[P2.69] Agent subprocesses can still read same-uid secrets outside CodeFRAME's own processes: ancestor shell environ, codex workspace-write reads

[frankbria]

Spun off from PR #1321 (issue #1286) during post-merge disposition.

Context

#1321 makes cf, the batch worker and the server non-dumpable, so an agent command can no longer read their /proc/<pid>/environ. The agent still runs as the operator's uid, so three same-uid paths remain open:

• Ancestor shell: a key exported in the shell that launched cf is in that shell's environ, one level above $PPID, and the shell is dumpable. The same applies to any other same-uid process on a self-hosted box, such as next dev.
• codex workspace-write: this sandbox limits writes, not reads. A sandboxed command can read an absolute path to ~/.codeframe/credentials without an approval request, so no denylist ever sees it (see the [P2.50] Agent subprocesses can read the parent's full environment via /proc/$PPID/environ, defeating the #721/#996 allowlist #1286 comment from [P2.42] Codex adapter lacks the zero-file false-completion guard, and its #916 dangerous-command guard is unreachable #1278 / PR fix(codex): zero-file guard + sandbox-preserving approval routing (#1278) #1318).
• Denylist evasion: the denylist is string matching, and quoted segments ("/proc"/"$PPID"/environ) and globs (/proc/1/en*) defeat it. The GLM review of fix(security): make cf/worker/server non-dumpable so agents cannot read /proc/$PPID/environ (#1286) #1321 noted this.

Why it was not done in that PR

Each of these needs OS-level isolation, which a prctl flag or a regex cannot provide. It is the same prerequisite as hosted mode (#1266 / #1303).

Definition of done

• Agent-steerable subprocesses (ReAct run_command, hooks, delegated CLIs) run under OS isolation that hides the operator's other processes' /proc and credential paths: a separate uid, a PID + mount namespace (bubblewrap/landlock), or a container.
• A test in the style of tests/core/test_proc_environ_1286.py proves a grandparent-shell sentinel and ~/.codeframe/credentials are both unreadable.

[frankbria]

Gated (needs-owner): this needs an OS-level isolation decision (bubblewrap vs. a separate uid vs. a container per run) that the owner chose to defer on 2026-10-02 in favour of the P1 launch blockers. Hosted execution is already refused (#1266), so this only matters once hosted mode launches.

[frankbria]

Owner steps (2026-10-06)

Priority 7 of 7. Deferred on purpose (owner, 2026-10-02). Hosted execution is already refused (#1266), so nothing is needed until hosted mode is scheduled. One decision unblocks both this issue and #1344.

When hosted mode is on the roadmap:

1. Choose the isolation model for agent-steerable subprocesses (ReAct run_command, hooks, delegated CLIs):

• Container per run. Strongest, and matches the "containers are the durable fix" direction; heaviest per run.
• Separate uid per tenant. Strong /proc and credential isolation; needs host-level user management (root/sudoers) on the server.
• bubblewrap / Landlock namespaces. Lightest and Linux-only; the agent's sandbox config becomes security-critical code.

2. Record it.

gh issue comment 1322 --repo frankbria/codeframe --body "Decision: <container per run | uid per tenant | bubblewrap>. Hosted-mode target: <date>."

3. The agent then writes the design and plan, implements it with the test_proc_environ_1286-style proof (a grandparent-shell sentinel and ~/.codeframe/credentials unreadable), and moves on to #1344. Your only further input is approving the PRs.

[frankbria]

Relabelled needs-owner → Future (owner, 2026-10-06). It stays deferred until hosted mode is scheduled; hosted execution is refused until then (#1266). The isolation-model decision steps above still apply when it's picked up.