
== build: start-ocx, receipts and ocx2 from /var/lib/ocx/agents/opus-ocx2/projects/ollama/b2de8b0c2c6700eb5c686b1747b5aaa1e2d2d01370ac55f2e5a151a67e03b48a/tree8

== served repository: demo.fossil, users, chat timeline
-rw-------    1 root     root        217088 Oct 29 15:41 /tmp/sA-3801733/fossil/demo.fossil

== receipt service, through the launcher's receipts policy
total 0
srw-------    1 root     root             0 Oct 29 15:41 receipts.sock

== Fossil server, its extroot's ocx2-cgi the launcher

== the daemon's node: nodes.json and credentials

== confined daemon, through the launcher's daemon policy
{"when":"2026-10-29T15:42:16Z","clone":"/tmp/sA-3801733/daemon/node/clones/demo.fossil","completion":1,"new":0,"handed":[],"settled":0}
{"when":"2026-10-29T15:42:19Z","clone":"/tmp/sA-3801733/daemon/node/clones/demo.fossil","completion":1,"new":0,"handed":[],"settled":0}
{"when":"2026-10-29T15:42:22Z","clone":"/tmp/sA-3801733/daemon/node/clones/demo.fossil","completion":1,"new":0,"handed":[],"settled":0}

== two runs, posted by boss (setup) through Fossil's form
sandboxed run bb1aa67f9e
unconfined run 03d7bbcbdf

== what the runs posted (started, kept logs, ended)
'bb1aa67f9e','boss','D 2026-10-29T15:42:24.372 H sandboxed\sprobe N text/x-markdown U boss W 1007 ```json {"ocx": 1, "kind": "run", "node": "demo-node", "objective": "Probe from an agent sandbox.", "workspace": [{"step": "directory", "at": "$$root$$/$$user$$/projects/$$project$$/$$run$$"}], "sandbox": {"uid": 1000, "gid": 1000, "capabilities": [], "network": false, "own_session": true, "ends_with_node": true, "read_only": ["/usr", "/bin", "/lib", "/lib64"], "read_write": ["$$workspace$$"], "homes": [], "files": [], "proc": "/proc", "dev": "/dev", "tmp": "/tmp"}, "limits": {"wall": "2m"}, "process": {"user": "build'
'03d7bbcbdf','boss','D 2026-10-29T15:42:24.479 H unconfined\sprobe N text/x-markdown U boss W 642 ```json {"ocx": 1, "kind": "run", "node": "demo-node", "objective": "Probe from the daemon itself, unconfined by any run sandbox.", "process": {"user": "builder", "command": ["/bin/sh", "-c", "echo uid=$(id -u); for p in /tmp/sA-3801733/fossil /tmp/sA-3801733/fossil/demo.fossil; do [ -e $p ] && echo VISIBLE $p || echo absent $p; done; head -c 16 /tmp/sA-3801733/fossil/demo.fossil >/dev/null 2>&1 && echo READ-OK || echo read-refused; n=0; for x in /proc/[0-9]*/root/tmp/sA-3801733/fossil/demo.fossil; do [ -r $x ] && n=$'
'e6ef616300','demo-node','D 2026-10-29T15:42:25.696 G bb1aa67f9ef05c1a3dfd8576a478076a1c2bae11643c16b7c43e8356b13d1acc I bb1aa67f9ef05c1a3dfd8576a478076a1c2bae11643c16b7c43e8356b13d1acc N text/x-markdown U demo-node W 687 ```json {  "ocx": 1,  "kind": "started",  "node": "demo-node",  "clone": "71846d03970f28b031950b8afa9b0dc215848ab8",  "run": "bb1aa67f9ef05c1a3dfd8576a478076a1c2bae11643c16b7c43e8356b13d1acc",  "values": {   "root": "/tmp/sA-3801733/daemon/agents",   "project": "demo",   "user": "builder",   "run": "bb1aa67f9ef05c1a3dfd8576a478076a1c2bae11643c16b7c43e8356b13d1acc",   "node": "demo-node",   "server": "'
'aa07e50828','demo-node','D 2026-10-29T15:42:25.891 G bb1aa67f9ef05c1a3dfd8576a478076a1c2bae11643c16b7c43e8356b13d1acc I bb1aa67f9ef05c1a3dfd8576a478076a1c2bae11643c16b7c43e8356b13d1acc N text/x-markdown U demo-node W 232 The process for the run bb1aa67f9ef05c1a3dfd8576a478076a1c2bae11643c16b7c43e8356b13d1acc exited 0. ~~~~ stdout uid=1000 absent /tmp/sA-3801733/fossil absent /tmp/sA-3801733/fossil/demo.fossil read-refused proc-paths-readable=0 ~~~~ Z 30c235dea44e51595eabd057de87be1d '
'9b7aeb5766','demo-node','D 2026-10-29T15:42:25.901 G bb1aa67f9ef05c1a3dfd8576a478076a1c2bae11643c16b7c43e8356b13d1acc I bb1aa67f9ef05c1a3dfd8576a478076a1c2bae11643c16b7c43e8356b13d1acc N text/x-markdown U demo-node W 236 ```json {  "ocx": 1,  "kind": "ended",  "node": "demo-node",  "clone": "71846d03970f28b031950b8afa9b0dc215848ab8",  "run": "bb1aa67f9ef05c1a3dfd8576a478076a1c2bae11643c16b7c43e8356b13d1acc",  "outcome": "exited",  "exit": 0 } ``` Z 3ab14b4e1edab96b6eb8d54728c602ed '
'20e2a37718','demo-node','D 2026-10-29T15:42:26.075 G 03d7bbcbdf82c1bffe179c13e0cab63c3616205915d4b5b6e5047f007fb33d4c I 03d7bbcbdf82c1bffe179c13e0cab63c3616205915d4b5b6e5047f007fb33d4c N text/x-markdown U demo-node W 277 ```json {  "ocx": 1,  "kind": "ended",  "node": "demo-node",  "clone": "71846d03970f28b031950b8afa9b0dc215848ab8",  "run": "03d7bbcbdf82c1bffe179c13e0cab63c3616205915d4b5b6e5047f007fb33d4c",  "outcome": "refused",  "note": "this node runs only sandboxed processes" } ``` Z 0d837d6cd017bb1a1801ddbcb82a3f85 '

