Exact

Exact Union RegExp

Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Transaction Science 96cd5e98a0 sandbox: flow across a run's checkpoints — an untrusted read closes the sinks that follow ... Sweep 2026-10-19 item #7, second half, by the owner's decision. Each checkpoint was decided alone: a unit could read data an attacker writes and later reach an endpoint it is granted, each call passing its own check, and nothing connected the read to the egress. The Enforcer is stateless by design (C2), so the connection had to be state the run carries explicitly. sandbox-capability (SPEC §5.8): - Grants.flow: FlowGrant { untrusted: [FlowSource { kind: Path|Kv|Program, pattern, origin }], tainted_may: [FlowSink { kind: Egress|Exec, target, accepts }] }. Omitted when empty, so a grant set without it keeps its bytes. - RunTaint: the origins of untrusted data a run has read; only grows. - Two pure Enforcer functions: taints(source), the origins a read adds; and may_reach(sink, &taint), where a tainted run reaches a sink only where tainted_may opens it to EVERY origin it carries (entries combine; `*` opens to any target or origin; an unopened sink is closed). Additional to the sink's capability, never instead. A decision stays a function of its inputs, the run's taint among them, as I/O counters already are. sandbox-exec-wasm (S2, where the live checkpoints are): HostState carries the taint. A storage or kv read that returns data, and a program's output, taint the run from a source the grant marks; egress and exec are refused with TAINTED (-6, distinct from DENIED) when the grant has not opened them to the run's origins. sandbox-exec-os is untouched: it refuses network and process grants outright, so no sink is reachable there. sandbox-runtime: grants_content_id binds flow_untrusted and flow_tainted_may when present, so the flow grant is part of the capability surface (SPEC §1.2); a grant without one keeps its id. Conformance class C13: sequence vectors (a run's calls in order; reads check the origins after, sinks whether reachable), in code and in the new conformance/v1/flow.json. The pack count goes to 13. SPEC §5.8, spec/capabilities.md (the enforcer contract: pure, with the run's history as an input), spec/conformance.md, conformance/v1/README.md; SPEC §10's class list was missing C11 and C12 and now lists C11–C13. Residuals, stated in §5.8: an unmarked source is read as the principal's data, and a tainted run's writes are not marked, so data can lose its taint between runs. Note: running gen_vectors also rewrites attestation.json and negative.json with "mechanism": null, a drift that predates this change; left out of it. Tests: - capability: three unit tests (a read carries every matching source's origin, kinds do not cross, `*` is any program; a tainted run reaches only what is opened to all it carries, entries combine; the taint only grows and an empty flow grant is not encoded). - exec-wasm: three end-to-end through real guests (an untrusted storage, kv or program read closes the egress that follows, a clean read leaves it open; an untrusted read closes the launch that follows; a sink opens only to the origins named, and no flow grant is untouched). - runtime: the flow grant is bound into the grant id, every part of it. - C13. Mutation testing: 17 mutants; 16 killed, 1 equivalent (the clean-run early return in may_reach: an empty taint already satisfies "every origin"). Verified on the build host: sandbox-rs 428 tests (--locked); every conformance class passes, C13 in code and from flow.json; clippy -D warnings clean on sandbox-capability, -exec-wasm, -runtime, -conformance. Repo checks pass. Co-Authored-By: Claude Opus 5.5 <[email protected]>		2026-10-21 10:49:52 -04:00
..
attestation.md	sandbox: one report_data binding for a run, a relying-party challenge, and evidence a third party can verify	2026-10-21 07:41:40 -04:00
build.md
capabilities.md	sandbox: flow across a run's checkpoints — an untrusted read closes the sinks that follow	2026-10-21 10:49:52 -04:00
conformance.md	sandbox: flow across a run's checkpoints — an untrusted read closes the sinks that follow	2026-10-21 10:49:52 -04:00
durable-runs.md
eat.md
environment-manifest.md
mcp.md
receipts.md	sandbox-exec-microvm, sandbox-exec-wasm, sandbox-meter: grade nominal-cost figures Estimator	2026-10-11 10:11:54 -04:00
tiers.md	Add aac, map, sandbox standards; catalog the standards family	2026-06-07 17:04:36 -04:00