Coder/deepseek-harness
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: reject the landstrip evaluation for the win32 sandbox rung

Browse Source 
User verdict: landstrip is not battle-tested — a days-old,
single-maintainer project (~48 GitHub stars at rejection), which a
security-invariant dependency cannot be. The note moves
proposed/feature -> rejected/feature with the verdict on the Status
line; the sandbox note's deferred-phases cross-link now records the
rejection instead of instructing an evaluation, and the NIH roll-up's
pointer follows. Supersedes this branch's earlier cross-link commit.
This commit is contained in:
Tianyi Cui
2026-07-27 00:55:32 +08:00
parent d0b87e8c0f
commit f520479663
9 changed files with 12 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
.agents/notes/implemented/feature/2026-07-06-sandbox.i18n.yaml
View File

@@ -2,5 +2,5 @@
# side as of the last confirmed-consistent state. Both languages carry equal authority;
# after editing either side, bring the other along and re-record with:
# pnpm run verify-translation-pairing --write
2026-07-06-sandbox.md: a9af53adfdabc6919113d8c6cb00c0b5f9e58c1f
2026-07-06-sandbox.zh.md: 6db1a914f1560e17296b7ea28f8c7367ecc58a81
2026-07-06-sandbox.md: c6883873192f15ba2982436e156d8795396c0148
2026-07-06-sandbox.zh.md: d84df9b06b15dd296801073d381603f34cfd2878

2
.agents/notes/implemented/feature/2026-07-06-sandbox.md
View File

@@ -128,7 +128,7 @@ Each phase gets its full design when picked up, validated against the code at th
- **Second consumer** — `subagent-acp` optionally confines child agents (per-call policy; unconfined default — a child agent must write its own persistence).
- **More environments** — an environment-coherent capability group example (e.g. bash+fs against one container).
- **Windows chain** — `PLATFORM_CHAINS.win32` is reserved and empty (fail-closed); filling it means a confinement runner from the AppContainer/restricted-token family, shipped from its own repository on the `node-addon-landlock-run` template, plus its profile dialect and denial/runner-failure signatures. Before implementing this rung, complete the [landstrip evaluation gate](../../proposed/feature/2026-07-26-evaluate-landstrip-for-windows-sandbox-rung.md).
- **Windows chain** — `PLATFORM_CHAINS.win32` is reserved and empty (fail-closed); filling it means a confinement runner from the AppContainer/restricted-token family, shipped from its own repository on the `node-addon-landlock-run` template, plus its profile dialect and denial/runner-failure signatures. Wrapping the third-party landstrip runner instead was [considered and rejected](../../rejected/feature/2026-07-26-evaluate-landstrip-for-windows-sandbox-rung.md) — not battle-tested enough for a security invariant.
## Alternatives considered

2
.agents/notes/implemented/feature/2026-07-06-sandbox.zh.md
View File

@@ -128,7 +128,7 @@ fs/web/todo 在进程内执行，因此它们的沙箱语义是各自 seam 层
- **第二个消费方**——`subagent-acp` 可选地约束子 agent（按调用策略；默认无约束——子 agent 必须写入自己的持久化）。
- **更多环境**——环境一致的能力组示例（如 bash+fs 对一个容器）。
- **Windows 链**——`PLATFORM_CHAINS.win32` 保留为空（失败关闭）；填充它意味着来自 AppContainer/restricted-token 家族的约束 runner，从其自己的仓库按 `node-addon-landlock-run` 模板交付，加上其 profile 方言和拒绝/runner 失败签名。在实现该梯级之前，先完成 [landstrip 评估门禁](../../proposed/feature/2026-07-26-evaluate-landstrip-for-windows-sandbox-rung.md)。
- **Windows 链**——`PLATFORM_CHAINS.win32` 保留为空（失败关闭）；填充它意味着来自 AppContainer/restricted-token 家族的约束 runner，从其自己的仓库按 `node-addon-landlock-run` 模板交付，加上其 profile 方言和拒绝/runner 失败签名。改为包装第三方 landstrip runner 的方案[经考虑后已驳回](../../rejected/feature/2026-07-26-evaluate-landstrip-for-windows-sandbox-rung.md)——对安全不变式而言，它还远未经过实战检验。
## 曾考虑的替代方案