Repository navigation
REQ 107
The lane executor shall reach a lane guest only by key-only root SSH over the host's loopback forward, with a client key generated for that run and bound to that instance by a guest property that only the host can set.
Option 3 of decision D-2 (VITechnologies/projectbuddy#165, REQ-103) drives the guest from outside, so the engine needs its own way in. Every clone of a lane box has the box's SSH host key, so the host key alone cannot tell two instances apart. A key that only this run holds, and that only the host can install in this instance, binds each session to this run's instance (VITechnologies/projectbuddy#206). The workload is untrusted candidate code (challenge ledger row CH-04 in VITechnologies/projectbuddy#159). Run as root, it could rewrite the supervisor, the launcher, or the spec that run its phases and record its result (REQ-106).
The lane box's readiness scan shows that sshd lets only root log in, only by an ssh-ed25519 key and only from the NAT gateway, with password, keyboard-interactive, host-based, and GSSAPI logins, other key files, forwarding, and terminals off, and that no account has an authorized_keys file. Root's only key is the one a boot helper reads from the guest property /VirtualBox/HostInfo/ProjectBuddy/Lane/ClientKey, which the guest cannot write. Each run generates its own ssh-ed25519 key in a run directory that only the lane's account can reach, and sets that property to its public key. Before any login, the engine pins the instance's host key to the box receipt's fingerprint. Every session uses only the run's key and the pinned host key, with no ssh configuration file, agent, or forwarding. The run creates the workload account pb-workload, which must not exist before, with a nonzero user and group ID, no login shell, and no cron or at access. Every probe, the candidate's extraction, and every fetch and build step run as that account. The supervisor, the launcher, the spec, and the secrets file are root's own files in a directory that root creates during the run, and the engine checks each one's owner, mode, link count, and size, and the SHA-256 of each except the secrets file. Rejected: a box whose sshd lets another account log in or accepts a password, or that has an authorized_keys file, gets no box receipt; an instance whose property is missing or writable by the guest accepts no login. A run directory that its group or others can reach, or that already holds a key file, is refused before ssh-keygen runs. A host key whose fingerprint differs from the receipt's stops connect before any command runs, and so does a login that is not root. A guest that already has the workload account or /run/projectbuddy-lane, a placed file whose state differs from what the engine sent, or a candidate with a submodule or a path that is not UTF-8 stops the run before the workload starts. No secret value appears in an argument vector or a message.
Planned, TEST-109; not yet performed live. Offline fixture tests cover the box's sshd drop-in, boot helper, and access scan; the client key's checks; host-key pinning; the exact ssh argument vector; and every workload placement command, with a real SSH session object against a fake instance, real git repositories, and a real GNU tar extraction. A documentation test fails when a command, mode, or timeout in the procedure differs from the code's. The unprivileged-execution obligation formerly combined in this statement is separately allocated to REQ-117, with the same test and no relaxation of the fit criterion.
Software-Requirements-Specification
High
scripts/tests/test_lane_box.py lane access cases, scripts/tests/test_lane_channel.py, scripts/tests/test_lane_placement.py, and scripts/tests/test_lane_docs.py SSH channel and workload placement cases
scripts/lane_box/access.py and scripts/lane_box/guest/ (the sshd drop-in, the boot unit, and lane_access.py, which writes root's key from the property), scripts/lane_box/readiness.py (the laneAccess scan), scripts/lane/plan.py (the property in the instance's Vagrantfile, and the client-key, connect, create-account, and placement steps), scripts/lane/channel.py (the client key, host-key pinning, and the session), and scripts/lane/placement.py (the workload account and the files the engine places), with docs/vm-provisioning/ubuntu-lane-box.md and docs/vm-provisioning/ubuntu-lane.md
Planned; offline fixture tests pass, no live proof yet