From 76fdcb43585a4c4d288c1026d318a0ddbe3e26ab Mon Sep 17 00:00:00 2001 From: tanaka takashi Date: Thu, 13 Aug 2026 18:20:33 +0900 Subject: fix(sandbox): correct cmd descendant handling and protected ACL policy Replace the earlier cmd-wide descendant incompatibility diagnosis with the verified distinction between drive-qualified paths and PATH/workspace-relative invocation. Document the cmd YAML configuration, executable resolution, --no-runtime approval flow, and safe descendant invocation examples in the user README. Keep the System32 protected DACL intact for both the OS Runtime Root and approved entry files nested below it. Skip redundant file-level ACL rewrites for approved System32 executables while retaining LPAC confinement, resolved-path checks, SHA-256 approval, WFP policy, and Job Object enforcement. Expand Windows coverage with capability positive/negative matrices, protected-DACL regression tests, cmd/PowerShell/venv Python script execution, nine Entry-to-Descendant combinations, network none/local probes, and randomized ACL round-trip testing. Add read-only CLI/README verification and published HTTP MCP agent_run verification scripts. Update Design, Audit Report, and Requirement Traceability with the corrected root cause, current evidence, withdrawn diagnostic conclusions, and the remaining partial item for per-combination descendant self-recorded LPAC SID/Job evidence. Verified: Release build 0 warnings/errors; Core 103 PASS; Planner 10 PASS; Windows 75 PASS with skip 0; README operational suite 19 PASS; published HTTP MCP agent_run completed 3/3 with cmd, curl, C:\tmp\.venv Python, network-none enforcement, ACL restoration, and CMD_HTTP_MCP_OK. --- plans/RequirementTraceability.md | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) (limited to 'plans/RequirementTraceability.md') diff --git a/plans/RequirementTraceability.md b/plans/RequirementTraceability.md index 4f901e6..ae32290 100644 --- a/plans/RequirementTraceability.md +++ b/plans/RequirementTraceability.md @@ -2,7 +2,7 @@ Sandbox Usability Revision後の現行実装を対象とする。commit `37386b8`（2026-08-11 JST）以前の結果は`plans/progress/`と本書末尾に履歴として保持するが、現行PASS判定には使用しない。 -状態は`PASS / PARTIAL / FAIL / NOT REVERIFIED`を使う。2026-08-12の現行working-tree管理者証跡は`artifacts/evidence/sandbox-usability-final-working-tree-2/`に保存する。 +状態は`PASS / PARTIAL / FAIL / NOT REVERIFIED`を使う。2026-08-12の現行working-tree管理者証跡は`artifacts/evidence/sandbox-usability-final-working-tree-2/`、2026-08-13のLPAC Descendant再監査は`artifacts/evidence/lpac-descendant-reaudit-working-tree/`に保存する。 ## Requirement mapping @@ -16,7 +16,7 @@ Sandbox Usability Revision後の現行実装を対象とする。commit `37386b8 | PLN-01〜06 | `TaskGraph`, `PlannerService`, structural `task_update` | Planner 10件、structured-plan retry、Task固有Tool証跡test | PASS | | SES-01〜06 | `SessionStore`、会話/graph/result保持、structured要約 | summary成功/失敗、session/runtime tests | PASS | | FS-01〜10 | `ResolvedPath`, `PathPolicy`, `TaskAclManager`, `SandboxEnvironmentResolver` | Resolution/fingerprint/nested root、read/execute分離、readonly/development LPAC実効果、管理者suite | PASS | -| PRC-01〜09 | `EntryExecutablePolicy`, `RestrictedProcessLauncher`, Approval Store、Job Process Tree | Alias-only Entry、hash、Runtime/Artifact分類、Entry/Descendant LPAC SID・Job、PowerShell/Python/.NET build/test、breakaway、process/memory/timeout | PASS | +| PRC-01〜09 | `EntryExecutablePolicy`, `RestrictedProcessLauncher`, Approval Store、Job Process Tree | Alias-only Entry、hash、Runtime/Artifact分類、PowerShell/Python/.NET build/test、breakaway、process/memory/timeout、Entry×Descendant matrix | PASS — cmdを含む全9組をPATH解決名／Workspace相対pathで再検証し、publish済みHTTP MCPでもcmd→cmd/curl/venv Pythonを完走 | | REC-01〜07 | retry、timeout、cancel cleanup、`RecoveryManager` | Core lifecycle、elevated crash/recovery matrix、残留0 | PASS | | SEC-INV-01〜05 | deny-by-default、Policy非変更、Resolved Path/hash/Entry分類 | Core境界、管理者Windows suite、Operational E2E | PASS | | SEC-INV-06〜08、13 | WFP none/local/restricted、credential非継承、Process Tree confinement | credential非継承、全Network mode、Process Tree実効果 | PASS | @@ -33,7 +33,8 @@ Sandbox Usability Revision後の現行実装を対象とする。