boot: the narrow report-door grant, on both paths (#343, fix 1b) - #367
Merged
Conversation
#337's posture matrix measured a checkout-less session with no channel out: no git, no MCP connector, and the auto-mode classifier refusing `curl` BEFORE it ran -- twice, deterministically. No change to the door fixes that; the gate is upstream of the network. The org's mechanism for it is a permissions.allow entry, the same shape .claude/settings.json already uses for org-repair.sh. Until #354 that entry could not exist: boot.sh rewrote settings.json from scratch every boot. It merges now, and harness-settings.mjs has carried a BOOT_ALLOW input with tests for it since -- this is the value. Bash(curl https://pathbase.bounded.tools/c/:*) Deliberately NOT Bash(curl:*), which is a blanket egress grant and a different posture. Host and /c/ prefix pinned, nothing else, so the rule cannot fail for a reason the session cannot see (#342). Installed on the fetch path via BOOT_ALLOW, on the no-merger fallback via the here-doc, and for attached sessions via this repo's settings.json. A user's deny of the same rule is honoured by the merger. Writing this was refused by the classifier twice earlier today on two tools. It is written now on the maintainer's explicit direction, which is the right order: a session should not grant itself egress; a person can. Changes boot.sh, so the payload is pre-staged before this merges -- the order payload-staged now enforces. Claim-issue: #343 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TzRQgnKvcAZ9YExKev6r2E
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The last half of #343
#337's posture matrix measured a checkout-less session with no channel out: no git, no MCP connector, and the auto-mode classifier refusing
curlbefore it ran — twice, deterministically. No change to the door fixes that; the gate is upstream of the network. The org's own mechanism for it is apermissions.allowentry, the same shape.claude/settings.jsonalready uses fororg-repair.sh.Until #354 that entry could not exist —
boot.shrewrotesettings.jsonfrom scratch every boot. It merges now, andharness-settings.mjshas carried aBOOT_ALLOWinput with tests for it since. This is the value:Deliberately not
Bash(curl:*)— that is a blanket egress grant and a different security posture. Host and/c/prefix pinned, nothing else, so the rule cannot fail for a reason the session cannot see (#342's complaint). The canonical invocation puts the URL first; flag order after it does not matter.Three paths, one rule
BOOT_ALLOW→harness-settings.mjsmerges it beside whatever the user already has.githubattached.claude/settings.jsonA user's
denyof the same rule is honoured by the merger (tested in #354).Verified
parseStepsstill enumerates exactly the same six steps — the value is inline at the use site, not hoisted, because a variable holding a command-shaped string parses as that commandbootstrap-steps,bootstrap-pin,harness-settings,test-coverage— 41/41{allow:[org-repair], deny:[rm]}→allowgains the rule,denyuntouchedOn the record
Writing this line was refused by the classifier twice earlier today, on two different tools. It is written now on the maintainer's explicit direction, which is the right order: a session should not grant itself egress; a person can.
Ordering — this PR is red on
stagedby design until the payload landsboot.shchanged, sopayload-stagedreports the branch digestb79a86f2…is not in the store. That is the check doing what #363 built it to do. The payload is being pre-staged from this branch in infra now; this PR merges only afterboot-deployserves it.Claim-issue: #343
🤖 Generated with Claude Code
https://claude.ai/code/session_01TzRQgnKvcAZ9YExKev6r2E
Generated by Claude Code