill retention. + +## Repository and patch sampling + +Use at least three open-source TypeScript/Node repositories with OSI-compatible licenses, local deterministic tests, and no credentials. Record the repository URL, license, pinned tip commit, package manager/runtime versions, and candidate-history command before eligibility inspection. + +For each repository, walk first-parent commits backward from the pinned tip. Consider at most the first 60 commits that change a `.ts` or `.tsx` source file and a test file. Apply the eligibility rules below without running PureFlow compilation. Stop after ten eligible patches per repository. If a repository yields fewer than ten, report it and add a replacement repository under the same rule before any compiler outcome is inspected. + +After 30 eligible patches exist, compute: + +```text +key = SHA-256("pureflow/r7-typescript-node-v1\n" + repository URL + "\n" + target commit) +``` + +Sort by `key`. The first 12 patches form the development corpus; the remaining 18 form the held-out corpus. Repository identity remains visible for setup but compiler outcomes stay hidden from expert relevance raters. + +## Eligibility frozen before outcomes + +A patch is eligible only when all conditions hold: + +- base and target are full adjacent first-parent commits; +- both install from a lockfile with the pinned runtime/package manager and pass the same declared deterministic test command in a clean network-enabled provisioning stage; +- the target changes at least one behavior-relevant TypeScript function, method, class, or module boundary supported by the frozen R2 extractor; +- at least one existing or patch-added deterministic test is attributable to that boundary; +- the patch needs no production credential, external service, browser, GPU, privileged device, or host daemon during execution; +- the execution stage can run with network none; +- dependency and lockfile changes are absent; +- generated files, snapshots larger than 1 MiB, vendored dependencies, submodules, symlinks, and platform-only native addons are absent; +- the relevant diff is at most 500 changed lines and the sanitized repository is at most 25 MiB after offline dependency provisioning; +- license and test artifacts may be used for this research audit. + +Every excluded candidate receives exactly one first matching exclusion code. Rules are never changed after the first compiler outcome is viewed. + +## Frozen support envelope + +The v1 compiler may use only: + +- R1 Flight Recorder-style task/change/command/test evidence reconstructed from Git and declared tests; +- the R2 TypeScript compiler-API extractor; +- existing test commands and controller-owned deterministic mutation operators; +- a sanitized standalone snapshot and immutable command registry; +- the digest-pinned ADR-003 sandbox with network none; +- deterministic heuristics frozen after the 12-patch development set. + +No patch-specific prompt, test, mutation, repair, oracle, command, path mapping, or exception may be added. Model prose may suggest a hypothesis but cannot supply executable material or determine pass/fail. + +## Outputs per eligible patch + +The compiler emits independently: + +1. one recovery episode or a typed no-episode reason; +2. one Explain-to-Break probe or a typed no-probe reason; +3. setup, execution, cleanup, timing, and disk evidence for three clean replays; +4. a strict participant projection and adversarial capsule result; +5. judge outcomes against the protected oracle. + +Development-set changes are limited to two compiler iterations. After iteration two, freeze the source commit and all configuration before revealing the held-out set. No held-out patch may trigger a code or configuration change. + +## Human rating + +Two independent experienced TypeScript engineers rate each eligible patch without seeing compiler success: + +- whether the selected seam is causally relevant to the changed behavior; +- the expected recovery oracle outcome; +- whether the probe falsifier tests the claimed invariant rather than syntax or trivia. + +Use binary judgments plus a short rationale. Report raw agreement and Cohen's kappa with a 95% bootstrap interval. A third adjudication record resolves disagreements but does not replace the pre-adjudication agreement result. AI agents may prepare packets, but they cannot count as either independent rater. + +## Primary metrics + +Report development and held-out results separately: + +- valid recovery episode rate; +- valid executable probe rate; +- three-run reproducibility rate; +- expert causal-relevance agreement; +- false-pass and false-fail rates; +- capsule rejection/leakage and unauthorized-execution counts; +- production-worktree writes and cleanup failures; +- median and interquartile setup time and disk cost. + +Use Wilson 95% intervals for binomial rates. Report every eligible patch in the denominator; typed compiler abstentions are failures for the corresponding validity rate. Report excluded candidates separately and never move them into the denominator after outcomes are known. + +## Gates + +- held-out valid recovery episodes: at least 80%; +- held-out valid