feat(paw-compute): computer attach access + governed Exec surface - #462
Draft
nerdsane wants to merge 6 commits into
Draft
feat(paw-compute): computer attach access + governed Exec surface#462nerdsane wants to merge 6 commits into
nerdsane wants to merge 6 commits into
Conversation
Open Computer create/read/list to authenticated tenant principals so harnesses can attach the existing computer by name (ADR-0001), and add the Exec entity + computer_exec WASM integration so third-party harnesses run commands on a Computer's sandbox as Cedar-gated, audited entity rows instead of raw provider CLI access (ADR-0002). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…uthenticated The deployed principal model carries no 'authenticated' attribute and Cedar denies on missing attributes, so the conditioned entity-op permits never matched. Use the shapes the dsf tool policies use: unconditional tenant-scoped read/list, Agent-only create. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…del across all Computer/Exec permits Lifecycle actions move to 'principal is Agent'; callbacks to agent_type == "system" or Admin; action ids listed in namespaced and bare forms until live dispatch pins the engine's naming. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Captures the bridge deployed on computer dsf as a reproducible, idempotent script (systemd unit, VncAuth-gated, page removable via port rm), so browser access to a computer's desktop is source-controlled rather than hand-applied sandbox state. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
LatencyDiag was submitted at runtime and lived only in the deployed tenant. Make it a first-class repo artifact so it can be published to Genesis: the LatencyDiag automaton (Idle/Scanning/Ready/Failed, RunScan fires the computer_exec trigger with a canned read-only Datadog p95 query), its EntityType + EntitySet in the app model, Cedar permits mirroring the Exec pattern, and an APP.md section. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PZkYwk1gmU6GPKRuQsSLda
Large command output was lost to the 8 KB stdout tail. computer_exec now wraps each command so its full combined output is persisted to ~/.exec-out/<exec_id>.log on the computer while the row still carries a tail (raised 8 KB -> 256 KB). The wrapper reports the log's byte count and path, parsed back into two new RunSucceeded result fields — stdout_path and stdout_bytes — so an agent can grep/sed/page output larger than the tail via follow-up Execs. exit $__rc preserves the user command's exit code through the wrapper. The exec id is sanitized into the filename so it cannot escape the log directory. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PZkYwk1gmU6GPKRuQsSLda
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of the Datadog Computer usecase (3p harness walk).
ADR-0001 — attach access. The shipped Cedar policy had no entity ops on Computer at all: every create/read/list 403'd (and reads deny without raising decisions), so the registry was unreachable. Permit create/read/list for authenticated tenant principals, matching the existing Configure/Provision scope. Bind (attach audit trail) considered and deferred.
ADR-0002 — governed Exec surface. New Exec entity (Created → Running → Succeeded|Failed) whose Run action fires the new computer_exec WASM module: resolves the Computer row by id via loopback, requires Ready + sandbox_url, executes via wasm_helpers::sandbox (tensorlake/modal), reports back RunSucceeded(exit_code, stdout_tail, stderr_tail) / RunFailed(error). Output tails truncated UTF-8-safe at 8KB. Cedar: Exec create/read/list/Run for
principal is Agent; callbacks admin-only; http_call/access_secret scoped tocontext.module == "computer_exec".Tests: 11 unit tests on the module's pure logic (SandboxHandle construction from a Computer row, Ready gate, output truncation, callback params) — all pass.
cargo build --target wasm32-unknown-unknown --releaseclean (262KB artifact, gitignored).Verification plan (before merge): publish to Genesis, hot-install into openpaw-production, live-test the walk: operator/Agent creates Exec → Run on Computer
dsf→ Succeeded with real exit code and output; failure path with bogus computer id → Failed. Evidence lands in .proofs/.🤖 Generated with Claude Code