feat(autonomy): in-session candidate build leg - ExecAsync carries the compile (P3) - #304
Merged
Merged
Conversation
…e compile The in-container toolchain change the known-limitation docs tracked. With Nexo:Autonomy:BuildCandidateInSession=true, every iteration must compile its candidate INSIDE the attested session via ISandboxedSession.ExecAsync; an iteration without a session refuses fail-closed rather than silently building on the host, and the validator rejects the flag without UseSandboxSessions at boot (an always-refusing loop is a configuration error, not a policy). SessionCandidateBuild compiles the EXACT bytes every certification-path compile sees (CandidateSourceWrapper.Wrap - A1.2 extended to the session): source, reference assemblies, NuGet.config, and the generated project all stream through ExecAsync as base64 argv chunks, because sessions may be sibling containers on a remote daemon where host bind mounts are meaningless. The generated project has zero PackageReferences and cleared package sources, so restore succeeds offline from the SDK's installed packs alone - anything needing a download fails loudly instead of waiting on a network the session does not have. A passed build becomes a session-build certificate input binding the toolchain version and candidate source hash to the session id. A failed build terminates the iteration as an explained failure with the step's diagnostic tail; the candidate never reaches the gate. Honesty boundary, stated in the harness docs: session-build claims COMPILATION containment only. The witness and mutation runs still execute in the harness process; sandbox-spec/attestation inputs remain provisioning evidence. The flight spike gains --session-build (pinned mcr.microsoft.com/dotnet/sdk:9.0 session image) and run-first-flight.ps1 gains -SessionBuild. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…-session The flight re-flown from d71d045 with -SessionBuild: the candidate compiled INSIDE the attested mcr.microsoft.com/dotnet/sdk:9.0 session (digest sha256:35048e3a..., engine 29.7.2) on the live daemon, offline, and the signed certificate carries six input kinds including session-build. AdmittedAndSwapped in 7.0s; zero sessions leaked; the dry leg and the 20/20 in-container suite passed alongside. Known limitation 4 is rewritten to the narrowed truth: session containment now covers COMPILATION (opt-in, fail-closed); witness and mutation execution still run in the harness process, and closing that means shipping a certification runner into the image - a separate step, not an increment. SessionEnvironmentInputs' remarks updated to match: the three environment inputs stay provisioning evidence; session-build is the separate compilation-containment claim. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Phase 3 of the post-merge plan: the in-session candidate build leg — the "in-container toolchain change" that
docs/certification-evidence.mdknown-limitation 4 tracked. WithNexo:Autonomy:BuildCandidateInSession=true, every iteration must compile its candidate inside the attested sandbox session viaISandboxedSession.ExecAsync; a passed build becomes asession-buildcertificate input.Stacked on #303 (the first flight), because the acceptance run for this leg is a flight.
How the compile gets into the session
SessionCandidateBuildcompiles the exact bytes every certification-path compile sees —CandidateSourceWrapper.Wrap(source)— extending A1.2 (analyzer and compiler see the same bytes) to: host compile and session compile see the same bytes.NuGet.config, and the generated project stream throughExecAsyncas base64 argv chunks (64 KiB raw per chunk, under Linux's per-argument ceiling), appended and decoded inside the session. The chunk rides as its own argv element — no shell-quoting surface.PackageReferences (references are directHintPathDLLs uploaded with the request) and cleared NuGet sources: restore succeeds from the SDK's installed targeting packs alone, and anything that would need a download fails loudly instead of waiting on a network the session doesn't have (NetworkAccess.None).UseSandboxSessionsrefuses at boot via the options validator — an always-refusing loop is a configuration error, not a policy.The honesty boundary, restated
session-buildclaims compilation containment only. The witness and mutation runs still execute in the harness process;sandbox-spec/attestationinputs remain provisioning evidence. The harness docs and known-limitation 4 now say exactly this — the limitation narrows, it does not vanish.Flight record (P3 acceptance)
Recorded in
docs/certification-evidence.md: the flight re-flown with-SessionBuildagainst the live daemon and the pinnedmcr.microsoft.com/dotnet/sdk:9.0session image — the candidate compiled inside the attested session, and the certificate carries thesession-buildinput.Testing
AutonomousIterationHarnessTests(+3 facts: in-session compile records the input and swaps; toolchain/step failure terminates as explained failure with teardown; no-session refuses fail-closed) andAutonomyCompositionTests(+BuildCandidateInSessionmisconfiguration row, binding)--session-build(fake sessions): PASS-SessionBuild(live daemon, SDK image): PASSmake kernel-coverage-gate— runs in CI (Infrastructure paths touched)🤖 Generated with Claude Code