feat!: remove the namespace sandbox #288

Merged

coilysiren merged 1 commit from feat/remove-sandbox into main

2026-08-14 05:34:26 +00:00

coilyco-ops commented

2026-08-14 05:25:38 +00:00

Member

Closes #256. Closes #277. Supersedes #287.

The jail was built when ward ran host-native. ward is containerized now, and its own container_bootstrap.go turns the jail off with the comment "The container is the isolation boundary". The premise is gone.

What the jail actually was in practice

Off in 34 places across the fleet - every deploy workflow, AOS CI, and ward's own container bootstrap.
Absent on two of three platforms. //go:build linux, so the Mac and Windows machines never had it - and ward exec is the documented workflow on both.
Broken or denied on the third. #256 (P1, open since July) has ward exec on a make verb failing outright on a root-owned /usr/bin/make. #277 has Ubuntu 24.04's apparmor denying the userns. Both issues list the same remedy: the opt-out env.

So the population where it engaged was: Linux hosts, not Ubuntu 24.04, with user-owned tool binaries, that hadn't set the opt-out. Close to empty.

It was a liability, not just dead weight

SECURITY.md advertised jail escapes as a reportable vulnerability class - grandchild gate routing, seccomp denylist, namespace confinement - and said "a passing test that does not actually hold is itself a vulnerability." Meanwhile #256 sat open against that exact surface while the control was disabled nearly everywhere. Promising a boundary that is switched off is worse than not promising it.

What goes

cli/sandbox (1192 lines, seccomp included), its wiring in cli/shell, docs/sandbox.md, and the SECURITY.md claim. -1146 lines.

With it go every CLIGUARD_ env var: NO_SANDBOX, JAILED, REALBIN_. The config fallback token follows for consistency: CLI_GUARD -> UMBRA, and FallbackAppDir ".cli-guard" -> ".umbra".

Operator note

That last rename moves the app dir for any consumer that never calls config.SetAppDir. AOSguard is one, so its audit log moves from ~/.cli-guard/audit/<repo-slug>.jsonl to ~/.umbra/audit/. Existing history is not migrated - run mv ~/.cli-guard ~/.umbra if it should carry over.

Verification

Full gate green on darwin (build, vet, tidy, test, lint 0 issues) and the whole suite green on linux in Docker, which is where the deleted code actually lived.

On #287

I opened #287 an hour ago to make this same jail degrade gracefully on the mode-2 denial. It works and is verified, but it is polish on something being deleted - close it unmerged. Same for #256, which this removes rather than fixes.

The fleet's 34 declarations come out next, once this releases.

Closes #256. Closes #277. Supersedes #287. The jail was built when ward ran host-native. ward is containerized now, and its own `container_bootstrap.go` turns the jail off with the comment *"The container is the isolation boundary"*. The premise is gone. ## What the jail actually was in practice - **Off in 34 places** across the fleet - every deploy workflow, AOS CI, and ward's own container bootstrap. - **Absent on two of three platforms.** `//go:build linux`, so the Mac and Windows machines never had it - and `ward exec` is the documented workflow on both. - **Broken or denied on the third.** #256 (P1, open since July) has `ward exec` on a `make` verb failing outright on a root-owned `/usr/bin/make`. #277 has Ubuntu 24.04's apparmor denying the userns. Both issues list the same remedy: the opt-out env. So the population where it engaged was: Linux hosts, not Ubuntu 24.04, with user-owned tool binaries, that hadn't set the opt-out. Close to empty. ## It was a liability, not just dead weight `SECURITY.md` advertised jail escapes as a reportable vulnerability class - grandchild gate routing, seccomp denylist, namespace confinement - and said *"a passing test that does not actually hold is itself a vulnerability."* Meanwhile #256 sat open against that exact surface while the control was disabled nearly everywhere. Promising a boundary that is switched off is worse than not promising it. ## What goes `cli/sandbox` (1192 lines, seccomp included), its wiring in `cli/shell`, `docs/sandbox.md`, and the SECURITY.md claim. **-1146 lines.** With it go **every `CLIGUARD_` env var**: `NO_SANDBOX`, `JAILED`, `REALBIN_`. The config fallback token follows for consistency: `CLI_GUARD` -> `UMBRA`, and `FallbackAppDir` `".cli-guard"` -> `".umbra"`. ## Operator note That last rename moves the app dir for any consumer that never calls `config.SetAppDir`. **AOSguard is one**, so its audit log moves from `~/.cli-guard/audit/<repo-slug>.jsonl` to `~/.umbra/audit/`. Existing history is not migrated - run `mv ~/.cli-guard ~/.umbra` if it should carry over. ## Verification Full gate green on darwin (`build`, `vet`, `tidy`, `test`, `lint` 0 issues) and the whole suite green on **linux in Docker**, which is where the deleted code actually lived. ## On #287 I opened #287 an hour ago to make this same jail degrade gracefully on the mode-2 denial. It works and is verified, but it is polish on something being deleted - **close it unmerged**. Same for #256, which this removes rather than fixes. The fleet's 34 declarations come out next, once this releases.

coilyco-ops added 1 commit

2026-08-14 05:25:38 +00:00

feat!: remove the namespace sandbox

ci / secrets (pull_request) Successful in 11s

Details

ci / lint (pull_request) Successful in 58s

Details

ci / test (pull_request) Successful in 1m24s

Details

283434c6d1

closes #256
closes #277

The jail was built when ward ran host-native. ward is containerized now,
and its own container_bootstrap.go turns the jail off with the comment
"The container is the isolation boundary". The premise is gone.

What the jail actually was in practice:

  Off in 34 places across the fleet - every deploy workflow, AOS CI, and
  ward's own container bootstrap.
  Absent on two of three platforms: //go:build linux, so the Mac and
  Windows machines never had it, and `ward exec` is the documented
  workflow on both.
  Broken or denied on the third. #256 (P1, open since July) has
  `ward exec` on a make verb failing outright on a root-owned
  /usr/bin/make. #277 has Ubuntu 24.04's apparmor denying the userns.
  Both list the same remedy: the opt-out env.

So the set where it engaged was Linux hosts, not Ubuntu 24.04, with
user-owned tool binaries, that had not set the opt-out. Close to empty.

It was also a live liability. SECURITY.md advertised jail escapes as a
reportable class - grandchild gate routing, seccomp denylist, namespace
confinement - while #256 sat open against that exact surface and the
control was disabled nearly everywhere. Promising a boundary that is off
is worse than not promising it.

Removed: cli/sandbox (1192 lines, seccomp included), its wiring in
cli/shell, docs/sandbox.md, and the SECURITY.md claim.

Every CLIGUARD_ env var goes with it - NO_SANDBOX, JAILED, REALBIN_. The
config fallback token follows for consistency: CLI_GUARD -> UMBRA, and
FallbackAppDir ".cli-guard" -> ".umbra".

OPERATOR NOTE: that last rename moves the app dir for any consumer that
never calls config.SetAppDir. AOSguard is one, so its audit log moves
from ~/.cli-guard/audit/<repo-slug>.jsonl to ~/.umbra/audit/. Existing
history is not migrated; `mv ~/.cli-guard ~/.umbra` if it should carry
over.

Full gate green on darwin and on linux in Docker.

Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>