cgalo5758
5829091881
The contained runner that drove the 2026-09 security audit, the README review and four rounds of design ideation lived only inside the ignored notebook. It moves to scripts/agent-runner/: the prepare, tools, audit, ideation and teardown scripts, the compose and container files, the allowlist proxy and the prompt templates, with the paths that assumed the notebook fixed and findings written to a caller-named directory. Run outputs, transcripts and the round-specific sheet scripts stay behind. docs/agent-runner.md states the method: the disposable git archive copy and the fail-closed proxy, how a task is shaped, union rather than intersection of findings across models, separate adjudication of every finding against the source, and the evidence a finding must carry.
52 lines
1.9 KiB
Bash
Executable File
52 lines
1.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Remove everything the sandbox created. Findings are untouched: they live in
|
|
# the directory the caller named with OUT, not here.
|
|
#
|
|
# ./teardown.sh # containers, networks, images, disposable copy
|
|
# ./teardown.sh --deep # also drop base images + prune build cache
|
|
# ./teardown.sh --verify-only # report residue, remove nothing
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")"
|
|
PROJECT=member-console-audit
|
|
LABEL=com.member-console.audit=1
|
|
|
|
DEEP=0; VERIFY_ONLY=0
|
|
for a in "$@"; do case "$a" in
|
|
--deep) DEEP=1 ;;
|
|
--verify-only) VERIFY_ONLY=1 ;;
|
|
*) echo "unknown flag: $a" >&2; exit 2 ;;
|
|
esac; done
|
|
|
|
report() {
|
|
echo "== residue check (label $LABEL) =="
|
|
echo "-- containers:"; docker ps -aq --filter "label=$LABEL" | sed 's/^/ /' || true
|
|
echo "-- networks:"; docker network ls -q --filter "label=$LABEL" | sed 's/^/ /' || true
|
|
echo "-- images:"; docker images -q member-console-audit member-console-audit-proxy 2>/dev/null | sed 's/^/ /' || true
|
|
echo "-- disposable copy (.code): $([[ -d .code ]] && echo PRESENT || echo gone)"
|
|
echo "Note: containers ran with --rm, so no opencode session/snapshot data"
|
|
echo "persisted. The host opencode config and your real repo were never mounted"
|
|
echo "writable; auth.json was mounted read-only."
|
|
}
|
|
|
|
if [[ $VERIFY_ONLY -eq 1 ]]; then report; exit 0; fi
|
|
|
|
echo "==> Stopping stack, removing containers + networks + named volumes"
|
|
docker compose down -v --remove-orphans || true
|
|
|
|
echo "==> Removing built images"
|
|
docker image rm -f member-console-audit:latest member-console-audit-proxy:latest 2>/dev/null || true
|
|
|
|
echo "==> Removing the disposable working copy (.code) and run state"
|
|
rm -rf .code .run
|
|
|
|
if [[ $DEEP -eq 1 ]]; then
|
|
echo "==> Deep clean: base images + build cache"
|
|
docker image rm -f golang:1.25-alpine alpine:3.20 2>/dev/null || true
|
|
docker builder prune -f >/dev/null || true
|
|
fi
|
|
|
|
echo
|
|
report
|
|
echo
|
|
echo "Done. Nothing else from this runner runs in the background."
|