Project a safe home-directory surface into standalone AOS #924

New issue

Closed

opened 2026-08-06 03:50:47 +00:00 by coilyco-ops · 1 comment

coilyco-ops commented

2026-08-06 03:50:47 +00:00

Owner

Problem

Standalone aoscompose does not preserve the practical home-directory surface that a native acompose launch expects. A container launch therefore loses ordinary host context and small local affordances even when they are deliberately safe to project.

This is a capability discontinuity, not a request to mount the host home wholesale. The current standalone contract correctly excludes host HOME, Git credentials, Docker socket, and AWS config.

Desired outcome

Define and implement a least-privilege home projection for standalone AOS that makes supported home-scoped capabilities available without turning the container into an unbounded view of the host.

Acceptance signals

The standalone launch has a documented, deterministic home surface appropriate to its selected role and projected context.
Sensitive host home content remains unavailable by default, including credentials and cloud configuration.
The projected home behaves consistently with native acompose expectations where that is safe.
Tests prove both the intended availability and the denied sensitive paths.

## Problem Standalone `aoscompose` does not preserve the practical home-directory surface that a native `acompose` launch expects. A container launch therefore loses ordinary host context and small local affordances even when they are deliberately safe to project. This is a capability discontinuity, not a request to mount the host home wholesale. The current standalone contract correctly excludes host HOME, Git credentials, Docker socket, and AWS config. ## Desired outcome Define and implement a least-privilege home projection for standalone AOS that makes supported home-scoped capabilities available without turning the container into an unbounded view of the host. ## Acceptance signals * The standalone launch has a documented, deterministic home surface appropriate to its selected role and projected context. * Sensitive host home content remains unavailable by default, including credentials and cloud configuration. * The projected home behaves consistently with native `acompose` expectations where that is safe. * Tests prove both the intended availability and the denied sensitive paths.

coilyco-ops referenced this issue from a pull request that will close it,

2026-08-06 06:36:09 +00:00

Use native shadow workspaces for standalone AOS #942

coilyco-ops commented

2026-08-06 06:55:30 +00:00

Author

Owner

Landed on main in coilyco-flight-deck/agentic-os@53b035bbb9.

Validation passed locally through ward exec aos-test, ward exec aos-build, ward exec aos-lint, ward exec test, ward exec pre-commit-all, and the AOS release build/package/check verbs. Pull request #942 was green before landing.

Landed on main in coilyco-flight-deck/agentic-os@53b035bbb969995bc2780e6971f2b95b30fe9bb2. Validation passed locally through ward exec aos-test, ward exec aos-build, ward exec aos-lint, ward exec test, ward exec pre-commit-all, and the AOS release build/package/check verbs. Pull request #942 was green before landing.

coilyco-ops closed this issue

2026-08-06 06:55:31 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/agentic-os#924

No description provided.

Rows
Columns