Omar SobhandClaude Opus 5
2d1f3954e8
Four measurements decide the shape, all taken today: 1. --allowedTools is not an enforcement boundary. ListAgents and ScheduleWakeup ran on microvm missions whose list is Read Edit Write Bash Agent. The flag governs prompting, not availability, so any task-permission layer must be enforced by our own gate. 2. The guest already has every tool's output on disk (the tap appends the whole payload, tool_response included), so taint is computable guest-locally with no network call and no added latency. 3. The taint store would already be protected — the hook-files rule refuses reads and writes to /root/toolhooks from both Bash and the write tools. 4. Provenance is a CONTAINER-tier control. A microVM reaches only the provider and the forge through a name-matched CONNECT allow-list; a container reaches any public host. Saying it matters equally on both would be padding. Task permission: a per-phase "agent_tools" key (NOT "tools", which security_scan already owns), defaulted from what phase kinds actually used, enforced by the gate. Provenance: taint hostnames out of fetched responses, deny an outbound call WITH A BODY whose target is one of them — the asymmetry being that reading a host a page mentioned is research and sending data to it is the attack. String taint is rejected outright as a false-positive generator, which is this module's cardinal sin. Both ship in shadow (gate.would_deny) first, because today's corpus is 171 tool calls and 15 curl invocations and cannot validate a rule. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
