From 9337ac3e5edd42bb17f5e2ade6c2de02c7ef576d Mon Sep 17 00:00:00 2001 From: tanaka takashi Date: Thu, 13 Aug 2026 22:48:24 +0900 Subject: feat!: isolate privileged sandbox network operations per task Run agent-mcp with an explicit asInvoker manifest and move WFP and loopback mutations into a fixed requireAdministrator helper under the release admin directory. Add the Agent.Admin client and host projects with task-scoped runas launch, a logon-SID and Administrators-only local named pipe, remote-client rejection, mutual PID validation, strict versioned JSON framing, fixed network-only operations, and bounded messages. Delay ACL and network Task Resource application until the first process_run. Verify executable identity, managed entry points, DNS snapshots, and normal-token WRITE_DAC access before elevation; reuse the helper only within the Task and keep elevation failures terminal without policy replanning. Keep LPAC creation, executable approval, Job confinement, and ACL leases in the normal process. Make startup platform checks read-only, create the fixed Application Profile during apply, preserve dynamic WFP lifetime in the helper, and route persistent loopback recovery through the same elevated boundary. Update recovery journaling, localized elevation and IPC errors, audit events, release publishing, manifests, README guidance, Specifications, Design, implementation records, and requirement traceability for the on-demand elevation model. Add administrative-boundary, file-only no-elevation, elevation-terminal, lazy-resource, crash-recovery, manifest, IPC schema, and operational verification coverage. Verified Release build with zero warnings, Core 105/105, Planner 10/10, administrative boundary 4/4, elevated Windows suite 79/79, and published stdio/HTTP MCP E2E. --- plans/RequirementTraceability.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'plans/RequirementTraceability.md') diff --git a/plans/RequirementTraceability.md b/plans/RequirementTraceability.md index 1aab2a2..241866a 100644 --- a/plans/RequirementTraceability.md +++ b/plans/RequirementTraceability.md @@ -1,5 +1,13 @@ # Requirement Traceability +> 2026-08-13オンデマンド昇格追補: 起動、Task Resource、Recovery、Security Invariantの証跡は`asInvoker` main、Task単位helper、明示DACL Named Pipe、dynamic WFP、loopback復元の最新検証へ置換する。これ以前の「administratorでServer起動」のPASSは履歴であり、現行RequirementのPASS根拠に使用しない。 + +| Requirement | 実装 | 検証 | 状態 | +| --- | --- | --- | --- | +| 非昇格Server / Task時昇格 | main/admin manifest、`WindowsPlatformCheck`、遅延`process_run`初期化 | embedded manifest、通常token stdio/HTTP、実UAC、file-only無昇格、terminal error unit | PARTIAL — 実UAC拒否操作は未再検証 | +| WFP / loopback Process境界 | `Agent.Admin.Host`、固定Named Pipe protocol | static call graph、strict schema、PID検証、none実HTTP、Windows suite | PARTIAL — hostile peer/remote pipeの実Process matrixは未再検証 | +| Recovery | 既存`TaskResourceJournal`と通常/昇格Recovery振分け | Windows crash matrix、legacy `wfp.dynamic`、loopback helper unit | PARTIAL — 実helper crashと実UAC startup Recoveryは未再検証 | + Sandbox Configuration schema version 2後の現行実装を対象とする。2026-08-13以前の結果は`plans/progress/`と本書末尾に履歴として保持するが、schema version 2の現行PASS判定には使用しない。 状態は`PASS / PARTIAL / FAIL / NOT REVERIFIED`を使う。2026-08-12の現行working-tree管理者証跡は`artifacts/evidence/sandbox-usability-final-working-tree-2/`、2026-08-13のLPAC Descendant再監査は`artifacts/evidence/lpac-descendant-reaudit-working-tree/`に保存する。 @@ -57,6 +65,13 @@ Internal Tool testは件数を仕様としてassertしない。`Design.md`のToo | Verification | Date / privilege | Result | |---|---|---| +| on-demand elevation Release build | 2026-08-13 / non-elevated | warning 0、error 0 | +| on-demand elevation Core / Planner | 2026-08-13 / non-elevated | Core 105 PASS、Planner 10 PASS、fail/skip 0 | +| administrative boundary tests | 2026-08-13 / non-elevated | fixed IPC schema、過大/未知field拒否、manifest/native call ownershipの4件PASS、fail/skip 0 | +| on-demand elevation Windows suite | 2026-08-13 / Windows Security childのみadministrator | 79 PASS、fail/skip 0。共有Application Profile/WFP状態を直列実行 | +| published HTTP MCP on-demand elevation | 2026-08-13 / main standard-user、helper Task時UAC / `deepseek-v4-flash:cloud` | completed 3/3。cmd→cmd/curl/Python 3.14、Network none、昇格request/success、WFP/ACL cleanup、helper残留0 | +| published stdio Operational E2E | 2026-08-13 / main standard-user、helper Task時UAC / `deepseek-v4-flash:cloud` | completed 4/4。複雑Python実装、9 unittest、Python subprocess、cleanup PASS | +| on-demand elevation manifests / Bundle | 2026-08-13 / fresh extraction | main `asInvoker`、helper `requireAdministrator/uiAccess=false`、固定`admin/`配置、local資産保持を確認。ZIP SHA-256 `59c6d110c919cb616812272cb3189b03e5a0cb1b42178942cc23748a57d3d0e8` | | schema v2 Release build | 2026-08-13 / non-elevated | warning 0、error 0 | | schema v2 Agent.Core.Tests / Planner.Tests | 2026-08-13 / non-elevated | Core 104 PASS、Planner 10 PASS、fail/skip 0 | | schema v2 Windows Security/Recovery + README operational | 2026-08-13 / administrator | 環境非依存56件と実環境19件の計75 PASS、fail/skip 0。LPAC/ACL/Job/WFP、PowerShell/cmd/venv Python、Network、ACL monkeyを含む | -- cgit v1.2.3