Repository navigation
chore(pr-pipeline): decide in the lanes audit whether lane run jobs keep sudo and docker #7791
Description
Lane run jobs keep sudo and docker access since #7786. Owner decision (2026-10-17): "lanes keep Docker and sudo for now - we can come back and evaluate/update later (no friction right now)".
The residual risk is recorded in docs/conventions/pr-pipeline/pr-run-activity.md ("Runner memory, with root") and ADR 0055 item 6. With root, a skill turn or head code run in the skill's Bash can read runner memory (sudo cat /proc/<Runner.Worker pid>/mem, docker run -v /:/host --privileged), including CLAUDE_CODE_OAUTH_TOKEN, which the subprocess env scrub otherwise keeps out of Bash. Review thread on #7786: #7786 (comment)
Done when
- The lanes audit decides, per lane, whether the run job keeps sudo and docker.
- Options to weigh (from the review): drop root before the head checkout and the activity again, keeping it only for the steps that need it (bwrap/socat install, setup-env.sh, Playwright system libraries); or keep it only for lanes whose trigger gate admits trusted actors, with a check that fails a run that reads untrusted text while root is available.
- The convention and ADR 0055 state the outcome.
🤖 Generated with Claude Code
Activity
github-actions commentedon Oct 17, 2026
Proposed work class: work-class: scoped
Basis: automated intake triage; the lanes App applied this class.
Size: Medium
Complexity: Medium
Uncertainty: Knowable
Flags: none
Blocked by: #7531
#7791 (comment)
This decision settles the open questions: lanes keep sudo and docker until the lanes audit in #7531 decides per lane. This issue is therefore sequenced after that audit.
Automated triage, applied by the lanes App.
kyle-sexton commentedon Oct 18, 2026
Decision recorded.
Question: Lane run jobs keep root since #7786. With root, a skill turn or head code that reads untrusted text could reach runner memory. Options: (a) keep parked until the lanes audit; (b) drop root before head checkout; (c) keep root only for lanes whose trigger admits trusted actors only.
Owner's answer: (a) Your own words on 2026-10-17: "lanes keep Docker and sudo for now - we can come back and evaluate/update later (no friction right now)". The residual risk is recorded in docs/conventions/pr-pipeline/pr-run-activity.md and ADR 0055 item 6. The lanes audit is #7531 ("post-V1 audit and retro of the unattended merge flow", open). Basis: #7791 body quote.
The owner accepted this recommendation as item D4 of a 21-decision batch in an attended backlog-shaping session on 2026-10-18. The batch question: "Accept all 21 batch 7 decisions, with my change to D13 (#6008 goes to the lane, but you merge its PR because it edits AGENTS.md)? I post a 'Decision recorded.' comment on each issue." The owner answered: "Accept, with my D13 change (Recommended)".
Posted by AI from the owner's answer in that session.
kyle-sexton commentedon Oct 25, 2026
Released for re-triage under the owner's 2026-10-24 rule: an issue stops for a person only for an intent or vision question, a security call, a host or attended run, or spend outside prepaid credit. The hold label came off and intake triage runs again now; it re-applies a hold, with a numbered question, when one of those applies.
To hold this issue again, add
needs-human(orstatus: needs-decision) and say why in a comment.melodic-automation-lanes commentedon Oct 25, 2026
Not admitted to the issue lane: no trusted-human acceptance criteria: a listed human must put the confirmed
- [ ]criteria in the body or post them as their own comment, or, on an issue a listed human filed, intake's newest refinement comment must hold them unedited. Admission takes the issue once each of those is met, when intake triages it again (.github/actions/resolve-config/admission-rules.json).melodic-automation-lanes commentedon Oct 25, 2026
The latest triage verdict holds nothing: admission moved the issue to
status: needs-decision; its comment says why.melodic-automation-lanes commentedon Oct 25, 2026
Refinement. A read-only run explored this repository, searched its issues and pull requests, and read the allowed docs to draft what follows. On an issue a listed human filed, it counts as the issue's spec once posted, while unedited; it is still model text, so check it.
Intended outcome: The lanes audit (#7531) decides per lane whether run jobs keep sudo and docker, and pr-run-activity.md and ADR 0055 item 6 are updated to state that outcome.
Dependencies
Related work
Open questions
RECOMMENDED: Check whether #7786's intent was reverted or only partly applied. Then rewrite the issue against the current state, or close it if root is already dropped everywhere. Basis: .github/actions/setup-runner-isolation/action.yml:43-51; docs/adr/0055-load-nothing-head-controlled-into-a-pipeline-skill-activity.md:70-72
RECOMMENDED: Keep it parked until #7531 reports, as the recorded decision says; an unattended run must not choose it. Basis: Decision recorded comment 2026-10-18 and the 2026-10-24 rule that security calls stop for a person
RECOMMENDED: List each lane workflow that uses setup-runner-isolation and give each a keep or drop verdict in a table in the convention. Basis: judgment
Sources read
Automated refinement by the lanes App. Answer with a comment whose first line is
**Decision recorded.**.kyle-sexton commentedon Oct 25, 2026
Decision recorded. The owner answered in the Issue Triage session (2026-10-25), accepting the recommended answers below:
Question asked: Close #7791 as done, since lane run jobs already drop sudo and docker before the head checkout? (Security.)
Already decided: #7791 (comment) (2026-10-18: (a) keep parked until the lanes audit in #7531)
Accepted: Close it as done. Main already does the body's first option (drop root before the head checkout, keeping it only for the steps that need it), and ADR 0055 item 6 and pr-run-activity.md already state it. Seven workflows call the action: eval-browser-dispatch, intake-triage, maintenance-audit-lane-runs, pr-run-activity-read, pr-run-activity-write, pr-unblock, pr-verify. Not checked: whether any other lane job runs head code without the action. Basis:
.github/actions/setup-runner-isolation/action.yml:40-60,docs/adr/0055-load-nothing-head-controlled-into-a-pipeline-skill-activity.md:70-72,docs/conventions/pr-pipeline/pr-run-activity.md:280-282and:1649-1650on origin/main 4ab8989 (corrected: the refinement said rewrite or close; this says close).Closed as done. Main already meets both lines of the body's "Done when". Evidence on origin/main 4ab8989:
.github/actions/setup-runner-isolation/action.yml:40-60: installs bubblewrap and socat with sudo, makes the docker socket root-only, deletes the runner's sudoers entry, and fails red if either still works.docs/adr/0055-load-nothing-head-controlled-into-a-pipeline-skill-activity.md:70-72anddocs/conventions/pr-pipeline/pr-run-activity.md:280-282,:1649-1650state the outcome.