feat!: move to umbra v0.140.0 and drop the sandbox

coilyco-ops commented

2026-08-14 04:57:59 +00:00

Owner

Two things, because they cannot land apart: the module rename (umbra#285) and the sandbox removal (umbra#288). Pinning v0.139.0 first and v0.140.0 second would mean two breaking bumps and an intermediate state nobody wants, so this goes straight to v0.130.0 -> v0.140.0.

1. Module path

cli-guard is now forgejo.coilysiren.me/coilyco-flight-deck/umbra. All 18 packages ward imports survive the intervening cleanup (umbra#284 removed 20 dead ones, none of them ours). Two things ward never used went with them: passthrough.WithReadCache and the aws-read execverb gate.

2. The sandbox is gone

umbra#288 deleted the namespace jail: it was disabled in 34 places across the fleet, absent on macOS and Windows, and broken or denied on Linux (umbra#256, umbra#277). Removed here:

file	what
`cmd/ward/main.go`	the `__jail` helper re-exec dispatch
`cmd/ward/runner.go`	`sandboxSpec()` and both `Sandbox` fields
`cmd/ward/agent.go`	`suspendSandbox()` and its two docker call sites - there is no jail left to suspend for a snap-provided docker (ward#540)
`cmd/ward/container_bootstrap.go`	`CLIGUARD_NO_SANDBOX=1`, which now opts out of nothing
`cmd/ward/docker_sandbox_test.go`	pinned the suspend/restore behaviour

That is ward's last CLIGUARD_ reference.

The security posture genuinely changed, and the docs now say so

SECURITY.md claimed the wrapper held "at arbitrary process depth, not just depth 0" on Linux via the jail, and that an escape was a reportable vulnerability. That is no longer true anywhere. The doc now states enforcement is depth-0 on every platform and descendant bypass is a known limitation rather than a vulnerability - which is what the same file already said for macOS and Windows, and consistent with its existing line that an escaped process is the container's job, not the gate's. README.md follows.

This is a real reduction in claimed guarantees. It is the honest description of what ward does now, not a downgrade hidden in a rename.

Verification

go build and go vet clean against v0.140.0. go test ./...: 6 packages pass; cmd/ward and scripts hang in my environment.

That hang is pre-existing. I confirmed it by cloning ward at main unmodified, still on v0.130.0, and running the same two packages - they hang identically, reading WARD_GITLAB_BASE and a config file. So it looks environmental, not dependency-related. CI is the authoritative signal here - please don't read my green build/vet as a full pass.

Fleet follow-on is gated on this

30 workflows across coilyco-bridge/deploy (25), agentic-os (4) and agentic-os-xxx (1) still declare CLIGUARD_NO_SANDBOX=1. Those cannot be swept until this merges and releases, because they run inside agentic-os:release, which bakes WARD_VERSION=0.879.0 - a ward that still contains the jail. Deleting the opt-out before that image rebuilds would re-enable a broken sandbox in 30 workflows.

Order: merge this -> ward release -> bump WARD_VERSION in agentic-os' Dockerfile -> then delete the declarations.

Two things, because they cannot land apart: the module rename (umbra#285) and the sandbox removal (umbra#288). Pinning v0.139.0 first and v0.140.0 second would mean two breaking bumps and an intermediate state nobody wants, so this goes straight to **v0.130.0 -> v0.140.0**. ## 1. Module path `cli-guard` is now `forgejo.coilysiren.me/coilyco-flight-deck/umbra`. All 18 packages ward imports survive the intervening cleanup (umbra#284 removed 20 dead ones, none of them ours). Two things ward never used went with them: `passthrough.WithReadCache` and the `aws-read` execverb gate. ## 2. The sandbox is gone umbra#288 deleted the namespace jail: it was disabled in 34 places across the fleet, absent on macOS and Windows, and broken or denied on Linux (umbra#256, umbra#277). Removed here: | file | what | | --- | --- | | `cmd/ward/main.go` | the `__jail` helper re-exec dispatch | | `cmd/ward/runner.go` | `sandboxSpec()` and both `Sandbox` fields | | `cmd/ward/agent.go` | `suspendSandbox()` and its two docker call sites - there is no jail left to suspend for a snap-provided docker (ward#540) | | `cmd/ward/container_bootstrap.go` | `CLIGUARD_NO_SANDBOX=1`, which now opts out of nothing | | `cmd/ward/docker_sandbox_test.go` | pinned the suspend/restore behaviour | That is **ward's last `CLIGUARD_` reference**. ## The security posture genuinely changed, and the docs now say so `SECURITY.md` claimed the wrapper held *"at arbitrary process depth, not just depth 0"* on Linux via the jail, and that an escape was a reportable vulnerability. **That is no longer true anywhere.** The doc now states enforcement is depth-0 on every platform and descendant bypass is a known limitation rather than a vulnerability - which is what the same file already said for macOS and Windows, and consistent with its existing line that an escaped process is the container's job, not the gate's. `README.md` follows. This is a real reduction in claimed guarantees. It is the honest description of what ward does now, not a downgrade hidden in a rename. ## Verification `go build` and `go vet` clean against v0.140.0. `go test ./...`: **6 packages pass; `cmd/ward` and `scripts` hang** in my environment. That hang is **pre-existing**. I confirmed it by cloning ward at `main` unmodified, still on v0.130.0, and running the same two packages - they hang identically, reading `WARD_GITLAB_BASE` and a config file. So it looks environmental, not dependency-related. **CI is the authoritative signal here** - please don't read my green build/vet as a full pass. ## Fleet follow-on is gated on this 30 workflows across `coilyco-bridge/deploy` (25), `agentic-os` (4) and `agentic-os-xxx` (1) still declare `CLIGUARD_NO_SANDBOX=1`. Those **cannot be swept until this merges and releases**, because they run inside `agentic-os:release`, which bakes `WARD_VERSION=0.879.0` - a ward that still contains the jail. Deleting the opt-out before that image rebuilds would re-enable a broken sandbox in 30 workflows. Order: merge this -> ward release -> bump `WARD_VERSION` in agentic-os' Dockerfile -> then delete the declarations.

