Plan hardening: socket-proxy allowlist, gateway load test, offline verify

- The compose server NEVER sees the raw Docker socket (plan risk #5):
  tecnativa/docker-socket-proxy on an isolated engine_net with exactly
  CONTAINERS/POST/EXEC/DELETE/VERSION allowed; server reaches it via
  DOCKER_HOST. DockerDriver honors DOCKER_HOST (connect_to). Proven by a
  REAL proxy test: full sandbox lifecycle works through the allowlist
  while /networks, /secrets, and /images all 403 — the blast-radius cap
  if the server is ever owned. (This also fixes compose deployments,
  where sandbox provisioning previously had no engine access at all.)
- Gateway load test (plan P6): 40 concurrent SSE streams against one
  server — every run completes with the full §13 event vocabulary,
  every journal strictly monotonic, every resumeFrom=0 replay byte-equal
  to its live stream
- release.yml: SBOMs (syft, spdx-json) for all four images shipped
  INSIDE the signed bundle; final verification now runs in a
  --network none container — proving the customer's verify path needs
  no internet, not just claiming it

159 Rust tests.

Co-Authored-By: Claude Fable 5 <[email protected]>

crates/tc-sandbox/Cargo.toml

@@ -26,6 +26,7 @@ k8s = ["dep:kube", "dep:k8s-openapi", "dep:rustls"]
 k8s-tests = ["k8s"]
 
 [dev-dependencies]
+reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
 
 [lints]
 workspace = true

crates/tc-sandbox/src/docker.rs

@@ -23,11 +23,24 @@ pub struct DockerDriver {
 
 impl DockerDriver {
     pub fn connect() -> Result<DockerDriver, SandboxError> {
+        // DOCKER_HOST (set in compose to the allow-listed socket proxy)
+        // wins; otherwise the local socket.
+        if let Ok(host) = std::env::var("DOCKER_HOST") {
+            return DockerDriver::connect_to(&host);
+        }
         let docker = Docker::connect_with_local_defaults()
             .map_err(|e| SandboxError::Engine(e.to_string()))?;
         Ok(DockerDriver { docker })
     }
 
+    /// Connects to a specific engine endpoint, e.g. the compose
+    /// deployment's allow-listed socket proxy (`tcp://socket-proxy:2375`).
+    pub fn connect_to(host: &str) -> Result<DockerDriver, SandboxError> {
+        let docker = Docker::connect_with_http(host, 30, bollard::API_DEFAULT_VERSION)
+            .map_err(|e| SandboxError::Engine(e.to_string()))?;
+        Ok(DockerDriver { docker })
+    }
+
     /// Removes a container by name if it exists (test/restart hygiene).
     pub async fn destroy_by_name(&self, name: &str) -> Result<(), SandboxError> {
         self.docker

