From afda41540167f7adf2b7884c845c89e38915e9ba Mon Sep 17 00:00:00 2001 From: hartsock Date: Sat, 4 Jul 2026 13:47:16 -0400 Subject: [PATCH 1/2] docs(reviews): Seatbelt L3 backend run live on a developer Mac MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Records the first owner-Mac exercise of the Seatbelt kernel proofs on real Apple-Silicon hardware (main @ bacb3b1), post-ADR-0019 / host-shell (#199): - All kernel proofs pass under RUSTFLAGS="-D warnings" + BRIDLE_REQUIRE_SEATBELT=1 — fs/exec/net axes, the ShellTool e2e path, and the ADR 0019 host-shell keystone. Genuinely exercised, not skipped. - The PR#195 net-proxy CI flake did not reproduce (0/40 parallel runs), but the cause is inspection-confirmed: fenced_child_reaches_allowed_via_proxy… is the only loopback-exercising net_proxy test that omits net_test_lock(). One-line fix suggested; issue to follow. Cross-links the full results + downstream adoption plan in newt-agent/docs/testing/seatbelt-live-uat.md. Docs-only; no code on main altered. Co-authored-by: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01UGQ2qe2Z4psJbv5nrg2HX4 --- .../2026-07-04-seatbelt-live-owner-mac.md | 58 +++++++++++++++++++ 1 file changed, 58 insertions(+) create mode 100644 docs/reviews/2026-07-04-seatbelt-live-owner-mac.md diff --git a/docs/reviews/2026-07-04-seatbelt-live-owner-mac.md b/docs/reviews/2026-07-04-seatbelt-live-owner-mac.md new file mode 100644 index 0000000..770293b --- /dev/null +++ b/docs/reviews/2026-07-04-seatbelt-live-owner-mac.md @@ -0,0 +1,58 @@ +# Review — Seatbelt L3 backend, run live on a developer Mac + +- Date: 2026-07-04 +- Scope: run the `check-macos` kernel proofs on real Apple-Silicon hardware + (not the GitHub `macos-latest` runner) against `main` @ `bacb3b1` — the first + owner-Mac exercise of the Seatbelt L3 line since ADR 0019 and the host-shell + engine (#199) landed. Includes a targeted chase of the PR #195 net-proxy CI + flake. +- Outcome: **all Seatbelt kernel proofs pass on real hardware; ADR 0019's + premise holds.** One latent test-serialization gap identified (not a product + bug). No code on `main` altered by this review. +- Method: ran the exact `.github/workflows/ci.yml` `check-macos` commands with + `RUSTFLAGS="-D warnings"` and `BRIDLE_REQUIRE_SEATBELT=1`, plus a 40× parallel + flake-repro loop of the tool-shell lib suite. + +--- + +## TL;DR + +The macOS L3 jail is **real on real hardware**. Every kernel proof that spawns a +`sandbox-exec` child and asserts a kernel denial passed — fs read/write, exec +allow-list (incl. the interpreter-trampoline and dyld-linking cases ADR 0014 +turns on), empty-net and loopback-only net, the net-proxy egress fence, the +`ShellTool` end-to-end path, and the **ADR 0019 host-shell keystone** +(`macos_dynamic_construct_runs_but_out_of_scope_write_is_seatbelt_denied`): a +`$(...)` the subset engine refuses *runs*, yet its out-of-scope write is +kernel-denied, `sandbox_kind == "seatbelt"`. `BRIDLE_REQUIRE_SEATBELT=1` means +these were genuinely exercised, not skipped +(`proof_gate_required_but_unsupported_is_a_failure` guards that). Full results +and the downstream newt adoption plan live in the embedder repo: +[`newt-agent/docs/testing/seatbelt-live-uat.md`](https://github.com/Gilamonster-Foundation/newt-agent/blob/main/docs/testing/seatbelt-live-uat.md). + +## The one finding — a test-serialization gap (not a product bug) + +PR #195's macOS CI leg once failed on +`net_proxy::…::fenced_child_reaches_allowed_via_proxy_denied_refused_direct_kernel_blocked` +("Empty reply from server"), while `main` stayed green. On this Mac it **did not +reproduce** (0/40 parallel runs; 41/41 including the proof run) — an M4 is too +fast/uncontended to lose the race. + +But inspection pins the cause: of the 17 `net_proxy` tests, every one that binds +a loopback listener and does an HTTP exchange serializes on the module's +`net_test_lock()` — **except** this test, which is the single heaviest network +test (loopback origin + proxy + a real `curl` child) yet the only such test that +omits the lock. Run concurrently with a sibling proxy test it races on loopback, +matching the CI symptom. + +**Suggested fix (one line, matches every sibling):** add +`let _serial = net_test_lock();` as the test's first statement in +`agent-bridle-tool-shell/src/net_proxy.rs`. Filed as an issue with this +evidence; a fix PR is held pending review. + +## Environment + +Apple M4 MacBook, macOS Darwin 25.5.0 (arm64); rustc/cargo 1.95.0 (Homebrew); +`/usr/bin/sandbox-exec` present. clippy `-D warnings` was clean on this +toolchain, and `--no-default-features --features host-shell` compiled in +isolation (the corner `--all-features` never exercises). From 0bbb42755616fc178d080c2dd814a7a73a6dd7f3 Mon Sep 17 00:00:00 2001 From: hartsock Date: Mon, 6 Jul 2026 13:24:54 -0400 Subject: [PATCH 2/2] docs(reviews): reference net-proxy flake issue #207 + 0.7.0-rc.1 gate follow-up - Replace the stale "filed as an issue" line with the real issue number (#207), noting the finding is still applicable on main as of 2026-07-06. - Add a Follow-up section pointing to the #205 0.7.0-rc.1 MacBook gate as the fuller re-verification of the Seatbelt line. Docs-only. Co-authored-by: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01UGQ2qe2Z4psJbv5nrg2HX4 --- docs/reviews/2026-07-04-seatbelt-live-owner-mac.md | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/docs/reviews/2026-07-04-seatbelt-live-owner-mac.md b/docs/reviews/2026-07-04-seatbelt-live-owner-mac.md index 770293b..138c84c 100644 --- a/docs/reviews/2026-07-04-seatbelt-live-owner-mac.md +++ b/docs/reviews/2026-07-04-seatbelt-live-owner-mac.md @@ -47,8 +47,16 @@ matching the CI symptom. **Suggested fix (one line, matches every sibling):** add `let _serial = net_test_lock();` as the test's first statement in -`agent-bridle-tool-shell/src/net_proxy.rs`. Filed as an issue with this -evidence; a fix PR is held pending review. +`agent-bridle-tool-shell/src/net_proxy.rs`. Filed as **#207** (still applicable +on `main` as of 2026-07-06); a one-line fix PR is a follow-up. + +## Follow-up (2026-07-06) + +The Seatbelt line was re-verified on this MacBook as part of the **0.7.0-rc.1** +pre-publication gate (#205): the host-shell Seatbelt keystone, the brush engine's +in-process confinement, Homebrew PATH parity, carried coreutils under a scrubbed +env (#206), and a dgx1-inference end-to-end run all pass. This review remains the +record of the first owner-Mac Seatbelt run; #205 carries the fuller matrix. ## Environment