b0559f3e0d
Ingests the credential-injection pattern the microVM-sandbox field converged on (Notion's Workers run on Vercel Firecracker microVMs with network-level credential injection), and adds the two things that pattern ships without: the secret held only by REFERENCE, and an audit commitment — both bound into the Sandbox standard's existing capability model. A NetworkGrant may now carry `credentials: Vec<EgressCredential>`. Each names an authorized egress `endpoint`, a `secret_ref` HANDLE the enforcement boundary resolves in its own keystore OUTSIDE the sandbox, and an `Injection` mode (Bearer / Header / Query / BasicAuth) describing how the resolved secret is applied to the request. The unit makes authenticated calls without ever holding the key: a compromised or hallucinating agent inside the sandbox cannot read, log, or exfiltrate a credential it was never given. The grant — and any receipt over it — carries only the reference, never the material. Two invariants: - injection ⊆ egress. `Enforcer::credential_for(endpoint)` returns a credential only when the endpoint is BOTH on the egress allowlist and has a declared credential, so injection can never reach further than egress even if the grant is malformed. `NetworkGrant::injection_within_egress()` flags such a grant at mint time; the enforcer is defensive regardless. - reference, not value. `EgressCredential::commitment()` content-addresses the (endpoint, secret_ref, mode) decision, so an attestation can record WHICH credential was injected for WHICH call without exposing the secret — the audit primitive Notion/Vercel lack. Backward compatible: `credentials` skips serialization when empty, so a grant with none is byte-identical to one minted before the field existed. The published sandbox conformance vectors are unchanged and still verify (empty credential set omitted; asserted by test). Five tests: injection only for authorized egress; injection can never exceed egress even for a malformed grant; the reference is recorded while no secret material ever appears in the encoding; commitments distinguish credentials without the secret; empty sets are omitted. sandbox-capability clippy-clean; full sandbox workspace green (one pre-existing warning in sandbox-conformance/vectors.rs, unrelated and untouched). Co-Authored-By: Claude Opus 4.8 <[email protected]>
15 lines
408 B
TOML
15 lines
408 B
TOML
[package]
|
|
name = "sandbox-capability"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
repository.workspace = true
|
|
rust-version.workspace = true
|
|
description = "Sandbox — the capability-grant model and deny-by-default enforcer (SPEC §5, spec/capabilities.md)."
|
|
|
|
[dependencies]
|
|
sandbox-schema.workspace = true
|
|
serde.workspace = true
|
|
|
|
[dev-dependencies]
|
|
serde_json.workspace = true
|