commit `37386b8 | ID | Current implementation / test | Status | |---|---|---| | AT-01〜06 | MCP stdio/HTTP、公開schema、Task lifecycle、Ollama、Vision拒否 | PASS | -| AT-07〜13、21〜22 | Resolution、LPAC/ACL/Process Tree、WFP、crash recovery | PASS | +| AT-07〜11、13、21〜22 | Resolution、LPAC/ACL/Process Tree、WFP、crash recovery | PASS | +| AT-12 | Entry/DescendantのLPAC・Job confinement | PARTIAL — cmdを含む起動組合せは成功し、Python Descendant自身のSID/JobとProcess Tree制限は検証済み。全9組それぞれのDescendant自身によるSID/Job記録は未実施 | | AT-14〜17 | cycle、immutable、PERT/CPM、全phase token集計 | PASS | | AT-18〜20 | en/ja、追加locale、malformed/unknown locale | PASS | @@ -42,10 +43,13 @@ Sandbox Usability Revision後の現行実装を対象とする。commit `37386b8 | ID | Current implementation / test | Status | |---|---|---| | ST-01〜09 | Profile/Mount/Resolution/Approval、ACL/LPAC実効果 | PASS | -| ST-10〜14 | Descendant inheritance、Job timeout、WFP actual traffic | PASS | +| ST-10〜14 | Descendant inheritance、Job timeout、WFP actual traffic | PASS — cmdを含むDescendant起動、Job timeout、PowerShell/cmd/PythonのNetwork none/local実通信を再実行 | | ST-15〜16 | MCP非公開境界、Design Tool catalogの名前/schema/Policy境界 | PASS | | ST-17〜18 | ACL/WFP/loopback crash recovery | PASS | | ST-19〜20 | malformed locale fatal、non-loopback bind拒否 | PASS | +| ST-25 | Entry×Descendant compatibility matrix | PARTIAL — PowerShell/cmd/venv Python親×cmd/curl/venv Python子の9組は全成功。全組合せで子自身のSID/Jobを個別記録する部分は未実施 | +| ST-26 | protected DACL coexistence | PASS — System32のSecurity Descriptor非変更、protected descendant非上書き、通常root cleanup一致を実昇格確認 | +| ST-27 | capability正負matrix | PASS — Network capabilityなし/ありの双方で固定baseline、Registry read、Registry write/COM拒否、secret非継承を確認し、Network到達性はnone/localのPowerShell/Python実通信で検証 | Internal Tool testは件数を仕様としてassertしない。`Design.md`のTool catalogに記載された`file_search / file_read / file_edit / process_run / task_update / dir`の名前、schema、Policy境界、MCP非公開性を検査する。 @@ -57,6 +61,11 @@ Internal Tool testは件数を仕様としてassertしない。`Design.md`のToo | Agent.Core.Tests | 2026-08-12 / administrator | 103 PASS、0 FAIL、0 skip | | Agent.Planner.Tests | 2026-08-12 / administrator | 10 PASS、0 FAIL、0 skip | | Agent.Windows.Tests | 2026-08-12 / administrator | 53 PASS、0 FAIL、0 skip。LPAC/ACL/Job/WFP/Recovery、PowerShell/Python/.NET Process Treeを含む | +| LPAC compatibility initial diagnostic | 2026-08-13 / administrator / current working tree | cmd親へドライブ修飾絶対pathを渡したため3組が失敗。一般的なDescendant拒否という当時の判定は撤回し、現行PASS根拠には使用しない | +| Agent.Windows.Tests initial diagnostic | 2026-08-13 / administrator / current working tree | 75件実行したが、cmd拒否を正解とした期待値を含むため現行のPRC/ST-10/ST-25受入証跡には使用しない | +| README/CLI/Windows operational suite | 2026-08-13 / administrator / current working tree | 19 PASS、0 FAIL、0 skip。CLI、PowerShell/cmd/venv Python、Entry×Descendant 9組、Network none/local、ACL monkey 64反復 | +| Agent.Windows.Tests corrected full suite | 2026-08-13 / administrator / current working tree | 75 PASS、0 FAIL、0 skip。System32/cmd.exe protected DACL非変更回帰を含む | +| Published HTTP MCP cmd E2E | 2026-08-13 / administrator / published Bundle | `agent_run` completed 3/3。cmd→cmd/curl/C:\tmp\.venv Python、Network none、exit 0、`CMD_HTTP_MCP_OK`、Task終了後ACL復元を確認 | | win-x64 self-contained Bundle | 2026-08-12 / administrator / fresh展開 | check PASS。既定ZIPにlocal override・local prompt/Skill・固有pathなし。deployment local資産保持。ZIP SHA-256 `f220cbf66d6d2bfd110542cdeec48cd64c97aec549b4ffd999c4746f3324ecb0` | | Operational E2E | 2026-08-12 / administrator / `deepseek-v4-flash:cloud`, `think:true`, Python 3.14.3 | stdio、HTTP IPv4、HTTP IPv6すべてPASS。Python実装、子Python unittest、独立検証、ACL/WFP/temp cleanup確認 | | Task Resource residual state | 2026-08-12 / administrator | Journal 0、backup 0、published `agent-mcp` process 0 | -- cgit v1.2.3