26b4a5be60
feat(P02): telemetry-wired sandbox spawn (Wave 3)
...
Task 2-3-01: create(learner_id, task_id) — telemetry sandboxes run a persistent
helper/inner namespace topology (offline inner ns; agent joins mount ns only and stays
online to reach the loopback ingest). Capture agent copied into the workspace (visible
in-ns at the bind), launched via sh -c with in-ns absolute paths (host cwd invalid after
the nsenter mount swap), stdin=DEVNULL daemonizes the agent (lifecycle tied to sandbox:
destroy reaps agent -> inner -> helper). Wire contract: frames strip URL-owned identity
(ingest extra=forbid anti-spoofing); spool keeps full events.
E2E test (real uvicorn on ephemeral port): exec in a live namespace sandbox -> events
arrive at WS ingest -> SQLite, ordered, sandbox-scoped. Pure-shell path (task_id=None)
asserts no capture agent. Full suite 216 green; ruff clean.
---ci---
phase: 2
milestone: v0.3
status: execute
requirements: {covered: [REQ-3-003], partial: []}
---/ci---
2026-09-12 00:47:45 +00:00
2d9f3201b3
feat(P01): sandbox backend + workdir + deps + config (Wave 1)
...
Task 1-1-01: SandboxBackend protocol + UnshareBackend (unshare user/mount/pid/net)
+ workdir layout (workspace/ + snapshots/). Isolation probe real on this box:
in-ns uid=0, network isolated (fresh net ns, lo only), writes contained to per-sandbox
bind dir; proc-remount not permitted (documented, not required). Deviations (documented):
util-linux 2.38.1 lacks --bind flag -> bind moved into namespace via sh -c mount shim;
rlimits moved into shim (preexec would kill the pytest interpreter); userns != DAC barrier
(host-uid-owned targets), documented for hardening under D-025.
Task 1-1-02: add sqlmodel, sqlalchemy, websockets, aiofiles (PyPI-verified); config keys
SANDBOX_DIR/MAX_CONCURRENT=5/TIMEOUT_S=900/MAX_WORKDIR_MB=512/DB_PATH (D-024/027/032/G-2).
Task 1-1-03: README sandbox isolation section with real probe transcript + locked
resource-limit mechanism (G-1/G-2); ruff config already correct (no change).
139/139 tests pass; ruff clean. .gitignore: ignore all ai-service sandboxes dirs (runtime+tests).
---ci---
phase: 1
milestone: v0.3
status: execute
requirements: {covered: [REQ-3-001, REQ-3-002], partial: []}
---/ci---
2026-09-12 00:47:45 +00:00
01286a02cb
docs(init): validate specification — milestone v0.3 credential-engines
...
- config.json: milestone v0.3 credential-engines, branch milestone/v0.3-credential-engines
- PROJECT.md: v0.3 scope sandbox fabric, telemetry, trace grading, variant gen, voice defense;
REQ-F-017 (identity/age-gating) explicitly deferred per founder directive
- REQUIREMENTS.md: activate REQ-F-007/008/009/010/021 as REQ-3-001..008; REQ-F-017 re-deferred to v0.4+
- ROADMAP.md: v0.3 phase structure P0-P7
- .gitignore: ignore .ciagent/bin/ (local credential helper)
- Clear stale v0.2 CHECKPOINT.json (milestone complete; new run starts at SPECIFY)
---ci---
phase: 0
milestone: v0.3
status: specify
---/ci---
2026-09-12 00:47:45 +00:00
88a1dab810
docs(milestone): complete v0.2-ai-tutor-architecture
...
---ci---
phase: 7
milestone: v0.2
status: complete
requirements:
covered: [REQ-2-001, REQ-2-002, REQ-2-003, REQ-2-004, REQ-2-005, REQ-2-006, REQ-2-007, REQ-2-008, REQ-2-009, REQ-2-010, REQ-2-011, REQ-2-012]
partial: []
---/ci---
Milestone v0.2 (ai-tutor-architecture) merged to main.
Escalation record (audit remediation, durable): P1 executor
delegation failed twice (empty subagent results, zero files
created); auto-resolved at full autonomy to inline execution with
identical plan fidelity (commit 3271373, reflog-only after phase
branch squash-delete).
2026-09-11 17:34:50 +00:00
810485ecc8
docs(milestone): complete v0.1-nextcraft-ui-prototype
...
---ci---
phase: 7
milestone: v0.1
status: complete
requirements:
covered: [REQ-001, REQ-002, REQ-003, REQ-004, REQ-005, REQ-006, REQ-007, REQ-008, REQ-009, REQ-010, REQ-011, REQ-012, REQ-013, REQ-014, REQ-015, REQ-016, REQ-017, REQ-018, REQ-019, REQ-020, REQ-021, REQ-022, REQ-023, REQ-024, REQ-025, REQ-026, REQ-027, REQ-028]
partial: []
---/ci---
Milestone v0.1 (nextcraft-ui-prototype) complete.
Summary:
- 7 phases (P0 pre-execution + P1-P6 execution + P7 final review)
- 28 requirements covered (all complete)
- 4 surfaces: Learner (7 pages), Marketplace (5), Employer Dashboard (4), Admin (4)
- 19 routes, 104 TypeScript files
- Shared component library (5 primitives + design tokens)
- Mock data: 5 competency stacks (70 competencies), 20 jobs, 15 candidates, 10 employers
- Tech: Next.js 15, Tailwind CSS v4, lucide-react, recharts, @xyflow/react, Inter font
- Storybook with 6 stories
- Dark mode, breadcrumbs, role switcher, responsive design
- Build passes, typecheck passes, Storybook build passes
Phases:
P0 pre-execution → v0.0.1
P1 project-scaffolding → v0.0.2
P2 learner-surface → v0.0.3
P3 marketplace-surface → v0.0.4
P4 employer-dashboard → v0.0.5
P5 admin-surface → v0.0.6
P6 polish-integration → v0.0.7
P7 final-review-ship → v0.1.0 (milestone release)
2026-09-10 22:47:56 +00:00
CIAgent