From b07b41cd435991cd254957af79055080c85b346e Mon Sep 17 00:00:00 2001
From: tanaka takashi <isazaka@gmail.com>
Date: Sun, 9 Aug 2026 21:08:20 +0900
Subject: feat: AI Agent Sandbox MCP Server v1を実装
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Specifications、Design、ImplementationPlanの優先順位を整理し、単一Task実行モデル、typed option優先、設定可能なresource上限、local Ollamaを必須とするRelease Gateを文書化。

.NET 10/C# 14の5 production project、3 test project、E2E Clientを構築。typed YAML、en/ja locale、fixed/user prompt、stdioおよびloopback限定Streamable HTTP、agent_run/agent_status、Session、Ollama text/tool/Vision、TaskGraphとtoken accountingを実装。

Windows sandboxとしてfixed AppContainer、canonical/reparse検査、能力別ACL、path+SHA-256 executable approval、child-process restriction、Job Object、task journal、atomic file transaction、crash recoveryを実装。WFPのIPv4/IPv6 default denyとexact allow、dynamic session、temporary loopback exemption、管理者/BFE診断を追加。

Security/Recovery test、MCP/Ollama integration test、stdio/HTTP Operational E2E、Release Bundle生成・checksum・manifest・fresh extraction検査を追加。Requirement TraceabilityとPhase 0〜11の進捗、初回セットアップ可能なREADMEを整備。

Debug/Release/publish/objをrepository rootのbuild/へ集約し、旧project-local bin/objへの依存を除去。artifacts/とbuild/をGit管理外に設定し、clean checkoutでもsolution buildからE2E Clientまで生成可能にした。
---
 scripts/Run-Final-ElevatedVerification.ps1 | 59 ++++++++++++++++++++++++++++++
 1 file changed, 59 insertions(+)
 create mode 100644 scripts/Run-Final-ElevatedVerification.ps1

(limited to 'scripts/Run-Final-ElevatedVerification.ps1')

diff --git a/scripts/Run-Final-ElevatedVerification.ps1 b/scripts/Run-Final-ElevatedVerification.ps1
new file mode 100644
index 0000000..9039c77
--- /dev/null
+++ b/scripts/Run-Final-ElevatedVerification.ps1
@@ -0,0 +1,59 @@
+param(
+    [string]$EvidenceRoot = 'artifacts\evidence\final-elevated'
+)
+
+$ErrorActionPreference = 'Continue'
+$OutputEncoding = [Text.UTF8Encoding]::new($false)
+[Console]::OutputEncoding = $OutputEncoding
+$repository = (Resolve-Path (Join-Path $PSScriptRoot '..')).Path
+$evidence = [IO.Path]::GetFullPath((Join-Path $repository $EvidenceRoot))
+if (-not $evidence.StartsWith($repository + [IO.Path]::DirectorySeparatorChar, [StringComparison]::OrdinalIgnoreCase)) {
+    throw 'Evidence output must remain inside the repository.'
+}
+New-Item -ItemType Directory -Force -Path $evidence | Out-Null
+$failed = $false
+
+function Invoke-VerificationStep {
+    param([string]$Name, [scriptblock]$Action)
+    $path = Join-Path $evidence "$Name.log"
+    "START $Name $(Get-Date -Format o)" | Tee-Object -FilePath $path
+    $exitCode = 0
+    try {
+        & $Action *>&1 | Tee-Object -FilePath $path -Append
+        if ($LASTEXITCODE) { $exitCode = $LASTEXITCODE }
+    }
+    catch {
+        $_ | Out-String | Tee-Object -FilePath $path -Append
+        $exitCode = 1
+    }
+    "END $Name exit=$exitCode $(Get-Date -Format o)" | Tee-Object -FilePath $path -Append
+    if ($exitCode -ne 0) { $script:failed = $true }
+}
+
+$bundle = Join-Path $repository 'build\Release\publish\agent-sandbox-mcp-1.0.0-win-x64'
+$windowsTests = Join-Path $repository 'build\Release\Agent.Windows.Tests\net10.0-windows10.0.26100.0\Agent.Windows.Tests.exe'
+$coreTests = Join-Path $repository 'build\Release\Agent.Core.Tests\net10.0-windows10.0.26100.0\Agent.Core.Tests.exe'
+$plannerTests = Join-Path $repository 'build\Release\Agent.Planner.Tests\net10.0\Agent.Planner.Tests.exe'
+
+Invoke-VerificationStep 'bundle-check' {
+    & (Join-Path $bundle 'agent-mcp.exe') check --config (Join-Path $bundle 'agent.yaml') --lang en
+}
+Invoke-VerificationStep 'windows-security-tests' { & $windowsTests }
+Invoke-VerificationStep 'core-unit-integration-tests' { & $coreTests }
+Invoke-VerificationStep 'planner-unit-tests' { & $plannerTests }
+Invoke-VerificationStep 'e2e-01-stdio' {
+    & (Join-Path $PSScriptRoot 'Operational-E2E.ps1') -Transport stdio
+}
+Invoke-VerificationStep 'e2e-02-http-ipv4' {
+    & (Join-Path $PSScriptRoot 'Operational-E2E.ps1') -Transport http -HttpHost 127.0.0.1
+}
+Invoke-VerificationStep 'e2e-02-http-ipv6' {
+    & (Join-Path $PSScriptRoot 'Operational-E2E.ps1') -Transport http -HttpHost ::1
+}
+
+if ($failed) {
+    Write-Error "Final elevated verification FAILED. Evidence: $evidence"
+    exit 1
+}
+Write-Output "Final elevated verification PASS. Evidence: $evidence"
+exit 0
-- 
cgit v1.2.3