software-defence-factory 0.15.2 → 0.15.3

package/docs/setup.md

@@ -432,6 +432,37 @@ local inference does not mean zero electricity, hardware or operator cost. Only
 then qualify a suitable real Factory issue; no customer jobs are part of this slice.
 
 
+## Local Pi project resources (0.15.3, #103)
+
+The local launcher gives each invocation a private `0700` directory under the
+job's existing `/tmp` tmpfs for Pi runtime stores/locks. `PI_CODING_AGENT_DIR`
+points there; it is never the read-only `/factory-local` binding mount. The
+selected `models.json` is linked to that mount, and the launcher/context adapter,
+policy and six Factory skills remain read-only. No host home, saved trust,
+authentication or settings are copied. Normal exit removes this state; container
+teardown removes interrupted state. Build and Review never share it. The root
+filesystem and Review checkout remain read-only.
+
+Pinned Pi 0.87.1 consults project trust even for an empty `.agents/skills`
+directory. Factory explicitly passes `--no-approve` to deny project settings,
+packages and executable resource loading, while retaining `--no-extensions`,
+`--no-skills` and `--no-prompt-templates`. A writable Pi home does not authorize
+project dependency installation. Only the explicit bundled context extension
+and `--skill /factory-skills` catalog are supported; their loading and the
+context-ready handshake are tested against actual Pi. Task stdin and ordinary
+`AGENTS.md` context remain available as untrusted text. Repository Pi settings,
+extensions/packages and automatically discovered repository skills are not a
+supported configuration path. Explicit task-driven file reads are still possible
+within the sandbox and grant no additional authority.
+
+Before accepting this repair, the lead must qualify the exact installed 0.15.3
+package/image through CLI/API, representative native local Build and separate
+read-only Review, and one actual local-model run. `npm run qualify:pi` uses actual
+Pi with **synthetic HTTP inference**, not model judgment. See [trust-store
+proof and limits](proof.md#pi-project-trust-startup-0153-103). Retain the failed
+#51 attempt unchanged and unaccepted; retry only through a newly authorized
+attempt after qualification. Do not modify private installations from a job.
+
 ## Local context budget and worker image (0.15.2, #100)
 
 The standard worker recipe pins **`@earendil-works/pi-coding-agent@0.87.1`** from

package/factory/execution-profile.mjs

@@ -24,16 +24,19 @@ import { expectedWebStories, webPolicyHash } from './web-verification.mjs';
 // 0.15.1 changes release downloads only; v1/v2/v3 writers and policy are unchanged.
 // 0.15.2 updates the opt-in local launcher and standard image; schemas, frozen
 // command/config/image hashes, protected checks and acceptance guards are unchanged.
+// 0.15.3 isolates local Pi mutable state and denies project resource trust.
+// Evidence schemas, candidate reconstruction and frozen profile guards are unchanged;
+// compatibility does not qualify an old local startup or accept a failed attempt.
 // Older writers still require exact patch/tree reconstruction before publication.
 // Deliberately independent of VERSION: a release bump is not
 // evidence compatibility. Re-audit this list for every trust-relevant writer,
 // isolation or validation change; remove versions whose guarantees no longer
 // satisfy current policy. See docs/npm.md. This predicate alone grants no trust.
-const SUPPORTED_EXECUTION_RUNTIMES_V1 = new Set(['0.8.0', '0.9.0', '0.9.1', '0.10.0', '0.11.0', '0.11.1', '0.11.2', '0.12.0', '0.13.0', '0.13.1', '0.14.0', '0.15.0', '0.15.1', '0.15.2']);
+const SUPPORTED_EXECUTION_RUNTIMES_V1 = new Set(['0.8.0', '0.9.0', '0.9.1', '0.10.0', '0.11.0', '0.11.1', '0.11.2', '0.12.0', '0.13.0', '0.13.1', '0.14.0', '0.15.0', '0.15.1', '0.15.2', '0.15.3']);
 
 export function isSupportedExecutionProfile(profile) {
-  if ([2, 3].includes(profile?.version)) return (profile.version === 3 ? ['0.15.0', '0.15.1', '0.15.2'].includes(profile.runtimeVersion) && Object.hasOwn(profile, 'localBinding')
-    : ['0.14.0', '0.15.0', '0.15.1', '0.15.2'].includes(profile.runtimeVersion) && !Object.hasOwn(profile, 'localBinding') && profile.inferenceProvider !== 'factory-local')
+  if ([2, 3].includes(profile?.version)) return (profile.version === 3 ? ['0.15.0', '0.15.1', '0.15.2', '0.15.3'].includes(profile.runtimeVersion) && Object.hasOwn(profile, 'localBinding')
+    : ['0.14.0', '0.15.0', '0.15.1', '0.15.2', '0.15.3'].includes(profile.runtimeVersion) && !Object.hasOwn(profile, 'localBinding') && profile.inferenceProvider !== 'factory-local')
     && profile.role === (Object.keys(ROLE_PHASES).find(role => ROLE_PHASES[role] === profile.phase) || null)
     && (profile.reasoningEffort === null || ['low', 'medium', 'high'].includes(profile.reasoningEffort))
     && /^[a-f0-9]{64}$/.test(profile.selectionHash || '');