crates/tc-sandbox/tests/socket_proxy.rs

@@ -0,0 +1,147 @@
+//! The compose deployment never hands the raw Docker socket to the
+//! server: an allow-listed socket proxy (tecnativa/docker-socket-proxy)
+//! sits between them. This suite runs the REAL proxy with the production
+//! allowlist and proves (a) the full sandbox lifecycle works through it
+//! and (b) operations outside the allowlist are refused.
+
+use std::process::Command;
+
+use tc_sandbox::{DockerDriver, SandboxDriver, SandboxSpec};
+
+const PROXY_IMAGE: &str = "tecnativa/docker-socket-proxy:0.3";
+const IMAGE: &str = "teamclaw/agent-base:dev";
+
+fn ensure_agent_image() {
+    let exists = Command::new("docker")
+        .args(["image", "inspect", IMAGE])
+        .output()
+        .expect("docker available")
+        .status
+        .success();
+    if !exists {
+        let root = env!("CARGO_MANIFEST_DIR");
+        let status = Command::new("docker")
+            .args([
+                "build",
+                "-t",
+                IMAGE,
+                "-f",
+                &format!("{root}/../../images/agent-base/Dockerfile"),
+                &format!("{root}/../../images/agent-base"),
+            ])
+            .status()
+            .expect("docker build runs");
+        assert!(status.success());
+    }
+}
+
+/// Starts the proxy with EXACTLY the allowlist the compose file ships.
+fn spawn_proxy() -> (String, String) {
+    let name = format!("tc-sockproxy-{}", std::process::id());
+    Command::new("docker")
+        .args(["rm", "-f", &name])
+        .output()
+        .ok();
+    let output = Command::new("docker")
+        .args([
+            "run",
+            "-d",
+            "--name",
+            &name,
+            "-p",
+            "0:2375",
+            "-v",
+            "/var/run/docker.sock:/var/run/docker.sock:ro",
+            // The production allowlist (deploy/compose/docker-compose.yml):
+            // container lifecycle + exec, nothing else.
+            "-e",
+            "CONTAINERS=1",
+            "-e",
+            "POST=1",
+            "-e",
+            "EXEC=1",
+            "-e",
+            "DELETE=1",
+            "-e",
+            "VERSION=1",
+            PROXY_IMAGE,
+        ])
+        .output()
+        .expect("docker run");
+    assert!(
+        output.status.success(),
+        "proxy start: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    let port = Command::new("docker")
+        .args(["port", &name, "2375"])
+        .output()
+        .expect("docker port");
+    let mapping = String::from_utf8_lossy(&port.stdout);
+    let port = mapping
+        .lines()
+        .next()
+        .and_then(|line| line.rsplit(':').next())
+        .expect("mapped port")
+        .trim()
+        .to_owned();
+    (name, format!("tcp://127.0.0.1:{port}"))
+}
+
+#[tokio::test]
+async fn the_sandbox_lifecycle_works_through_the_allowlisted_proxy() {
+    ensure_agent_image();
+    let (proxy_name, docker_host) = spawn_proxy();
+
+    // The driver honors DOCKER_HOST — exactly how the compose server
+    // reaches the proxy.
+    let driver = DockerDriver::connect_to(&docker_host).expect("proxy reachable");
+    // The proxy needs a moment to come up.
+    let mut handle = None;
+    let spec = SandboxSpec {
+        name: format!("tc-proxy-test-{}", std::process::id()),
+        image: IMAGE.into(),
+        memory_bytes: 256 * 1024 * 1024,
+        nano_cpus: 500_000_000,
+        pids_limit: 64,
+        egress: false,
+    };
+    for _ in 0..20 {
+        match driver.provision(&spec).await {
+            Ok(h) => {
+                handle = Some(h);
+                break;
+            }
+            Err(_) => tokio::time::sleep(std::time::Duration::from_millis(500)).await,
+        }
+    }
+    let handle = handle.expect("provision through proxy");
+
+    let result = driver.exec(&handle, &["id", "-u"]).await.unwrap();
+    assert_eq!(result.stdout.trim(), "10001");
+    assert!(driver.health(&handle).await.unwrap());
+    driver.destroy(&handle).await.unwrap();
+    assert!(!driver.health(&handle).await.unwrap());
+
+    // Outside the allowlist: building images, listing networks, reading
+    // swarm secrets — the §15 blast-radius cap if the server is owned.
+    let client = reqwest::Client::new();
+    let base = docker_host.replace("tcp://", "http://");
+    for forbidden in ["/v1.43/networks", "/v1.43/secrets", "/v1.43/images/json"] {
+        let status = client
+            .get(format!("{base}{forbidden}"))
+            .send()
+            .await
+            .unwrap()
+            .status();
+        assert_eq!(
+            status, 403,
+            "{forbidden} must be refused by the proxy allowlist"
+        );
+    }
+
+    Command::new("docker")
+        .args(["rm", "-f", &proxy_name])
+        .output()
+        .ok();
+}