Skip to content

README.md

Latest commit

 

History

History
68 lines (60 loc) · 4.58 KB

README.md

File metadata and controls

68 lines (60 loc) · 4.58 KB
Raw

CostMarshal worker image

This image is the trusted bootstrap for worker_isolation.mode=required. It contains two fixed commands:

  • costmarshal-isolation-canary --json proves the non-root, read-only-rootfs, capability, mount, and engine-socket boundary before dispatch.
  • costmarshal-worker --jsonl [--model MODEL] [--codex-native --max-subagents N --minimum-codex-version VERSION] accepts the bounded task prompt on stdin, runs codex exec --json, and writes only /out/final.md. Codex-native mode performs a fail-closed CLI version handshake and permits only attempt-local children that inherit the same model, provider credential, sandbox, budget, and lease.
  • costmarshal-worker --jsonl --mode multimodal-api --max-output-tokens N [--image/--audio/--video/--document PATH] is a report-only path for a gateway-bound native Responses provider. It cannot write the workspace or invoke tools, limits aggregate attachments to 2 MiB, and requires authoritative usage plus a settled hard-budget Proxy response.
  • costmarshal-escape-probe is a test-only hostile workload used by the full source checkout's tests/oci_live_evidence.py; normal dispatch never selects it and the installed runtime snapshot does not ship that maintainer harness.

Builds are intentionally fail-closed unless the base image digest, Codex CLI version, and top-level npm integrity match the reviewed build inputs. The committed package-lock.json additionally pins the platform binary and every optional package tarball; installation uses npm ci --ignore-scripts. A production build must be pushed to a reviewed registry so it receives a repository digest:

docker buildx build container/worker `
  --platform linux/amd64 `
  --build-arg NODE_BASE_IMAGE=node@sha256:<reviewed-linux-image-digest> `
  --build-arg CODEX_NPM_VERSION=<reviewed-version> `
  --build-arg CODEX_NPM_INTEGRITY=<reviewed-sha512-integrity> `
  --tag registry.example/costmarshal-worker:<reviewed-version> `
  --push
docker pull registry.example/costmarshal-worker:<reviewed-version>
docker image inspect registry.example/costmarshal-worker:<reviewed-version> --format '{{json .RepoDigests}}'

The Dockerfile intentionally relies on the reviewed builder's bundled frontend instead of resolving a mutable remote Dockerfile frontend. Record the builder endpoint identity, Docker Engine and BuildKit versions alongside the build. Record the returned immutable repository digest (name@sha256:...) in --worker-image and in the full source checkout's reviewed release/evidence-policy.json; pull that exact reference on every release-test host. A local-only mutable tag has no RepoDigest and is intentionally insufficient. Record the base digest, Codex version, builder identity/version, registry provenance/signature, and SBOM in the release review. The container receives the workspace, one credential at most, one credential-free profile, and an empty output directory; it never receives the CostMarshal runtime or the aggregate secrets file. The image explicitly clears any base-image entrypoint so the inspected command is exactly the CostMarshal worker command selected by the adapter.

Release maintainers run the live evidence harness from a full source checkout, not from the curated installed-plugin snapshot, with a locally available reviewed image:

$env:COSTMARSHAL_OCI_IMAGE = "registry.example/costmarshal-worker@sha256:<digest>"
$env:COSTMARSHAL_OCI_PROVIDER_NETWORK = "costmarshal-provider-proxy"
$env:COSTMARSHAL_OCI_PROXY_CONTAINER = "reviewed-provider-proxy"
$env:COSTMARSHAL_OCI_PROXY_HEALTH_URL = "http://reviewed-provider-proxy/allowlisted-upstream-proof"
$env:COSTMARSHAL_OCI_PROXY_HEALTH_SHA256 = "<sha256-of-bounded-response-body>"
python tests/oci_live_evidence.py

The network must already be internal and CostMarshal-labelled. The proxy must be running, carry the same trust label, and be attached both to that internal network and an independently inspected non-internal egress network. The health URL must expose a credential-free response that the reviewed proxy policy obtains from an allowlisted upstream; its expected body hash prevents a local empty health page from satisfying the positive path. The source-only harness then exercises read-only and writable workspaces, hostile output exchanges, mount/label/resource/security options, socket/runtime/aggregate-secret probes, direct egress denial, proxy reachability, immutable identity, and credential cleanup. It writes the source checkout's artifacts/oci-attestation.json; missing engine, image, health proof, or real proxy topology produces an explicit blocked result.