fix: qualify local bridge execution, DNS isolation, and trace provenance - #263

Scope and status

The local execution path is now qualified end to end: published Agent Runtime -> authenticated loopback CLI-Bridge -> actual OpenCode -> explicitly selected GLM free inference. The model completed a filesystem task, the Bridge was restarted, and the same native session resumed successfully. The final live-proof job also passed the complete repository suite, TypeScript check, published Runtime consumer regression and actual Linux jail isolation checks.

Current qualified head: d7df6f93282396910b0fe178cc7162915fea2c09. The successful PR integration tree recorded by the execution receipt is d608afecbd6b73f82812e48923fec3815ce6021d. The source fixes for the remaining timeout regressions were published in 6509d1e7f33fe93346064077446dd949cc5fae8e. All temporary source-finalization and cloud-bundle workflows are deleted; the maintained opt-in live-inference workflow remains.

Changes

• Preserve only the exact regular resolver file read-only inside the Linux filesystem jail, including WSL resolver targets. Remove the broader resolver-directory mount. Actual jailed-process tests verify resolver access, read-only enforcement and hidden sibling files.
• Consume the published Runtime 0.325.0 provider-prefix correction and compatible Eval 0.214.0 with the committed lockfile and strict peer checks. No duplicated Runtime implementation or package-policy bypass.
• Verify the trace producer's exact root-importer dependency version and integrity, without rejecting valid workspaces merely because a separate consumer uses another version. Handle pnpm's separate package-manager document; reject ambiguous, non-registry or integrity-less selections.
• Correct the stale OpenCode prompt-intent assertion to its existing materialization receipt. Syntax-check the live script, retain evidence outside owned scratch, and clean owned native databases/caches only after process shutdown and evidence capture.
• Fix Pi timeout-test setup: wait for the real Python fixture's stderr readiness marker before starting the deliberately short RPC deadline. Do not consume protocol stdout, weaken the 80ms protocol timeout, or remove failure assertions.
• Separate the host-executor descendant-lifetime scenario from the independent 400ms admission-cap tests. Its admission wait accommodates actual process reaping while preserving assertions that capacity stays held until the helper exits.
• Run opt-in inference on a pinned disposable Ubuntu 22.04 runner with installed/probed bubblewrap. Ubuntu 24.04's unavailable jail correctly failed preflight; no namespace security policy was disabled and no unconfined fallback was added.

Executed verification

Source qualification 39091779283: integrated current main, frozen strict-peer installation, TypeScript, three repeated executions of the Pi/native process-lifetime regressions, the complete repository suite and the actual published Runtime consumer all passed. Only then were the source fixes committed. The two repaired test files also passed locally: 28 tests, zero failures.

Final live qualification 39092115882, on the PR integration tree recorded above:

• Frozen strict-peer installation: passed.
• Semantic TypeScript, complete repository suite and published Runtime consumer: passed.
• Real bubblewrap probe plus resolver read-only/sibling-file isolation: passed.
• Checksum-pinned OpenCode 1.19.3, Node 22.23.3: executed.
• Model: opencode/glm-5.3-flash-free, with no automatic model or paid fallback.
• Filesystem task: passed, 13 Runtime events. The agent read a synthetic random input, computed its SHA-256 and wrote an independently checked output file.
• Actual Bridge restart and native-session continuation: passed, 6 Runtime events. Before and after records retain native session ses_eb30a40a4ffeJzfkwzXfzxVi2E; the resumed task recovered the prior conversation-only marker without resupplying it and wrote the checked result.
• Local trace retention: 6 records. Owned scratch cleanup: confirmed.

The downloaded receipt reports status:passed; the artifact archive digest and both output-file digests were independently recomputed and matched. Artifact local-inference-39092115882-1 (ID 12122983625), SHA-256 c5dca0a1f19243134a278749b368fb004e7b47f056a2822a54d18be4411cee0f, is retained with the successful run. The receipt, native logs, before/after session records and trace objects are included. Provider monetary accounting remains usdKnown:false; selecting a free model is not a separate billing audit.

Earlier rate-limited provider attempts and failed runner preflights remain in Actions history; they are not counted as success. The earlier direct ChatGPT-container boot/authentication proof remains valid, but its inference attempt failed due to external connectivity. The successful complete inference proof above ran on GitHub's cloud runner, not in that DNS-restricted container.

Reproduce

pnpm install --frozen-lockfile --strict-peer-dependencies
pnpm typecheck && pnpm test
CLI_BRIDGE_REAL_OPENCODE_TESTS=1 \
CLI_BRIDGE_LIVE_MODEL=opencode/glm-5.3-flash-free \
pnpm test:local-inference

Requires Linux with working bubblewrap, supported Node and installed OpenCode. OPENCODE_BIN selects the executable; CLI_BRIDGE_LIVE_OUT selects a new evidence directory. Missing prerequisites, provider errors, incorrect file output or failed continuation fail the proof rather than self-skipping. The maintained workflow provisions its own CLI and uses fresh synthetic workspaces, not customer data or host model credentials.

Boundaries

This qualifies local Runtime execution, Bridge HTTP/process handling, filesystem tools, native restart/resume and local trace retention. It does not qualify Agent App browser journeys, production R2 capture, complete producer coverage, disaster recovery or training eligibility. Storage changes are in agent-container #10962. There are no unresolved inline review threads; independent reviewer approval is not asserted. Nothing was merged, deployed, published as a dataset or used for training.