coilyco-ops added 1 commit

2026-08-14 04:57:59 +00:00

chore!: move to the umbra module path

test / test (pull_request) Failing after 1m7s

Details

ee1b855577

cli-guard is now forgejo.coilysiren.me/coilyco-flight-deck/umbra
(umbra#285). The pin moves v0.130.0 -> v0.139.0 and the product name in
prose follows.

All 18 packages ward imports survive the intervening cleanup (umbra#284
removed 20 dead ones, none of them ours). Two things ward never used
went away with it: passthrough.WithReadCache and the aws-read execverb
gate.

CLIGUARD_NO_SANDBOX is deliberately untouched. It is a runtime env
contract umbra kept under the old spelling on purpose, and
container_bootstrap.go sets it; renaming either half alone would stop
the opt-out being honoured silently.

Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>

coilyco-ops requested review from coilysiren

2026-08-14 04:57:59 +00:00

coilyco-ops added 1 commit

2026-08-14 06:28:51 +00:00

style: gofmt the comment alignment the umbra rename shifted

test / test (pull_request) Successful in 50s

Details

b3d0b32e18

`cli-guard` and `umbra` are different lengths, so the trailing comments in
five literal blocks fell out of gofmt's alignment column. Whitespace only,
no behavior change. `golangci-lint run --timeout=15m ./...` reports 0 issues.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>

coilyco-ops added 1 commit

2026-08-14 06:43:09 +00:00

Merge branch 'main' into chore/umbra-rename

test / test (pull_request) Has been cancelled

Details

0dfbd4f534

coilyco-ops added 1 commit

2026-08-14 06:44:42 +00:00

feat!: drop the sandbox and move to umbra v0.140.0

test / test (pull_request) Failing after 52s

Details

c4ab788d04

umbra#288 removed the namespace jail, so the pin goes straight to
v0.140.0 rather than stopping at v0.139.0.

Removed here:
  cmd/ward/main.go             the __jail helper re-exec dispatch
  cmd/ward/runner.go           sandboxSpec() and both Sandbox fields
  cmd/ward/agent.go            suspendSandbox() and its two docker
                               call sites - there is no jail left to
                               suspend for a snap-provided docker
  cmd/ward/container_bootstrap.go
                               CLIGUARD_NO_SANDBOX=1, which now opts
                               out of nothing
  cmd/ward/docker_sandbox_test.go
                               pinned the suspend/restore behaviour

That is ward's last CLIGUARD_ reference.

SECURITY.md claimed the wrapper held "at arbitrary process depth, not
just depth 0" on Linux via the jail, and that an escape was a
vulnerability. That is no longer true anywhere, so the doc now says
enforcement is depth-0 on every platform and descendant bypass is a
known limitation rather than a vulnerability - which is what the same
file already said about macOS and Windows, and consistent with its
existing line that an escaped process is the container's job.

Verified: build and vet clean, 6 test packages pass. cmd/ward and
scripts still hang locally, unchanged from pristine main - pre-existing
and environmental, so CI remains the authoritative signal.

Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>

coilyco-ops changed title from ~~chore!: move to the umbra module path~~ to feat!: move to umbra v0.140.0 and drop the sandbox

2026-08-14 06:45:10 +00:00