Pre-publication MacBook verification for the brush-ocap engine + host-shell (before shipping crates; cut 0.7.0-rc.1)

[hartsock]

Gate for publishing brush-ocap-* to crates.io and cutting the agent-bridle 0.7.0-rc.1 line. Run this on the owner's MacBook (Seatbelt L3, Apple-Silicon, Homebrew) to confirm everything works on the target platform before the irreversible publish. All local; nothing ships until this is green.

What's staged

• Draft PR feat(shell): carried brush engine (BrushShellTool) [DRAFT — needs brush-ocap-* published] #204 (feat/brush-ocap-engine) — the carried brush engine (BrushShellTool), in-process bash confined by the CommandInterceptor, behind the brush feature. Uses a git dep on the fork, so it's held as draft until publish.
• Fork: hartsock/brush @ brush-ocap (ee58e24) = upstream + the hook (feat(core): add CommandInterceptor exec/open hook to ShellExtensions reubeno/brush#1184) + the brush-ocap-{core,builtins,coreutils-builtins} rename. cargo publish --dry-run on brush-ocap-core is green on Linux.
• host-shell engine + the full-access PATH seed (PR fix(tool-shell): seed PATH in the sandbox-host engine so full-access resolves bare names #203) are already on main.
• newt: the engine-selection surface (--shell-engine, [shell] engine, --full-access→host, newt doctor) is merged (newt #951). newt's brush value currently falls back to host (wiring newt→brush is a follow-up after publish).

Environment

rustup default stable        # need >= 1.87 for std::io::pipe; brush needs 1.88
brew --prefix                # confirm /opt/homebrew on PATH

A. Brush engine builds + confines on macOS (agent-bridle PR #204 branch)

git fetch origin && git checkout feat/brush-ocap-engine
cargo test -p agent-bridle-tool-shell --features brush

Expect: brush_real green — $(...) runs in-process; a restricted-exec out-of-scope command is denied (denied:true, kind:exec) and never runs; in-scope runs. (This is the engine host-shell can't do: confining a restricted exec grant.)

B. Host-shell Seatbelt keystone on macOS

cargo test -p agent-bridle-tool-shell --features host-shell,macos-seatbelt --test host_shell_real

Expect: macos_dynamic_construct_runs_but_out_of_scope_write_is_seatbelt_denied green — sandbox_kind == \"seatbelt\", the in-scope $(...) write succeeds, the out-of-scope write is kernel-denied. Plus the new full_access_seeds_default_path_into_the_child / bare_name_resolves_* (PR #203).

C. Full-access PATH parity on macOS (Homebrew)

Confirm the full-access PATH seed picks up /opt/homebrew/bin. With a Homebrew-only tool installed (e.g. brew install ripgrep):

• Drive the host engine (or the brush engine test harness) with Caveats::top() and cmd: \"rg --version\" (bare name, in /opt/homebrew/bin) → resolves and runs. Pre-fix(tool-shell): seed PATH in the sandbox-host engine so full-access resolves bare names #203 it would not (empty PATH → dash _CS_PATH misses homebrew).
• Also sanity: printf '%s' \"$PATH\" under full-access equals default_exec_path() (the ambient PATH incl. /opt/homebrew/bin).

D. newt end-to-end on macOS (from main)

cd newt-agent && git checkout main && just install-real   # or the real-shell build
newt doctor          # → \"L3 kernel jail (this platform): Seatbelt — available\"; engine readout

Then a real newt --shell-engine host (and --full-access) session; confirm these run and are Seatbelt-jailed:

ls -la
grep -n fn src/**/*.rs      # or any grep
find . -name '*.rs' | head
echo "$(whoami)"            # dynamic construct — safe-subset refuses, host runs
ls | wc -l                  # pipeline

• Confirm a restricted preset ([tui.permissions] preset=\"workspace_dev\") still denies an out-of-scope write (Seatbelt) and that host refuses a restricted-exec grant.
• Confirm the reworded --full-access banner reads the ambient-authority/OCAP prose (#926).

E. Local-inference E2E (the owner's standing bar)

Ollama on the Mac driving newt --shell-engine host (or --full-access) on a task that requires a $(...) one-liner the safe-subset engine refuses — it runs, Seatbelt-jailed, and (restricted preset) an out-of-scope write is denied.

F. Publishability rehearsal (simulate post-publication)

On a scratch copy of PR #204, swap the two brush-ocap-* git deps in agent-bridle-tool-shell/Cargo.toml to version deps and dry-run the chain:

# brush-ocap-core = \"0.5\"  /  brush-ocap-builtins = \"0.2\"   (once published)
cargo publish --dry-run -p agent-bridle-core
cargo publish --dry-run -p agent-bridle-tool-shell --features brush   # should be git-dep-free

Confirm no git = sources remain in any published manifest.

Version bump (on green)

Cut 0.7.0-rc.1 (semver pre-release; note the dash/dot form, not 0.7.0rc1):

• Publish brush-ocap-{core,builtins} (and -coreutils-builtins if the carried-coreutils refactor lands) to crates.io — local publish from gnuc, causal order core→builtins.
• Swap PR feat(shell): carried brush engine (BrushShellTool) [DRAFT — needs brush-ocap-* published] #204's git deps → crates.io version deps; un-draft; merge.
• Bump the agent-bridle workspace version 0.1.0 → 0.7.0-rc.1; just publish-crates (core, tool-shell, tool-web, facade, mcp).
• Bump newt's agent-bridle pin to the published 0.7.0-rc.1; wire newt's brush engine value to BrushShellTool; cut a newt rc.

