cgalo5758
5829091881
The contained runner that drove the 2026-09 security audit, the README review and four rounds of design ideation lived only inside the ignored notebook. It moves to scripts/agent-runner/: the prepare, tools, audit, ideation and teardown scripts, the compose and container files, the allowlist proxy and the prompt templates, with the paths that assumed the notebook fixed and findings written to a caller-named directory. Run outputs, transcripts and the round-specific sheet scripts stay behind. docs/agent-runner.md states the method: the disposable git archive copy and the fail-closed proxy, how a task is shaped, union rather than intersection of findings across models, separate adjudication of every finding against the source, and the evidence a finding must carry.
34 lines
1.2 KiB
Plaintext
34 lines
1.2 KiB
Plaintext
# Egress proxy for the agent runner.
|
|
# Deny-by-default: only hosts matching allowlist.txt beside this file may be
|
|
# reached.
|
|
# The auditor container has NO other route to the internet (its network is
|
|
# marked `internal`), so this file is the whole egress policy.
|
|
# Stay root: this is a throwaway single-purpose container. Dropping privileges
|
|
# is pointless here and loses access to the log file.
|
|
User root
|
|
Group root
|
|
Port 8888
|
|
Timeout 600
|
|
# Bind on all interfaces inside the container network namespace.
|
|
Listen 0.0.0.0
|
|
# Only the sandbox network can talk to us; the isolated net is 172.x private.
|
|
Allow 0.0.0.0/0
|
|
|
|
# Allow CONNECT to 443 (HTTPS to model APIs) and 80.
|
|
ConnectPort 443
|
|
ConnectPort 80
|
|
|
|
# Host allowlist. FilterDefaultDeny means: block everything except matches.
|
|
Filter "/etc/tinyproxy/allowlist.txt"
|
|
# Extended POSIX regexes (the allowlist uses ERE syntax).
|
|
FilterType ere
|
|
FilterDefaultDeny Yes
|
|
# Match against the requested hostname, not the URL path.
|
|
FilterURLs Off
|
|
|
|
LogLevel Connect
|
|
# tinyproxy refuses to open /dev/stdout (symlink safety check), so log to a
|
|
# file inside the container. Read denials with:
|
|
# docker compose exec egress-proxy cat /tmp/tinyproxy.log
|
|
LogFile "/tmp/tinyproxy.log"
|