Plan hardening: socket-proxy allowlist, gateway load test, offline verify

- The compose server NEVER sees the raw Docker socket (plan risk #5):
  tecnativa/docker-socket-proxy on an isolated engine_net with exactly
  CONTAINERS/POST/EXEC/DELETE/VERSION allowed; server reaches it via
  DOCKER_HOST. DockerDriver honors DOCKER_HOST (connect_to). Proven by a
  REAL proxy test: full sandbox lifecycle works through the allowlist
  while /networks, /secrets, and /images all 403 — the blast-radius cap
  if the server is ever owned. (This also fixes compose deployments,
  where sandbox provisioning previously had no engine access at all.)
- Gateway load test (plan P6): 40 concurrent SSE streams against one
  server — every run completes with the full §13 event vocabulary,
  every journal strictly monotonic, every resumeFrom=0 replay byte-equal
  to its live stream
- release.yml: SBOMs (syft, spdx-json) for all four images shipped
  INSIDE the signed bundle; final verification now runs in a
  --network none container — proving the customer's verify path needs
  no internet, not just claiming it

159 Rust tests.

Co-Authored-By: Claude Fable 5 <[email protected]>

.github/workflows/release.yml

@@ -28,6 +28,16 @@ jobs:
           docker build -t "teamclaw/agent-browser:$VERSION" images/agent-browser
           docker pull postgres:16-alpine
 
+      - name: SBOMs for every shipped image
+        run: |
+          mkdir -p dist/sboms
+          curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh \
+            | sh -s -- -b /usr/local/bin
+          for image in server frontend agent-base agent-browser; do
+            syft "teamclaw/$image:$VERSION" -o spdx-json \
+              > "dist/sboms/$image.spdx.json"
+          done
+
       - name: Save image tarballs
         run: |
           mkdir -p dist/images
@@ -62,6 +72,10 @@ jobs:
             images/seccomp/agent-profile.json=seccomp/agent-profile.json \
             deploy/airgapped/install.sh=install.sh \
             "$BUNDLER"=bin/teamclaw-bundler \
+            dist/sboms/server.spdx.json=sboms/server.spdx.json \
+            dist/sboms/frontend.spdx.json=sboms/frontend.spdx.json \
+            dist/sboms/agent-base.spdx.json=sboms/agent-base.spdx.json \
+            dist/sboms/agent-browser.spdx.json=sboms/agent-browser.spdx.json \
             $ARTIFACTS
           chmod +x dist/bundle/bin/teamclaw-bundler dist/bundle/install.sh
           rm /tmp/release.key
@@ -73,8 +87,13 @@ jobs:
           printf '%s' "$BUNDLE_SIGNING_KEY" > /tmp/release.key
           target/release/teamclaw-bundler pubkey /tmp/release.key dist/release.pub
           rm /tmp/release.key
-          # The customer's exact procedure: only the public half.
+          # The customer's exact procedure: only the public half — and
-          target/release/teamclaw-bundler verify dist/bundle dist/release.pub
+          # inside a NETWORK-DISABLED container, proving verification
+          # needs no internet (the air-gapped contract).
+          docker run --rm --network none \
+            -v "$PWD/dist:/dist:ro" \
+            ubuntu:24.04 \
+            /dist/bundle/bin/teamclaw-bundler verify /dist/bundle /dist/release.pub
 
       - name: Tarball
         run: tar -C dist -czf "teamclaw-bundle-$VERSION.tgz" bundle

Cargo.lock

@@ -3525,6 +3525,7 @@ dependencies = [
  "futures",
  "k8s-openapi",
  "kube",
+ "reqwest",
  "rustls",
  "serde",
  "serde_json",