probes: at least 70%; +- reproducible setup and judge result: at least 95%; +- expert-labeled outcome agreement: at least 90%; +- observed false passes, production writes, accepted leaks, and unauthorized executable inputs: zero; +- median setup after dependencies are present: under two minutes. + +If episode validity is below 60% or probe validity below 50% after the two development iterations, narrow to explicit invariant manifests, mutation-test operators, or test-backed API boundaries. Do not hide a miss by adding UI, streaks, scalar readiness, another model, or patch-specific rules. + +## Required parity and adversarial cases + +Run the held-out set on protected Linux and the selected Windows backend. Include paths with spaces, concurrent twins, cancellation, descendant processes, locked files, timeout, output overflow, exact cleanup, prompt/label/order drift, cross-project refs, replayed IDs, absolute paths, controller/oracle IDs, credential fixtures, and model proposals containing code, commands, arguments, mounts, or environment values. + +## Publication + +Publish aggregate metrics, all typed failures, exclusions, compiler freeze commits, environment identities, rater agreement, adjudications, and confidence intervals under `docs/v0.3/results/`. Raw third-party source is not copied into PureFlow; retain only repository URLs, commit IDs, bounded evidence hashes, measurements, and license metadata. diff --git a/docs/v0.3/README.md b/docs/v0.3/README.md index 60fc443..cad4579 100644 --- a/docs/v0.3/README.md +++ b/docs/v0.3/README.md @@ -10,21 +10,23 @@ PureFlow v0.3 asks whether an AI IDE can keep autonomous coding fast while behav 4. [`CONCEPTS.md`](CONCEPTS.md) — alternative architectures and selection. 5. [`ADR-001-DUAL-CONTROL.md`](ADR-001-DUAL-CONTROL.md) — system decision. 6. [`ADR-002-EXECUTION-PHASES.md`](ADR-002-EXECUTION-PHASES.md) — trusted-fixture slice versus the untrusted-code sandbox gate. -7. [`ADR-004-EPISTEMIC-CHECKPOINTS.md`](ADR-004-EPISTEMIC-CHECKPOINTS.md) — event-driven Control Pulses, Explain-to-Break, Side Coach, and honest motivation mechanics. -8. [`ADR-005-FLIGHT-RECORDER-NAME.md`](ADR-005-FLIGHT-RECORDER-NAME.md) — collision-free name and raw-ledger boundary. -9. [`ADR-006-CODEX-APP-SERVER-ADAPTER.md`](ADR-006-CODEX-APP-SERVER-ADAPTER.md) — first live runtime choice and portability path. -10. [`CONTRACTS.md`](CONTRACTS.md) — normative schemas, hidden-answer isolation, oracle integrity, and command boundary. -11. [`EXPERIMENTS.md`](EXPERIMENTS.md) — hypotheses, metrics, and kill criteria. -12. [`AGENT_EXECUTION.md`](AGENT_EXECUTION.md) — ordered implementation workstreams and acceptance gates. -13. [`JULES_LOOP.md`](JULES_LOOP.md) — guarded server-side execution queue for the audited R0–R4 slice. +7. [`ADR-003-DOCKER-DESKTOP-SANDBOX.md`](ADR-003-DOCKER-DESKTOP-SANDBOX.md) — selected Phase-B backend, capability evidence, and remaining gate. +8. [`ADR-004-EPISTEMIC-CHECKPOINTS.md`](ADR-004-EPISTEMIC-CHECKPOINTS.md) — event-driven Control Pulses, Explain-to-Break, Side Coach, and honest motivation mechanics. +9. [`ADR-005-FLIGHT-RECORDER-NAME.md`](ADR-005-FLIGHT-RECORDER-NAME.md) — collision-free name and raw-ledger boundary. +10. [`ADR-006-CODEX-APP-SERVER-ADAPTER.md`](ADR-006-CODEX-APP-SERVER-ADAPTER.md) — first live runtime choice and portability path. +11. [`CONTRACTS.md`](CONTRACTS.md) — normative schemas, hidden-answer isolation, oracle integrity, and command boundary. +12. [`EXPERIMENTS.md`](EXPERIMENTS.md) — hypotheses, metrics, and kill criteria. +13. [`R7_PREREGISTRATION.md`](R7_PREREGISTRATION.md) — frozen 30-patch sampling, metrics, and analysis protocol. +14. [`AGENT_EXECUTION.md`](AGENT_EXECUTION.md) — ordered implementation workstreams and acceptance gates. +15. [`JULES_LOOP.md`](JULES_LOOP.md) — guarded server-side execution queue for the audited R0–R4 slice. ## Current truth - The released v0.1 VSCodium IDE exists and remains the runtime baseline. -- The complete v0.3 Dual-Control product runtime is not implemented. R0 provides canonical hashing, fail-closed fixture contracts, the deterministic fixture, standalone hash-pinned runtime, external oracle, mutation, and exact repair. R1 adds the checked replay `AgentDriver` and append-only Flight Recorder. R2 adds deterministic Git/TypeScript change-evidence extraction and explicit fixture check linkage; protected PR #12 run `30666648522` passed the required Linux and Windows checks. +- The complete v0.3 Dual-Control product runtime is not implemented. R0–R4.5 implement and protect the reviewed-fixture path from canonical evidence through recovery judging and a precommitted Control Pulse. The readiness ledger, cockpit, arbitrary-code sandbox runner, corpus audit, and human pilot remain gated. - No retention, takeover, productivity, or usability target has been measured. - The first valid build is one test-backed vertical slice, not a full Cursor clone. -- R0–R4 may execute only finite, repository-owned fixture states. Arbitrary participant or corpus code remains blocked until ADR-003 selects and runtime-verifies a real sandbox backend. +- R0–R4.5 may execute only finite, repository-owned fixture states. ADR-003 selects Docker Desktop/WSL2 and records one local Windows primitive audit, but arbitrary participant or corpus code remains blocked until the exact `SandboxRunner` passes protected Linux/Windows tests. ## Architecture shorthand From 11c285ab50ce9c0dcff5565f1f057702725e0252 Mon Sep 17 00:00:00 2001 From: Error Lover Date: Sat, 1 Aug 2026 02:15:02 +0300 Subject: [PATCH 2/2] docs: record protected R7 protocol check --- docs/BUILD_LOG.md | 2 +- docs/PROJECT_STATE.