Skip to content

openenvd 4/5: relays and the external surfaces - #1386

Draft
zkwentz wants to merge 2 commits into
zkwentz/openenvd-k3b-confinementfrom
zkwentz/openenvd-k4-relays
Draft

openenvd 4/5: relays and the external surfaces#1386
zkwentz wants to merge 2 commits into
zkwentz/openenvd-k3b-confinementfrom
zkwentz/openenvd-k4-relays

Conversation

@zkwentz

@zkwentz zkwentz commented Oct 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Summary

These are the relays every call out of the agent zone crosses, and the unit's single external listener.

  • relays.py:
    • env_relay_app relays any HTTP or websocket request to the unmodified env server on a Unix socket, with byte-identical responses. Hooks let the surfaces notice activity and done.
    • model_proxy_app accepts only the placeholder key and injects the real one, so the real key never enters a zone.
    • service_relay_app proxies to a hidden service and strips headers that reveal infrastructure.
  • surfaces.py. One TCP listener:
    • /mcp and other env paths stay unchanged for the agent;
    • /ws, /reset, /step and /state need the orchestrator token, so agents cannot reset;
    • /info, /verdict, /inspect, /resume, /reset_unit and /end_episode are orchestrator controls;
    • error bodies carry stable codes only.

How a call travels

How calls travel: the harness through the model proxy and MCP relay, the orchestrator through the surfaces

The harness believes it's talking to localhost. Every byte goes through openenvd, and the model's real key exists only between the proxy and the model.

Test plan

  • 109 passed and 2 skipped cumulatively. An end-to-end test serves the real echo env through the surfaces.

Stack

Part of openenvd on kernel primitives (#1053). Review bottom-up; each PR shows only its own layer.

  1. openenvd 1/5: manifest contract and unit phases #1383: Contract and phases
  2. openenvd 2/5: cgroups and the isolation preflight #1385: cgroups and the isolation preflight
  3. openenvd 3/5: confinement (seccomp, OCI, shim, forwarders, custody) #1416: Confinement: seccomp, OCI, shim, forwarders, custody
  4. openenvd 4/5: relays and the external surfaces #1386: Relays and surfaces ← this PR
  5. openenvd 5/5: unit assembly, daemon, enforcement check and live tests #1387: Unit, daemon, check, live tests

Deployment assumption: openenvd ships in every image. Run privileged (a microVM in production, or docker run --privileged in development) and it isolates. Run any other way and it logs isolation disabled and serves the environment exactly as before.

The trace machinery (hash-chained trace, seal, harness self-report cross-check, /observe) is parked on zkwentz/openenvd-with-trace and is out of this stack's scope.

🤖 Generated with Claude Code

This was referenced Oct 9, 2026
Open
Closed
Open
Draft
@zkwentz
zkwentz force-pushed the zkwentz/openenvd-k4-relays branch from 1d81005 to ba6b6de Compare October 12, 2026 17:35
@zkwentz zkwentz changed the title openenvd 4/5: recording relays and the external surfaces openenvd 3/4: relays and the external surfaces Oct 12, 2026
@zkwentz
zkwentz added this pull request to stack #1415 October 12, 2026 18:38
github-code-quality[bot]
github-code-quality Bot found potential problems Oct 12, 2026
View reviewed changes
Comment thread src/openenv/core/openenvd/relays.py
task.cancel()
for task in pending:
with contextlib.suppress(asyncio.CancelledError, Exception):
await task
Comment thread src/openenv/core/openenvd/relays.py
server.should_exit = True
task = getattr(server, "serve_task", None)
if task is not None:
await task
@zkwentz
zkwentz force-pushed the zkwentz/openenvd-k4-relays branch from ba6b6de to 48d2c2a Compare October 13, 2026 00:31
@zkwentz
zkwentz removed this pull request from stack #1415 October 13, 2026 00:32
@zkwentz
zkwentz changed the base branch from zkwentz/openenvd-k3-kernel to zkwentz/openenvd-k3b-confinement October 13, 2026 00:32
@zkwentz
zkwentz added this pull request to stack #1417 October 13, 2026 00:32
@zkwentz zkwentz mentioned this pull request Oct 13, 2026
Draft
1 task done
@zkwentz zkwentz changed the title openenvd 3/4: relays and the external surfaces openenvd 4/5: relays and the external surfaces Oct 13, 2026
@zkwentz
zkwentz force-pushed the zkwentz/openenvd-k4-relays branch 2 times, most recently from c83fc2e to 7152863 Compare October 13, 2026 01:29
@zkwentz
zkwentz force-pushed the zkwentz/openenvd-k4-relays branch from 7152863 to 17474ea Compare October 13, 2026 14:23
zkwentz and others added 2 commits October 13, 2026 13:32
@zkwentz @claude
openenvd 4/5: relays and the external surfaces
229f8ad 
Part 4 of 5 of openenvd on kernel primitives (#1053).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@zkwentz @claude
Drop peercred: nothing used it
e8c5c7b 
Each container already reaches only its own socket directory, so the
cgroup check on Unix-socket peers had no caller.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@zkwentz
zkwentz force-pushed the zkwentz/openenvd-k4-relays branch from 17474ea to e8c5c7b Compare October 13, 2026 17:35

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@github-code-quality github-code-quality[bot] github-code-quality[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@zkwentz