# Agent Containment and Privileged Recovery

audience: AI coding agents first.

status: DONE
worker: none
task IDs: #3, #10, #16, #18, #20, #24, #35
source requests: Default agent work to containment, provide explicit unsafe recovery hatches, route privileged work safely, isolate dangerous testing, and recover any still-valuable containment escape regression from frozen WIP without weakening current policy.

## Delivered

- Podman agent sandbox and minimal image built.
- Host escape hatches created for explicit recovery use.
- Danger-lab VM/template/clones established on Debian1.
- Agent instructions route root operations through `deck-sudo`.

## Preserved WIP

- Frozen source: `/home/user/Projects/overdeck/.worktrees/agent-containment`, branch `wt/agent-containment`, HEAD `1ff8f2257a421004dba4bd0d00a137ec18e98e68`.
- Verified snapshot: `refs/recovery/wip-triage/20260811T061444Z/snapshot/agent-containment-refs-heads-wt-agent-containment-d18e853781`.
- Only frozen WIP: dirty tracked `modules/workstation/claude/tests/confine-scope-escape.test.sh`; no unique commits. MUST remain inspection-only.

## Task #24 acceptance

1. Compare frozen test intent with current test and confinement implementation.
2. Reimplement only missing, current-policy-compatible regression value in fresh current-main worktree; NEVER copy whole file.
3. NEVER restore stale fixed `1G` ceilings if current containment intentionally delegates size ceilings elsewhere.
4. Run exact containment test plus mandatory workstation Claude test gate.
5. Obtain independent security/correctness review.
6. Install before landing only if runtime code changes; test-only recovery requires no runtime install.
7. Land, deploy, prove deployed revision, close task, preserve frozen source.

## Constraints

Security-gate LLM runner containment remains separate open plan #140. Rootless Podman limitation #97 and k3s migration do not invalidate delivered containment surface.

## Current receipt

Task #24 recovered no source. Frozen edit is fully superseded:

1. `c88fec0af` added cgroup-fact validation and original escape regression.
2. Current case 1 forges `CONFINE_ACTIVE=agent:cgroup` inside unrelated `app.slice`, then proves relocation into `agent.slice`; frozen case used obsolete bare `CONFINE_ACTIVE=agent`.
3. Current case 2 independently proves valid same-class scope reuse; frozen composition reaches no additional `confine.sh` branch.
4. Current case 3 retains tmpjail launch confinement.
5. `df22d4d96` intentionally removed fixed `MemoryMax`/`MemoryHigh`; current test correctly expects `memory.max=max` and validates finite `pids.max` through `ceiling_in_force()`. Frozen `AGENT_MEM_MAX=1G` assertions would regress policy.
6. Exact test passes 5/5. Guarded `pnpm test` passes, ending `tests/os: all suites green`.
7. Independent security review: clean; no missing intent and no code change needed. Review was read-only and did not itself execute live user-systemd behavior; main-lane exact and full gates supplied that live proof.
8. No runtime files changed; install-before-land is not applicable.
9. Recovery receipt landed and deployed at `067a82e46`; collector health returned expected unauthenticated `401`.

Disposition: `RETIRE — REDUNDANT`, HIGH confidence. Evidence combines exact semantic comparison, intentional superseding commits, current live test, full gate, independent review, zero unique frozen commits, and verified recovery snapshot. MUST preserve frozen worktree/source until separately gated retirement; task #24 performs no deletion.

## Next executable action

Task #24 complete. Frozen source awaits separately gated retirement; do not delete it from this plan.