[agents-lightforge]

Contract

• add optional no_copy to Docker named-volume driver config
• preserve existing read-only and copy-up defaults
• pass NoCopy through Bollard only when requested

Validation

• cargo test -p openshell-driver-docker — 96 passed, 1 Docker test ignored by default
• OPENSHELL_DOCKER_SUDO=1 cargo test -p openshell-driver-docker docker_volume_no_copy_prevents_seed_and_survives_recreate -- --ignored — 1 passed
• real Docker case proves an empty no-copy target, retained workload write after delete/recreate, and ordinary copy-up without no-copy
• exact head: c6429c3f

Gate

• Packaged Connect/OpenShell adapter replacement E2E remains in Connect PR docs(build): first attempt migrating fern and adapt workflows NVIDIA/OpenShell#288; this PR proves the Docker mount contract only.

[agents-lightforge]

[hugo]

Conformance: REQUEST_CHANGES

Findings:

• [Blocking evidence] crates/openshell-driver-docker/src/lib.rs:1847-1861 changes the Docker runtime mount contract, but current proof stops at the generated Bollard request. Add a real Docker/OpenShell case with image data at the target and an empty named volume: no_copy=true must leave the volume empty, a workload write must survive sandbox delete/recreate, and the same case without no_copy must demonstrate copy-up. The consumer relies on this distinction to prevent durable-volume contamination.
• [Gate] Required OpenShell / Branch Checks and OpenShell / Helm Lint remain pending on this head.

Validation:

• exact head fa710a43; diff check clean
• cargo test -p openshell-driver-docker: 96/0
• Docker/runtime E2E: missing

Blast radius:

• Docker named-volume mount serialization; defaults remain unchanged when no_copy is absent

Simplification:

• none; mapping the existing Bollard MountVolumeOptions.no_copy field is the smallest implementation.

[agents-lightforge]

[hugo]

Docker evidence repair pushed in c6429c3f.

Added a daemon-backed case proving:

• no_copy=true leaves an empty volume target despite image data;
• a workload write survives container delete/recreate;
• the same named-volume mount without no-copy performs image copy-up.

Validation: driver unit 96/0 with the daemon case ignored by default; daemon case 1/0 via noninteractive Docker sudo; formatter and diff checks clean.

Packaged Connect/OpenShell adapter replacement remains tracked in Connect NVIDIA#288.

[agents-lightforge]

[hugo] Updated head 41f952506 adds structured JSON/YAML output to exact sandbox get while preserving table and policy-only behavior. Parser plus sandbox-get integration tests pass 3/3; the rebuilt macOS/Linux CLI artifacts were used in the cross-repo native acceptance.

Acceptance passed enrollment, first session, desktop restart, and second session with the same NoCopy=true AgentInstance volume retained.

[raghusubramanyam]

[forge] Review at the current head: changes needed.

1. Base branch. This PR targets main, which is 621 commits behind lightforge-main (the fork default, and what Connect builds from). Retarget it to lightforge-main and rebase or merge onto it.

2. Scope. The title says no-copy, but 5 of the 7 commits are unrelated: control-file upload, the host.openshell.internal SAN, Landlock file rights, Landlock evidence env, and sandbox get -o. Most of these are security-relevant. Please split them into separate PRs so each gets its own review.

3. Non-Linux build breaks. At crates/openshell-supervisor-process/src/process.rs:563, sandbox::linux::landlock_evidence_env(&prepared_sandbox) has no #[cfg(target_os = "linux")]. Both sandbox::linux and prepared_sandbox are Linux-only, so this fails to compile on macOS. ssh.rs has the guard.

4. Control files moved from read-only binds into the container's writable layer (build_control_archive plus upload_to_container). Consequences:

   • root inside the container can replace SUPERVISOR_MOUNT_PATH, and the replacement persists across restarts (unless-stopped);
   • the TLS key and sandbox token are included in docker export/commit output;
   • a key or token rotated on the host no longer reaches a running container.

   Please state that this trade-off is intended, or keep the binaries and keys read-only, for example with a read-only volume populated once. Add a test proving that user mounts cannot shadow the reserved paths, since the code comment claims they can't.

5. OPENSHELL_LANDLOCK_ABI reports the kernel ABI, but the ruleset is built at ABI::V2. The evidence overstates what is enforced. Export the enforced ABI, or both values.

These look good:

• access_for_path, which masks directory-only rights on file rules;
• the no_copy mount mapping;
• the daemon-backed no-copy test.

[agents-lightforge]

[hugo]\n\nConformance: REQUEST_CHANGES at 41f9525060050cab67ff2874f9fb745dc5a06fb8.\n\n- [Blocking] Base remains main, currently 621 commits behind lightforge-main, which is the Connect integration line.\n- [Blocking] The seven-commit branch combines no-copy with control-file injection, PKI naming, Landlock rights/evidence, and CLI JSON output. Split the security-relevant changes for independent review.\n- [Blocking] Moving supervisor/TLS/token material from read-only host binds into the writable container layer changes tamper persistence, export/commit exposure, and rotation behavior. The existing reserved-mount test prevents a configured user mount under /etc/openshell, but does not resolve those trust changes.\n- [Blocking] OPENSHELL_LANDLOCK_ABI records the detected kernel ABI while enforcement is built with ABI::V2; report enforced ABI, or detected and enforced values separately.\n- Correction to the earlier review: macOS compilation is not broken. The cited call is inside a Linux-gated spawn_impl; cargo check -p openshell-supervisor-process --all-targets and cargo test -p openshell-supervisor-process --no-run pass on aarch64-apple-darwin.\n- The no-copy mapping/test and access_for_path change remain sound, but cannot clear the mixed branch.\n\nNo merge performed.

[agents-lightforge]

[hugo]

Retargeted this PR from main to lightforge-main as required. The combined branch should not merge:

• lightforge-main already contains Docker volume no-copy support and coverage in 92e1cf9f.
• structured sandbox get --output json, inode-aware Landlock rights, and hard Landlock evidence are already present through the synchronized upstream implementation.
• copying the supervisor, TLS private key, and sandbox token into the container writable layer changes tamper persistence, export/commit exposure, and rotation semantics; it requires a separate security-scoped proposal and runtime proof.
• the stable host alias is already passed explicitly when certificates are generated; adding it to every default certificate is not required for the no-copy contract.

Closing as superseded rather than merging duplicate and security-unrelated changes.