From 9337ac3e5edd42bb17f5e2ade6c2de02c7ef576d Mon Sep 17 00:00:00 2001 From: tanaka takashi Date: Thu, 13 Aug 2026 22:48:24 +0900 Subject: feat!: isolate privileged sandbox network operations per task Run agent-mcp with an explicit asInvoker manifest and move WFP and loopback mutations into a fixed requireAdministrator helper under the release admin directory. Add the Agent.Admin client and host projects with task-scoped runas launch, a logon-SID and Administrators-only local named pipe, remote-client rejection, mutual PID validation, strict versioned JSON framing, fixed network-only operations, and bounded messages. Delay ACL and network Task Resource application until the first process_run. Verify executable identity, managed entry points, DNS snapshots, and normal-token WRITE_DAC access before elevation; reuse the helper only within the Task and keep elevation failures terminal without policy replanning. Keep LPAC creation, executable approval, Job confinement, and ACL leases in the normal process. Make startup platform checks read-only, create the fixed Application Profile during apply, preserve dynamic WFP lifetime in the helper, and route persistent loopback recovery through the same elevated boundary. Update recovery journaling, localized elevation and IPC errors, audit events, release publishing, manifests, README guidance, Specifications, Design, implementation records, and requirement traceability for the on-demand elevation model. Add administrative-boundary, file-only no-elevation, elevation-terminal, lazy-resource, crash-recovery, manifest, IPC schema, and operational verification coverage. Verified Release build with zero warnings, Core 105/105, Planner 10/10, administrative boundary 4/4, elevated Windows suite 79/79, and published stdio/HTTP MCP E2E. --- plans/ImplementationPlan.md | 2 ++ 1 file changed, 2 insertions(+) (limited to 'plans/ImplementationPlan.md') diff --git a/plans/ImplementationPlan.md b/plans/ImplementationPlan.md index 4ec765f..fc101c7 100644 --- a/plans/ImplementationPlan.md +++ b/plans/ImplementationPlan.md @@ -1,5 +1,7 @@ # AI Agent Sandbox MCP Server — 実装・監査作業計画 +> 2026-08-13オンデマンド昇格追補: Server全体の常時管理者起動を廃止する。`agent-mcp.exe`は`asInvoker`で起動し、Task内の初回`process_run`直前にWFPとloopback exemptionだけをTask単位の`runas` Processへ移す。ACL、LPAC、Job、Executable Approvalは通常側に維持する。WFP dynamic objectのfilter IDは新規Recovery Journalへ保存せず、persistentなloopback状態だけを既存Journalで復元する。旧管理者起動を前提とするPhase完了記録は当時のcommitに対する履歴である。 + > Current status (2026-08-13): Sandbox Configuration schema version 2を破壊的に導入した。YAMLを唯一のdesired stateとし、CLIはServer起動、`apply`、`show`へ限定する。個別Executable Approval StoreとSandbox Resolution Storeは廃止し、config別Applied Configuration Storeへ統合する。旧完了報告と旧schemaの証跡は履歴であり、schema version 2のPASS根拠には使用しない。 **文書名:** `ImplementationPlan.md` -- cgit v1.2.3