Repository navigation
SYS REQ 030
The system shall derive live agent and MCP authority only from a deterministic, versioned run policy bound to one run and one newly created disposable VM identity.
Epic #250 tests Ollama use while LBA capture remains active and permits automatically admitted MCP tools within a compiled policy. The VM UUID is not known before provisioning, while the existing pinned LBA MCP contract contains no VM-creation tool. A staged authorization boundary is therefore required to prevent the model, tool output, stale plans, or concurrent VM activity from broadening the run.
A trusted, versioned policy produces a one-use provisioning permit for exactly one VM creation request under a host/profile/resource envelope and binds that permit to a domain-separated digest of the local OS machine-id. Raw identifier bytes are never retained; the digest is a replay-scope control, not hardware attestation. A fixed persistent private host ledger prevents selecting a fresh per-run ledger to replay permits, but same-user malicious deletion or replacement is outside the ledger guarantee. An exclusive run lock and before/after host inventory establish exactly one newly created UUID matching the provisioner result; the one-shot dispatcher persists its dispatch marker before invoking the exact provisioner request, rechecks expiry immediately before the callback, and never retries after an ambiguous response. No model or LBA MCP call starts until a sealed run grant binds that canonical UUID. The grant binds the policy and contract digests, run nonce, model identity, evidence/privacy/resource/deadline limits, ordered exact MCP tool names and canonical arguments, and exact-UUID teardown. A broker checks every proposed call against a canonical immutable grant snapshot and pinned contract, and rechecks host identity and expiry at call start and completion. Expired in-flight results are refused; abort/cancellation also retains unresolved in-flight state and blocks teardown until settlement or independent reconciliation. Once safe to terminate, teardown is permitted only on the original host and exact UUID; host identity drift leaves the VM unresolved and forbids cross-host cleanup. Unknown, changed, repeated, expired, replayed, out-of-order, wrong-UUID, or policy-tampered actions fail before their effect. Model output cannot modify or mint grants. Results from plan-only tools remain inert; command text is never executed. A reserved teardown capability applies only to the recorded UUID on success or failure, with no workload retry on that VM. Ambiguous identity or failed teardown stops the run and reports unresolved cleanup without broadening the target. Grants and receipts contain no secret values or raw capture content.
TEST-122 / TEST-123 offline implementation checks integrated through PR #252, merge fd998aab3551f3ed5665bf809ebc3f08f79209de. Full local suites passed 2,193 Python and 108 .NET tests; all seven applicable PR checks passed. No VM, MCP, Ollama or live-capture run has exercised this policy; SYS-REQ-030 remains system-level planned until the #250 coordinator and live workflow are implemented and qualified.
System-Requirements-Specification; epic #250; P0 #251
High
Executed offline policy/broker regressions are listed in REQ-121 / REQ-122 under scripts/tests/test_assisted_benchmark_live_policy.py; the provisioner/coordinator adapter and live-workflow evidence remain planned.
REQ-121, REQ-122; planned change targets: scripts/assisted_benchmark_live_policy.py (host_identity_sha256, ProvisioningLock, compile_provision_permit, bind_created_vm, and LiveRunBroker); scripts/assisted_benchmark_contract.py (pinned tool/effect contract); and the #250 provisioning/run coordinator and fixture tests.
Policy/compiler and broker primitives implemented in develop through PR #252; live system integration, capture-time model use and VM lifecycle are not qualified