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/BUILD_LOG.md b/docs/BUILD_LOG.md index eedc26e..a76194b 100644 --- a/docs/BUILD_LOG.md +++ b/docs/BUILD_LOG.md @@ -7,7 +7,7 @@ This is a concise chronological record of material implementation work and runti - Selected digest-pinned Linux containers through Docker Desktop/WSL2 as the first replaceable Phase-B backend in ADR-003. The decision fixes prerequisite detection, explicit provisioning, mount policy, read-only oracle delivery, resource limits, cancellation/cleanup, image identity, and fail-closed behavior. - Started Docker Desktop through its supported CLI and ran a real disposable Windows capability audit against `node@sha256:b04ce4ae4e95b522112c2e5c52f781471a5cbc3b594527bcddedee9bc48c03a0`. The probe observed network failure under `network=none`, read-only root, no undeclared mounts, `EROFS` on the oracle with unchanged host hash, 128 MiB/0.5 CPU/64 PID limits, all capabilities dropped, `no-new-privileges`, terminal container kill, and exact removal. - Froze the R7 sampling and analysis protocol before compiler outcomes: deterministic first-parent eligibility, 30 patches across at least three repositories, hash-assigned 12-patch development and 18-patch held-out sets, two independent human raters, Wilson intervals, adversarial cases, thresholds, and explicit narrowing rules. -- No Docker `SandboxRunner`, corpus patch, compiler result, or human rating exists yet. Arbitrary code remains disabled and R7 has not passed. +- Protected PR #16 run `30672257419` passed the required Linux, Windows, contract, web, and policy checks for the ADR/protocol change. No Docker `SandboxRunner`, corpus patch, compiler result, or human rating exists yet. Arbitrary code remains disabled and R7 has not passed. Evidence: `docs/v0.3/ADR-003-DOCKER-DESKTOP-SANDBOX.md`, `docs/v0.3/R7_PREREGISTRATION.md`, local Docker Desktop/Engine/image inspection, and the disposable capability output recorded in ADR-003. diff --git a/docs/PROJECT_STATE.md b/docs/PROJECT_STATE.md index 2292917..5926ee1 100644 --- a/docs/PROJECT_STATE.md +++ b/docs/PROJECT_STATE.md @@ -28,7 +28,7 @@ Branch `codex/shadow-cockpit-rnd` resets the product R&D thesis around **Dual-Co - Participant serialization contains no fixture binding, command, state, revision, oracle, controller handle, or production path. Capsule construction reopens only participant-visible project evidence, caps and scrubs excerpts, and treats every model proposal as non-executable text plus an optional existing input ID. - Six R4.5 tests cover cross-platform golden claim/probe/attempt hashes, strict projection and catalog isolation, unstable/cross-project/hidden/malformed evidence rejection, capsule path/secret/ID redaction, precommitted prediction, prose-invariant observation, replay/late/identity failures, and timeout/cancellation/runner-error invalidation. The full local Windows extension suite passes 63/63; `npm run check`, production build, and VSIX packaging pass. Protected PR #15 run `30671499103` passed `extension`, `extension-windows`, `contract`, `web`, and `jules-rnd-policy`, so R4.5 acceptance is complete. - ADR-003 selects digest-pinned Linux containers through Docker Desktop/WSL2 as the replaceable Phase-B backend. A real local Windows probe verified outbound network failure, a read-only root, zero undeclared mounts, an unchanged `EROFS` oracle, memory/CPU/PID limits, dropped capabilities, `no-new-privileges`, descendant-container kill, and exact removal on Docker Desktop 4.61 / Engine 29.2.1. -- `R7_PREREGISTRATION.md` freezes the repository/patch sampling algorithm, eligibility and exclusions, 12/18 development/held-out split, two-rater protocol, metrics, confidence intervals, adversarial cases, thresholds, and narrowing rules before corpus outcomes are inspected. +- `R7_PREREGISTRATION.md` freezes the repository/patch sampling algorithm, eligibility and exclusions, 12/18 development/held-out split, two-rater protocol, metrics, confidence intervals, adversarial cases, thresholds, and narrowing rules before corpus outcomes are inspected. Protected PR #16 run `30672257419` passed the required Linux, Windows, contract, web, and policy checks for the ADR/protocol change. - The Docker `SandboxRunner` itself and the 30-patch corpus are not implemented. The local primitive probe is backend-selection evidence, not permission to execute arbitrary participant or repository code. - The readiness ledger and v0.3 cockpit do not exist yet. R0–R4.5 remain a closed reviewed-fixture mechanism and do not execute arbitrary participant or workspace code. - No skill-retention or speed metric has been measured. Values in the PRD are predeclared R&D targets.