Repository navigation
REQ 121
The live-assistance runner shall compile automatic per-run tool grants from a trusted, deterministic, versioned policy bound to one run and one newly created disposable VM identity.
The approved #250 workflow creates one disposable VM before its UUID exists, then uses local Ollama and LBA MCP while capture is active. The current LBA contract describes tool effects and exact JSON arguments but contains no VM-creation tool. The current stopped-capture authorization validator requires a fixed UUID and caller-authored approved calls, so it cannot safely express this new two-phase lifecycle without a separate policy compiler.
The compiler validates a versioned policy whose digest is pinned by the reviewed runner build and derives a unique run nonce, a one-use permit for exactly one provisioner request, and a sealed post-create grant only after an exclusive-lock before/after inventory check proves exactly one new VM UUID matches the provisioner result. The one-shot dispatcher validates exact create arguments and expiry immediately before calling the provisioner adapter; it persists a dispatch marker first, and a timeout/lost response burns that run ID so the create is never retried. The policy and each permit/grant bind a host identity digest computed with the projectbuddy/host-identity@1 domain separator over the local OS machine-id; raw machine-id bytes are never retained in a plan or receipt. This detects accidental cross-host replay but is not hardware attestation and does not resist an intentionally cloned host identity. Permit and grant claims use one fixed persistent current-user ledger so selecting a fresh ledger cannot reset a run ID; this local ledger is not protected against a malicious same-user process. The sealed grant contains the exact UUID, run/policy/LBA-contract/model digests, finite expiry and resource/privacy limits, ordered canonical MCP tool/argument pairs, and a single teardown capability reserved for that UUID on success or failure. Before each call, a broker validates the proposed tool/effect/arguments against the next exact grant entry and the pinned MCP schema; no extra, reordered, duplicate, stale, replayed, altered, or cross-UUID call reaches the client. Policy-generated grants may automatically authorize any pinned tool whose exact invocation is included, but plan-only results and returned command text are never executed. The model cannot create, amend, extend, or replay a grant. The authority permits no workload retry on that VM. This offline compiler returns, but does not execute, the teardown capability; live coordinator and adapter behavior are verified separately under #250. Ambiguous inventory or a failed teardown must stop with unresolved cleanup and never target another VM. No secret values or raw frames are serialized into policy or public proof.
TEST-122 executed fixture provisioner and fake host-inventory cases through PR #252, implementation 65a931f712bc478c00a9ca0100d38ef918fde642 and merge fd998aab3551f3ed5665bf809ebc3f08f79209de. Full suites passed 2,193 Python and 108 .NET tests; all seven applicable PR checks passed. These results validate offline policy primitives, not an integrated provisioner or live VM run.
SYS-REQ-030; epic #250; P0 #251
High
scripts/tests/test_assisted_benchmark_live_policy.py executed provisioning-policy, host-binding, one-shot-claim/dispatch, expiry and tamper cases including test_host_identity_digest_is_domain_separated_and_does_not_return_raw_id, test_persistent_host_ledger_ignores_home_environment, test_policy_compiles_stable_one_vm_provision_permit_and_sealed_grant, test_policy_canonicalizes_valid_uppercase_model_digest, test_provision_permit_claim_is_private_and_non_replayable, test_provision_dispatch_refuses_changed_arguments_and_expired_permits, test_lost_provisioner_response_burns_dispatch_without_retry, test_dispatch_expiry_after_durable_marker_prevents_provisioner_call, test_host_provisioning_lock_serializes_inventory_and_creation, test_uuid_binding_refuses_ambiguous_or_mismatched_host_inventory, test_permit_and_grant_reject_tampering_expiry_and_policy_substitution, and test_permit_claim_rechecks_expiry_after_durable_marker. Full suites passed 2,193 Python and 108 .NET tests; all seven PR #252 checks passed. These are offline contract/failure-injection cases, not a live run, invoked teardown, or proof of model quality.
Implemented offline primitives in scripts/assisted_benchmark_live_policy.py: host_identity_sha256, ProvisioningLock, validate_live_policy, compile_provision_permit, claim_provision_permit_once, dispatch_provision_once, bind_created_vm, and claim_run_grant_once; integrated in develop through PR #252. A live provisioning/run coordinator remains future #250 work.
Implemented in develop through PR #252 as offline policy/UUID-binding primitives. No live provisioner adapter, executed teardown, or VM run is claimed.