crates/tc-api/tests/gateway_load.rs

@@ -0,0 +1,184 @@
+//! Gateway under load (plan P6): many concurrent SSE streams against one
+//! server — every run completes, every journal is strictly monotonic, and
+//! every replay is byte-equal to its live stream. The §13 contract must
+//! not degrade under concurrency.
+
+use std::sync::Arc;
+
+use eventsource_stream::Eventsource;
+use futures::StreamExt;
+use serde_json::{json, Value};
+use tc_api::AppState;
+use tc_auth::AuthService;
+use tc_domain::{Role, User, UserId, Workspace, WorkspaceId};
+use tc_llm::ScriptedProvider;
+use tc_runtime::{Runtime, RuntimeConfig};
+
+const STREAMS: usize = 40;
+
+const SCENARIOS: &str = r#"
+[[scenario]]
+marker = "[[scenario:tool-time]]"
+
+[[scenario.turns]]
+events = [
+    { type = "text", text = "Checking. " },
+    { type = "tool_use", name = "clock.now", input = {} },
+]
+
+[[scenario.turns]]
+events = [
+    { type = "text", text = "I checked the current time for you." },
+]
+"#;
+
+async fn collect_sse(response: reqwest::Response) -> Vec<(String, String, Value)> {
+    let mut events = Vec::new();
+    let mut stream = response.bytes_stream().eventsource();
+    while let Some(event) = stream.next().await {
+        let event = event.unwrap();
+        let data: Value = serde_json::from_str(&event.data).unwrap();
+        let name = event.event.clone();
+        let done = name == "run_completed" || name == "error";
+        events.push((event.id, name, data));
+        if done {
+            break;
+        }
+    }
+    events
+}
+
+#[tokio::test]
+async fn forty_concurrent_streams_complete_and_replay_identically() {
+    let pool = tc_testkit::test_pool().await;
+    let runtime = Runtime::new(
+        pool.clone(),
+        Arc::new(ScriptedProvider::from_toml(SCENARIOS).unwrap()),
+        RuntimeConfig::basic("scripted", 1024),
+    );
+    let app = tc_api::router(AppState::new(pool.clone(), runtime));
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let base = format!("http://{}", listener.local_addr().unwrap());
+    tokio::spawn(async move {
+        axum::serve(listener, app).await.unwrap();
+    });
+
+    let ws = Workspace {
+        id: WorkspaceId::new(),
+        name: "Acme".into(),
+        plan: "team".into(),
+    };
+    tc_db::repo::workspaces::insert(&pool, &ws).await.unwrap();
+    let owner = User {
+        id: UserId::new(),
+        workspace_id: ws.id,
+        email: format!("{}@acme.test", UserId::new()),
+        role: Role::Owner,
+        display_name: "Owner".into(),
+        created_at: time::OffsetDateTime::UNIX_EPOCH,
+    };
+    tc_db::repo::users::insert(&pool, &owner).await.unwrap();
+    AuthService::new(pool.clone())
+        .set_password(owner.id, "pw")
+        .await
+        .unwrap();
+    let client = reqwest::Client::new();
+    let token = client
+        .post(format!("{base}/api/auth/login"))
+        .json(&json!({"email": owner.email, "password": "pw"}))
+        .send()
+        .await
+        .unwrap()
+        .json::<Value>()
+        .await
+        .unwrap()["token"]
+        .as_str()
+        .unwrap()
+        .to_owned();
+    let claw: Value = client
+        .post(format!("{base}/api/claws"))
+        .bearer_auth(&token)
+        .json(&json!({"name": "Scout", "job_title": "Analyst"}))
+        .send()
+        .await
+        .unwrap()
+        .json()
+        .await
+        .unwrap();
+    let claw_id = claw["id"].as_str().unwrap().to_owned();
+
+    // Fire all streams concurrently, one session each.
+    let mut tasks = Vec::new();
+    for i in 0..STREAMS {
+        let client = client.clone();
+        let base = base.clone();
+        let token = token.clone();
+        let claw_id = claw_id.clone();
+        tasks.push(tokio::spawn(async move {
+            let session: Value = client
+                .post(format!("{base}/api/sessions"))
+                .bearer_auth(&token)
+                .json(&json!({"clawId": claw_id, "title": format!("Load {i}")}))
+                .send()
+                .await
+                .unwrap()
+                .json()
+                .await
+                .unwrap();
+            let session_key = session["sessionKey"].as_str().unwrap().to_owned();
+            let response = client
+                .post(format!("{base}/api/gateway?clawId={claw_id}"))
+                .bearer_auth(&token)
+                .json(&json!({
+                    "sessionKey": session_key,
+                    "message": format!("time check {i} [[scenario:tool-time]]"),
+                }))
+                .send()
+                .await
+                .unwrap();
+            assert_eq!(
+                response.status(),
+                200,
+                "stream {i}: {}",
+                response.text().await.unwrap_or_default()
+            );
+            let live = collect_sse(response).await;
+            (session_key, live)
+        }));
+    }
+
+    let mut runs = Vec::new();
+    for task in tasks {
+        runs.push(task.await.unwrap());
+    }
+    assert_eq!(runs.len(), STREAMS);
+
+    for (session_key, live) in &runs {
+        // Completed, with the full §13 event vocabulary in order.
+        let names: Vec<&str> = live.iter().map(|(_, name, _)| name.as_str()).collect();
+        assert_eq!(*names.first().unwrap(), "run_started", "{session_key}");
+        assert_eq!(*names.last().unwrap(), "run_completed", "{session_key}");
+        assert!(names.contains(&"step_started"));
+        assert!(names.contains(&"step_finished"));
+
+        // Strictly monotonic journal ids.
+        let ids: Vec<i64> = live.iter().map(|(id, _, _)| id.parse().unwrap()).collect();
+        assert!(
+            ids.windows(2).all(|pair| pair[1] > pair[0]),
+            "monotonic ids: {ids:?}"
+        );
+
+        // Replay equals live, byte for byte.
+        let replay = collect_sse(
+            client
+                .post(format!("{base}/api/gateway?clawId={claw_id}"))
+                .bearer_auth(&token)
+                .json(&json!({"sessionKey": session_key, "resumeFrom": 0}))
+                .send()
+                .await
+                .unwrap(),
+        )
+        .await;
+        assert_eq!(&replay, live, "replay must equal live for {session_key}");
+    }
+}