== receipts through the launcher's CGI route, against Fossil's own record
boss {"artifacts": [{"artifact": "bb1aa67f9ef05c1a3dfd8576a478076a1c2bae11643c16b7c43e8356b13d1acc", "received": true, "sender": "boss", "capabilities": "bcdefghijklmnopqrstwz234567AD", "receipt": 2, "rid": 2}], "user": {"user": "demo-node", "capabilities": "ghjorwz4C", "wiki_moderated": false, "ticket_moderated": false}}
viewer {"artifacts": [{"artifact": "bb1aa67f9ef05c1a3dfd8576a478076a1c2bae11643c16b7c43e8356b13d1acc", "received": true, "sender": "boss", "capabilities": "bcdefghijklmnopqrstwz234567AD", "receipt": 2, "rid": 2}], "user": {"user": "demo-node", "capabilities": "ghjorwz4C", "wiki_moderated": false, "ticket_moderated": false}}
anon {"artifacts": [{"artifact": "bb1aa67f9ef05c1a3dfd8576a478076a1c2bae11643c16b7c43e8356b13d1acc", "received": true, "sender": "boss", "capabilities": "bcdefghijklmnopqrstwz234567AD", "receipt": 2, "rid": 2}], "user": {"user": "demo-node", "capabilities": "ghjorwz4C", "wiki_moderated": false, "ticket_moderated": false}}
Fossil's own record: 'boss','bcdefghijklmnopqrstwz234567AD',2,2
Fossil's fullcap(demo-node): 'ghjorwz4C'

== the console, as boss (the page's other paths still pass through: E6)
console ok: True | runs running: 0 | ended: 2

== writes from the receipt service's policy fail (a probe in place of receipts)
Fossil's port 57121 answers on the host: 200
GC Warning: Could not open /proc/stat
open the repository for writing: refused (File::Error: Error opening file with mode 'r+': '/repositories/demo.fossil': Read-only file system)
create a file beside it: refused (File::Error: Error opening file with mode 'w': '/repositories/x': Read-only file system)
read the repository: read ok (allowed: read-only)
reach Fossil's port: refused (Socket::ConnectError: Error connecting to '127.0.0.1:57121': Connection refused)
write in its socket directory: written (allowed: its one writable place)

== the daemon's own view: a probe in place of its program, started through the same daemon policy
daemon probe: uid=0 caps=CapEff: 000001ffffffffff
absent /tmp/sA-3801733/fossil
absent /tmp/sA-3801733/fossil/demo.fossil
proc-paths-readable=0 (other processes of the same account; the live daemon has an account of its own)
agent sandbox inside: started

== review test: the /receipt aliases reach the receipt service, never the passthrough
/receipt -> service boss
/receipt/ -> service boss
/receipt/x -> service boss

== review test: one repository held locked while another is asked, straight at the service's socket
demo (locked=True): 2.02 s  {"unavailable":"sqlite error 5: database is locked","retry_after":1}
demo2 (locked=False): 0.0 s  {"artifacts":[{"artifact":"bb1aa67f9ef05c1a3dfd8576a478076a1c2bae11643c16b7c43e8356b13d1ac

== review test: inside the CGI sandbox (a probe in place of the release's program)
args: --receipt-fd 3
CapEff: 0000000000000000
fd 0 -> /dev/null
fd 1 -> pipe:[987568194]
fd 10 -> /release/ocx2-cgi
fd 2 -> pipe:[987568194]
fd 3 -> socket:[987567434]
fd 4 -> pipe:[987564742]
cookie: absent nonce: absent repository: demo
absent /tmp/sA-3801733/fossil
absent /tmp/sA-3801733/fossil/demo.fossil
network: 000

== review test: a receipt service that listens but never accepts
status 503 after 0 s: {"unavailable":"receipt service not answering"}

== rollback point: the launcher's CGI link is one file; the previous page is the release's own ocx2
lrwxrwxrwx    1 root     root           142 Oct 29 15:41 /tmp/sA-3801733/ext/ocx2-cgi -> /var/lib/ocx/agents/opus-ocx2/projects/ollama/b2de8b0c2c6700eb5c686b1747b5aaa1e2d2d01370ac55f2e5a151a67e03b48a/work/stageA-run10/bin/start-ocx
done