package/factory/executor.mjs

@@ -113,8 +113,7 @@ async function container(mode, input, command, options = {}) {
       for (const file of ['pi-context-extension.mjs', 'pi-context-budget.mjs'])
         writeFileSync(join(localDirectory, file), readFileSync(join(ROOT, 'factory', file)), { mode: 0o600, flag: 'wx' });
       writeFileSync(join(localDirectory, 'models.json'), JSON.stringify(localRegistry(binding)), { mode: 0o600, flag: 'wx' });
-      args.push('--mount', `type=bind,source=${localDirectory},target=${LOCAL_AGENT_DIR},readonly`,
-        '--env', `PI_CODING_AGENT_DIR=${LOCAL_AGENT_DIR}`);
+      args.push('--mount', `type=bind,source=${localDirectory},target=${LOCAL_AGENT_DIR},readonly`);
     }
     selectedModelEnvironment = writeSelectedModelEnvironment(join(state, 'model.env'), modelEnvironmentPath, {
       phase: mode, executor: execution.executor, inferenceProvider: config.inferenceProvider,

package/factory/pi-context-extension.mjs

@@ -1,11 +1,10 @@
 // Explicitly mounted Factory adapter, never discovered from the host/repository.
 import { readFileSync, writeSync } from 'node:fs';
-import { join } from 'node:path';
 import { openAICompletionsApi } from '@earendil-works/pi-ai';
 import { bytes, fitToolText, projectedTokens, restoreOutputBudget, validatePairs } from './pi-context-budget.mjs';
 
 export default function factoryLocalContext(pi) {
-  const registry = JSON.parse(readFileSync(join(process.env.PI_CODING_AGENT_DIR, 'models.json'), 'utf8'));
+  const registry = JSON.parse(readFileSync(new URL('./models.json', import.meta.url), 'utf8'));
   const configured = registry.providers['factory-local'].models[0];
   const window = configured.contextWindow, output = configured.maxTokens;
   let task;

package/factory/pi-local-launch.mjs

@@ -1,6 +1,6 @@
 // Mounted read-only beside the single selected registry. Keep all JSON evidence;
 // process exit alone does not establish a successfully completed Pi turn.
-import { readFileSync } from 'node:fs';
+import { mkdtempSync, readFileSync, rmSync, symlinkSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { spawn, spawnSync } from 'node:child_process';
@@ -116,16 +116,24 @@ function launch() {
   // Never inherit credential inputs, provider overrides, NODE_OPTIONS or external
   // Pi directories. The runtime image supplies binaries; the repository supplies data.
   const env = Object.fromEntries(['PATH', 'HOME', 'LANG', 'TMPDIR', 'FACTORY_PHASE'].filter(key => process.env[key] !== undefined).map(key => [key, process.env[key]]));
-  env.PI_CODING_AGENT_DIR = directory;
   for (const file of ['pi-context-extension.mjs', 'pi-context-budget.mjs']) readFileSync(join(directory, file));
   const version = spawnSync('pi', ['--version'], { env, encoding: 'utf8', timeout: 10000 });
   if (version.status !== 0 || version.stdout.trim() !== '0.87.1')
     throw new Error('Local context protection requires pinned Pi 0.87.1; qualify and select the worker image while idle. No fallback.');
-  // The explicit non-secret runtime key bypasses Pi 0.87.1's credential-store
-  // refresh, which otherwise tries to lock auth.json in this read-only mount.
-  // --no-extensions still disables discovery. Only this read-only bundled path
-  // is explicitly enabled; it cannot load repository or host extensions.
-  const child = spawn('pi', [...args, '--extension', join(directory, 'pi-context-extension.mjs'), '--api-key', 'factory-local-keyless'], { env, stdio: ['inherit', 'pipe', 'inherit'] });
+  // Pi's home is mutable runtime state (including trust-store locks), not the
+  // operator-owned binding. Each launch gets a private directory in the existing
+  // sandbox tmpfs; no host trust/auth/settings are copied. Keep model input linked
+  // to its read-only mount, and load the adapter directly from that mount.
+  const runtimeDirectory = mkdtempSync('/tmp/factory-pi-');
+  const cleanup = () => rmSync(runtimeDirectory, { recursive: true, force: true });
+  process.on('exit', cleanup); // Container teardown also clears interrupted runs.
+  symlinkSync(join(directory, 'models.json'), join(runtimeDirectory, 'models.json'));
+  env.PI_CODING_AGENT_DIR = runtimeDirectory;
+  // Denying project trust also prevents project settings/packages and dependency
+  // installation, which --no-extensions alone does not prevent. Explicit CLI
+  // resources remain available in pinned Pi: only our adapter and mounted skills.
+  const child = spawn('pi', [...args, '--no-approve', '--no-extensions', '--no-skills', '--no-prompt-templates',
+    '--extension', join(directory, 'pi-context-extension.mjs'), '--api-key', 'factory-local-keyless'], { env, stdio: ['inherit', 'pipe', 'inherit'] });
   const completion = new PiCompletion();
   child.stdout.setEncoding('utf8');
   child.stdout.on('data', chunk => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "software-defence-factory",
-  "version": "0.15.2",
+  "version": "0.15.3",
   "description": "Factory: scoped software delivery and defence investigations with isolated jobs, evidence and review",
   "type": "module",
   "license": "MIT",
@@ -58,7 +58,7 @@
     "check": "node scripts/check.mjs && node --test tests/*.test.mjs && npm run test:dashboard",
     "build:dashboard": "npm --prefix dashboard ci --ignore-scripts && npm --prefix dashboard run build",
     "test:dashboard": "npm --prefix dashboard test",
-    "qualify:pi": "FACTORY_REQUIRE_PI=1 node --test tests/pi-local-adapter.test.mjs tests/pi-context.test.mjs tests/pi-context-batch.test.mjs"
+    "qualify:pi": "FACTORY_REQUIRE_PI=1 node --test tests/pi-local-adapter.test.mjs tests/pi-trust.test.mjs tests/pi-context.test.mjs tests/pi-context-batch.test.mjs"
   },
   "dependencies": {
     "yaml": "2.9.1"