Add UID/GID isolation for evaluated agents - #87

Draft

dmorosanu wants to merge 9 commits into

mainfrom

codex/uid-gid-agent-isolation

Commits on Aug 6, 2026

Add UID/GID agent isolation
dmorosanu
committed
7e3654a
Support protected mock passthrough
dmorosanu
committed
c7be068

Commits on Aug 7, 2026

fix(docker): pin npm global prefix so the claude CLI lands where the isolation wrapper execs it
dmorosanu
committed
02ca02c
fix(docker): exempt the isolation-managed agent workspace from the reserved-path assertion
dmorosanu
committed
62cfccd
test(docker): give the build-failure fixture a real agent type for the isolation default
dmorosanu
committed
0502c1b
fix(isolation): stop the evaluated agent inheriting the evaluator Bedrock credential
dmorosanu
committed
7f2b135
test(codex): isolate env assertions from ambient scrubbed credentials
dmorosanu
committed
7d4a41a
style: apply ruff format to isolation and protected mock modules
dmorosanu
committed
f26387d
test(plugin-bundle): fix drift test writing into the hardened bundle dir and skip POSIX-only relative symlinks on Windows
dmorosanu
committed
24e8a59