crates/tc-sandbox/Cargo.toml

@@ -26,6 +26,7 @@ k8s = ["dep:kube", "dep:k8s-openapi", "dep:rustls"]
 k8s-tests = ["k8s"]
 
 [dev-dependencies]
+reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
 
 [lints]
 workspace = true

crates/tc-sandbox/src/docker.rs

@@ -23,11 +23,24 @@ pub struct DockerDriver {
 
 impl DockerDriver {
     pub fn connect() -> Result<DockerDriver, SandboxError> {
+        // DOCKER_HOST (set in compose to the allow-listed socket proxy)
+        // wins; otherwise the local socket.
+        if let Ok(host) = std::env::var("DOCKER_HOST") {
+            return DockerDriver::connect_to(&host);
+        }
         let docker = Docker::connect_with_local_defaults()
             .map_err(|e| SandboxError::Engine(e.to_string()))?;
         Ok(DockerDriver { docker })
     }
 
+    /// Connects to a specific engine endpoint, e.g. the compose
+    /// deployment's allow-listed socket proxy (`tcp://socket-proxy:2375`).
+    pub fn connect_to(host: &str) -> Result<DockerDriver, SandboxError> {
+        let docker = Docker::connect_with_http(host, 30, bollard::API_DEFAULT_VERSION)
+            .map_err(|e| SandboxError::Engine(e.to_string()))?;
+        Ok(DockerDriver { docker })
+    }
+
     /// Removes a container by name if it exists (test/restart hygiene).
     pub async fn destroy_by_name(&self, name: &str) -> Result<(), SandboxError> {
         self.docker