Exit criteria

A–F all green on the MacBook ⇒ publish brush-ocap-* ⇒ swap deps ⇒ merge #204 ⇒ cut 0.7.0-rc.1. Any red blocks the publish (crate names are permanent).

Refs: PR #204, #203, agent-bridle#20, newt #951 / #868 / #926, reubeno/brush#1184.

[hartsock]

Addendum — Section A.1: carried coreutils (issue #206, now runnable in PR #204)

git checkout feat/brush-ocap-engine
cargo test -p agent-bridle-tool-shell --features carried-coreutils --test carried_coreutils
# and a manual scrubbed-env check (proves no host tools are used):
BIN=$(cargo build -p agent-bridle-tool-shell --features carried-coreutils --bin dispatch_host --message-format=json 2>/dev/null | python3 -c "import sys,json;[print(json.loads(l)['executable']) for l in sys.stdin if l.strip().startswith('{') and json.loads(l).get('executable')]" | tail -1)
mkdir -p /tmp/ct && echo hi > /tmp/ct/f.txt
env -i "$BIN" "ls /tmp/ct"      # → lists f.txt via carried uutils ls, no /bin/ls
env -i "$BIN" "cat /tmp/ct/f.txt"  # → hi

Expect success with the environment scrubbed — proving carried ls/cat run in-process against the dispatch-capable binary with no Homebrew//bin tools.

[hartsock]

MacBook gate run — 2026-07-06 (Apple-Silicon, Seatbelt L3, Homebrew, rustc 1.95)

Ran the A–F verification on the owner MacBook. Inference for E: the home-lab Ollama on dgx1 (ornith:35b).

#	Section	Result
A	Brush engine confines (--features brush, fork ee58e24)	✅ PASS — brush_real 3/3: $(...) runs in-process; a restricted-exec out-of-scope command is denied; in-scope runs
B	Host-shell Seatbelt keystone + PATH seed	✅ PASS — host_shell_real 6/6 incl. macos_dynamic_construct_runs_but_out_of_scope_write_is_seatbelt_denied, full_access_seeds_default_path_into_the_child, bare_name_resolves_*, under BRIDLE_REQUIRE_SEATBELT=1
C	Homebrew PATH parity	✅ PASS — default_exec_path() = ambient $PATH (incl. /opt/homebrew/bin); rg present; bare-name resolution green
D	newt e2e (build + doctor)	✅ PASS — real-shell build OK; --shell-engine surface present; newt doctor → "L3 kernel jail (this platform): Seatbelt — available" + engine readout; dgx1/gnuc Ollama OK
E	Local-inference (dgx1 ornith:35b)	✅ E1 PASS — model drove echo "E1OUT=$(whoami)" through the host engine → E1OUT=<user> (a dynamic construct the safe-subset engine refuses). E2: under the default workspace_dev preset (exec restricted), --shell-engine host honestly refuses — "exec does not permit 'sandbox-host engine (exec restricted)' … refuses rather than claim confinement it can't guarantee (ADR 0019 D2)." Correct fail-closed. The live Seatbelt out-of-scope-write denial through newt needs the deferred fs-fenced+exec-All preset (workspace_dev_fullshell, newt #868 item 3); the jail itself is proven by B.
#206	Carried coreutils (dispatch-as-library)	✅ PASS — keystone 2/2 (carried_ls/carried_cat run in-process with the env scrubbed — env_clear(), no PATH, no host tools — via re-exec of the dispatch-capable host bin on Apple-Silicon); macOS carried-coreutils,host-shell,macos-seatbelt combo green (0 failures)
F	Publishability	⚠️ agent-bridle-core dry-run clean; agent-bridle-tool-shell carries the expected brush-ocap-* git-deps → dependency 'brush-ocap-builtins' does not specify a version. This is the documented pre-publish state; the git→version-dep swap + re-verify happens at publish.

Verdict

The platform-confinement gate is GREEN on this Mac. Brush confines a restricted exec grant in-process; the host engine runs full grammar Seatbelt-jailed and honestly fails closed when it can't confine exec; Seatbelt L3 is available and enforcing; carried coreutils run with no host tools (distroless story proven on macOS); Homebrew bare names resolve under full-access; newt builds/reports correctly; dgx1 inference drives it end-to-end.

Nothing agent-bridle-side on this Mac blocks 0.7.0-rc.1. Remaining steps are the irreversible publish sequence itself (publish brush-ocap-{core,builtins,coreutils-builtins} → swap #204's git deps to version deps → re-verify F git-dep-free → un-draft/merge #204 → bump 0.1.0 → 0.7.0-rc.1).

Non-blocking follow-ups: the E2 live fs-jail demo through newt awaits workspace_dev_fullshell (#868 item 3), and the newt doctor readout could add a carried-coreutils line now that it's real.

🤖 owner-MacBook harness run

[hartsock]

Closing (2026-07-10 triage): the MacBook A–F gate run recorded above is all-PASS, 0.7.0-rc.1 was cut, and 0.7.1 has since shipped to crates.io. The one deferred item (live Seatbelt out-of-scope-write through newt under a fs-fenced+exec-All preset) is tracked on the newt side (newt-agent#868 item 3), not here.