agent: OS-level isolation for the agent tool boundary (SPEC §10)

harnessd gains --socket mode (Unix socket, trusted uid, mutating ops
serialized); the harness client speaks socket when
HOTPATH_HARNESS_SOCKET is set. scripts/agent-isolated.sh launches an
attempt with the agent tree confined — mountns mode (repo bind-mounted
read-only, CAP_SYS_ADMIN/CAP_SYS_PTRACE dropped; no credential copying)
or user mode (unprivileged hpagent, bench-metal shape).
scripts/isolation-check.sh + just isolation-check verify the boundary
from the agent's side: 19 checks, both modes, all passing — repo
writes, forged ledger INSERTs, trust-binary replacement, rw remounts,
and userns re-entry all refused; the harnessd socket door works.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EcKPWQ3MQD4NdEHwar96u2

scripts/agent-isolated.sh

@@ -0,0 +1,107 @@
+#!/bin/sh
+# Launch one unattended optimization attempt behind an OS-level boundary
+# (SPEC §10). Run as the trusted uid (root in this container):
+#
+#   scripts/agent-isolated.sh <target> <run-id> [max-turns]
+#
+# Two isolation modes (HOTPATH_ISOLATION, default "mountns"):
+#
+#   mountns — this container's boundary. The agent process tree (Claude
+#     CLI + MCP server + harness client) runs in a private mount
+#     namespace where the repo is bind-mounted READ-ONLY, with
+#     CAP_SYS_ADMIN and CAP_SYS_PTRACE removed from the bounding set so
+#     the mount cannot be undone (verified: remount and userns re-entry
+#     both refused). Repo writes fail with EROFS no matter the uid; the
+#     CLI's own auth state (under $HOME) stays untouched. No credential
+#     copying.
+#
+#   user — the bench-metal shape (docs/infra.md). The agent loop runs as
+#     the unprivileged user 'hpagent' whose only door into the repo is
+#     the harnessd socket. Requires the agent user to have its own API
+#     credentials (CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY in its
+#     environment) — a parent session's root-owned auth is deliberately
+#     NOT copied across the boundary.
+#
+# In both modes harnessd + the verdict pipeline run OUTSIDE the boundary
+# as the trusted uid and own every write into the repo (git apply,
+# ledger rows, pending/ evidence). Verify the boundary any time with
+# scripts/isolation-check.sh.
+set -eu
+
+ROOT=$(cd "$(dirname "$0")/.." && pwd)
+TARGET=${1:?usage: agent-isolated.sh <target> <run-id> [max-turns]}
+RUN_ID=${2:?usage: agent-isolated.sh <target> <run-id> [max-turns]}
+MAX_TURNS=${3:-40}
+MODE=${HOTPATH_ISOLATION:-mountns}
+
+AGENT_USER=hpagent
+SOCK_DIR=/run/hotpath
+SOCK=$SOCK_DIR/harness.sock
+
+[ "$(id -u)" -eq 0 ] || { echo "must run as the trusted uid (root)" >&2; exit 1; }
+
+# --- no world-writable holes in the repo ------------------------------------
+# In user mode the boundary is filesystem permissions; a single o+w path
+# would void it. mountns mode doesn't need this, but a hole is still a
+# smell worth failing on.
+HOLES=$(find "$ROOT" -perm -o+w \( -type f -o -type d \) 2>/dev/null || true)
+if [ -n "$HOLES" ]; then
+    echo "refusing to launch: world-writable paths inside the repo:" >&2
+    echo "$HOLES" >&2
+    exit 1
+fi
+
+# --- trust-layer daemon (outside the boundary) --------------------------------
+( cd "$ROOT" && cargo build -q -p harnessd -p verdict )
+
+mkdir -p "$SOCK_DIR"
+if [ ! -S "$SOCK" ]; then
+    ( cd "$ROOT" && setsid ./target/debug/harnessd --socket "$SOCK" \
+        >>/var/log/hotpath-harnessd.log 2>&1 & )
+    for _ in $(seq 1 50); do [ -S "$SOCK" ] && break; sleep 0.1; done
+    [ -S "$SOCK" ] || { echo "harnessd socket never appeared" >&2; exit 1; }
+fi
+
+run_loop="python3 -m hotpath_agent.loop $TARGET --run-id $RUN_ID --max-turns $MAX_TURNS --repo-root $ROOT"
+
+case "$MODE" in
+mountns)
+    chmod 600 "$SOCK"   # uid 0 only; the confined tree is still uid 0
+    exec unshare -m sh -c "
+        mount --bind '$ROOT' '$ROOT' &&
+        mount -o remount,bind,ro '$ROOT' &&
+        exec setpriv --bounding-set -sys_admin,-sys_ptrace --inh-caps -all \
+            env HOTPATH_HARNESS_SOCKET='$SOCK' \
+                HOTPATH_REPO_ROOT='$ROOT' \
+                PYTHONPATH='$ROOT/agent' \
+            $run_loop"
+    ;;
+user)
+    id "$AGENT_USER" >/dev/null 2>&1 || useradd -m -s /bin/sh "$AGENT_USER"
+    HP_HOME=$(getent passwd "$AGENT_USER" | cut -d: -f6)
+    chown root:"$AGENT_USER" "$SOCK"
+    chmod 660 "$SOCK"
+    # The container's TLS-intercepting proxy CA lives under /root (mode
+    # 700); the agent user needs a readable copy to reach the API.
+    CA_SRC=${HOTPATH_CA_SRC:-/root/.ccr/ca-bundle.crt}
+    CA=/etc/hotpath-ca.crt
+    [ -f "$CA_SRC" ] && install -m 644 "$CA_SRC" "$CA"
+    # setpriv preserves the environment (proxy/API routing vars); we
+    # override HOME and every CA var that pointed under /root. The agent
+    # user must bring its own API credentials — see header.
+    exec setpriv --reuid "$AGENT_USER" --regid "$AGENT_USER" --init-groups \
+        env HOME="$HP_HOME" USER="$AGENT_USER" LOGNAME="$AGENT_USER" \
+            HOTPATH_HARNESS_SOCKET="$SOCK" \
+            HOTPATH_REPO_ROOT="$ROOT" \
+            PYTHONPATH="$ROOT/agent" \
+            SSL_CERT_FILE="$CA" NODE_EXTRA_CA_CERTS="$CA" \
+            CURL_CA_BUNDLE="$CA" REQUESTS_CA_BUNDLE="$CA" \
+            GIT_SSL_CAINFO="$CA" AWS_CA_BUNDLE="$CA" \
+            NIX_SSL_CERT_FILE="$CA" GRPC_DEFAULT_SSL_ROOTS_FILE_PATH="$CA" \
+        $run_loop
+    ;;
+*)
+    echo "unknown HOTPATH_ISOLATION mode: $MODE (mountns|user)" >&2
+    exit 1
+    ;;
+esac