crates/tc-sandbox/tests/socket_proxy.rs

@@ -0,0 +1,147 @@
+//! The compose deployment never hands the raw Docker socket to the
+//! server: an allow-listed socket proxy (tecnativa/docker-socket-proxy)
+//! sits between them. This suite runs the REAL proxy with the production
+//! allowlist and proves (a) the full sandbox lifecycle works through it
+//! and (b) operations outside the allowlist are refused.
+
+use std::process::Command;
+
+use tc_sandbox::{DockerDriver, SandboxDriver, SandboxSpec};
+
+const PROXY_IMAGE: &str = "tecnativa/docker-socket-proxy:0.3";
+const IMAGE: &str = "teamclaw/agent-base:dev";
+
+fn ensure_agent_image() {
+    let exists = Command::new("docker")
+        .args(["image", "inspect", IMAGE])
+        .output()
+        .expect("docker available")
+        .status
+        .success();
+    if !exists {
+        let root = env!("CARGO_MANIFEST_DIR");
+        let status = Command::new("docker")
+            .args([
+                "build",
+                "-t",
+                IMAGE,
+                "-f",
+                &format!("{root}/../../images/agent-base/Dockerfile"),
+                &format!("{root}/../../images/agent-base"),
+            ])
+            .status()
+            .expect("docker build runs");
+        assert!(status.success());
+    }
+}
+
+/// Starts the proxy with EXACTLY the allowlist the compose file ships.
+fn spawn_proxy() -> (String, String) {
+    let name = format!("tc-sockproxy-{}", std::process::id());
+    Command::new("docker")
+        .args(["rm", "-f", &name])
+        .output()
+        .ok();
+    let output = Command::new("docker")
+        .args([
+            "run",
+            "-d",
+            "--name",
+            &name,
+            "-p",
+            "0:2375",
+            "-v",
+            "/var/run/docker.sock:/var/run/docker.sock:ro",
+            // The production allowlist (deploy/compose/docker-compose.yml):
+            // container lifecycle + exec, nothing else.
+            "-e",
+            "CONTAINERS=1",
+            "-e",
+            "POST=1",
+            "-e",
+            "EXEC=1",
+            "-e",
+            "DELETE=1",
+            "-e",
+            "VERSION=1",
+            PROXY_IMAGE,
+        ])
+        .output()
+        .expect("docker run");
+    assert!(
+        output.status.success(),
+        "proxy start: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    let port = Command::new("docker")
+        .args(["port", &name, "2375"])
+        .output()
+        .expect("docker port");
+    let mapping = String::from_utf8_lossy(&port.stdout);
+    let port = mapping
+        .lines()
+        .next()
+        .and_then(|line| line.rsplit(':').next())
+        .expect("mapped port")
+        .trim()
+        .to_owned();
+    (name, format!("tcp://127.0.0.1:{port}"))
+}
+
+#[tokio::test]
+async fn the_sandbox_lifecycle_works_through_the_allowlisted_proxy() {
+    ensure_agent_image();
+    let (proxy_name, docker_host) = spawn_proxy();
+
+    // The driver honors DOCKER_HOST — exactly how the compose server
+    // reaches the proxy.
+    let driver = DockerDriver::connect_to(&docker_host).expect("proxy reachable");
+    // The proxy needs a moment to come up.
+    let mut handle = None;
+    let spec = SandboxSpec {
+        name: format!("tc-proxy-test-{}", std::process::id()),
+        image: IMAGE.into(),
+        memory_bytes: 256 * 1024 * 1024,
+        nano_cpus: 500_000_000,
+        pids_limit: 64,
+        egress: false,
+    };
+    for _ in 0..20 {
+        match driver.provision(&spec).await {
+            Ok(h) => {
+                handle = Some(h);
+                break;
+            }
+            Err(_) => tokio::time::sleep(std::time::Duration::from_millis(500)).await,
+        }
+    }
+    let handle = handle.expect("provision through proxy");
+
+    let result = driver.exec(&handle, &["id", "-u"]).await.unwrap();
+    assert_eq!(result.stdout.trim(), "10001");
+    assert!(driver.health(&handle).await.unwrap());
+    driver.destroy(&handle).await.unwrap();
+    assert!(!driver.health(&handle).await.unwrap());
+
+    // Outside the allowlist: building images, listing networks, reading
+    // swarm secrets — the §15 blast-radius cap if the server is owned.
+    let client = reqwest::Client::new();
+    let base = docker_host.replace("tcp://", "http://");
+    for forbidden in ["/v1.43/networks", "/v1.43/secrets", "/v1.43/images/json"] {
+        let status = client
+            .get(format!("{base}{forbidden}"))
+            .send()
+            .await
+            .unwrap()
+            .status();
+        assert_eq!(
+            status, 403,
+            "{forbidden} must be refused by the proxy allowlist"
+        );
+    }
+
+    Command::new("docker")
+        .args(["rm", "-f", &proxy_name])
+        .output()
+        .ok();
+}

deploy/compose/docker-compose.yml

@@ -17,6 +17,10 @@ networks:
     internal: true
   secrets_net:
     internal: true
+  # Server <-> socket proxy only; the raw Docker socket never reaches the
+  # server container.
+  engine_net:
+    internal: true
 
 volumes:
   pgdata: {}
@@ -37,6 +41,23 @@ services:
       timeout: 3s
       retries: 12
 
+  # Allow-listed Docker API (§15 blast-radius cap): the server can
+  # create/exec/stop/remove sandbox containers and NOTHING else — no
+  # image builds, no networks, no secrets, no volumes. Proven by
+  # crates/tc-sandbox/tests/socket_proxy.rs against this exact allowlist.
+  socket-proxy:
+    image: tecnativa/docker-socket-proxy:0.3
+    restart: unless-stopped
+    environment:
+      CONTAINERS: 1
+      POST: 1
+      EXEC: 1
+      DELETE: 1
+      VERSION: 1
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    networks: [engine_net]
+
   server:
     image: teamclaw/server:${TEAMCLAW_VERSION:-latest}
     build:
@@ -46,9 +67,10 @@ services:
     environment:
       TEAMCLAW_CONFIG: /etc/teamclaw/teamclaw.toml
       TEAMCLAW_DATABASE__URL: postgres://postgres:${POSTGRES_PASSWORD:?set in .env}@postgres:5432/teamclaw
+      DOCKER_HOST: tcp://socket-proxy:2375
     volumes:
       - ./teamclaw.toml:/etc/teamclaw/teamclaw.toml:ro
-    networks: [edge, core]
+    networks: [edge, core, engine_net]
     ports:
       - "8080:8080"
     depends_on: