Archived

This repository has been archived on 2026-07-08. You can view files and clone it. You cannot open issues or pull requests or push a commit.

Files

tegwick 5466330cf4 docs: add workplans SAND-WP-0010–0012 for remaining gaps

Cloud adapters (E2B/Modal/BYOK/fin-hub), reachability and consumer
profiles, Packer orchestration; update gap analysis and SCOPE.

2026-06-24 12:47:08 +02:00

3.3 KiB

Raw Blame History

id, type, title, domain, repo, status, owner, topic_slug, created, updated

id	type	title	domain	repo	status	owner	topic_slug	created	updated
SAND-WP-0011	workplan	Reachability and consumer profiles	infotech	sand-boxer	ready	codex	custodian	2026-06-24	2026-06-24

Reachability and consumer profiles

Formalize ops-bridge tunnel attachment in reachability descriptors and ship first-class profiles for glas-harness and snuggle-inventor consumers.

Gap analysis P6/P7: history/2026-06-24-post-wp0007-intent-scope-gap-analysis.md

Predecessor: SAND-WP-0010 (cloud adapters — proposed)
Follow-on: SAND-WP-0012 (Packer orchestration)

Note: Can proceed in parallel with SAND-WP-0010 where profiles are self-hosted.

Reachability descriptor enrichment

id: SAND-WP-0011-T01
status: todo
priority: high

Extend Reachability model: optional tunnel (local port / alias), tunnel_via (ops-bridge route id), identity (warden actor hint). Populate from profile reachability spec + SANDBOXER_TUNNEL_* env on compose-ssh / vm-packer. Document contract in docs/meta-framework.md; sand-boxer does not own tunnels.

ops-bridge integration helper

id: SAND-WP-0011-T02
status: todo
priority: medium

Optional sandboxer reachability show <id> (or enrich get output) surfacing SSH one-liner and tunnel status pointer (ops-bridge MCP / CLI doc link). No tunnel bring-up in sand-boxer — pointer only.

profile.agent-dev

id: SAND-WP-0011-T03
status: todo
priority: high

Profile for glas-harness: longer TTL defaults, actor: agt examples, route prefer-self-hosted. Extension ext.compose-ssh or vm-packer attach variant. Update docs/integrations/glas-harness.md with real profile id.

profile.build (snuggle-inventor)

id: SAND-WP-0011-T04
status: todo
priority: high

Build sandbox profile binding profile.vm-haskell-build or compose path; setup.instructions placeholder; secret_refs list on profile (resolution v0: validate refs exist via warden route, inject at provision boundary only). Update docs/integrations/snuggle-inventor.md.

Secret boundary v0

id: SAND-WP-0011-T05
status: todo
priority: medium

SetupSpec.secret_refs resolution in manager pre-provision hook: fetch via operator-documented OpenBao path; pass to extension handle; never store on SandboxStatus or emit to State Hub. Tests with mocked resolver.

Consumer smoke scripts

id: SAND-WP-0011-T06
status: todo
priority: medium

scripts/smoke-agent-dev.sh, scripts/smoke-build-profile.sh (dry-run or CoulombCore gated). Integration section in each consumer doc.

Tests and docs

id: SAND-WP-0011-T07
status: todo
priority: high

Model tests for reachability fields; profile loader tests; update SCOPE.md profile catalog. make check green.

Out of scope

Item	Track
glas-harness tool execution	glas-harness repo
snuggle code generation	snuggle-inventor repo
ops-bridge tunnel automation	ops-bridge repo

Acceptance criteria

profile.agent-dev and profile.build load and create via CLI
Reachability JSON includes tunnel metadata when profile declares ops-bridge
secret_refs resolved at boundary; absent from agent-visible status payload
Consumer integration docs reference real profile ids

3.3 KiB Raw Blame History