Repository navigation
E2e isolation: sessions run against a hash-verified plugin snapshot - #7
Merged
Merged
Conversation
Sessions never see the real repo: run.sh snapshots the plugin payload once per suite (rsync minus .git/.venv/caches), every claude invocation gets the snapshot as --plugin-dir, and fanout children inherit it via CLAUDITY_E2E_PLUGIN_DIR. At exit the owning process recomputes the snapshot's sha256 manifest and FAILS the run if any session mutated the plugin (drifted paths printed, snapshot kept for inspection). __pycache__ is outside the integrity contract — the very first verified run caught the vendored scripts compiling .pyc into the snapshot, which doubles as proof the MCP server runs from the snapshot, not the repo. The old detection-only posture upgrades to prevention + proof: the repo git-status check remains as defense in depth, now delta-based so developer WIP doesn't false-positive. Mid-run edits to plugin content no longer invalidate in-flight sessions (harness scripts still run live from the repo — noted in CLAUDE.md/TESTING.md). Verified: 8 token-free mechanics tests (tests/test_e2e_isolation.py: payload presence, junk exclusion, edit/add/delete tamper detection, fanout adoption), free no-match runs through the sequential and stress paths, and paid 10-record (MCP from snapshot) + 02-routing (skill injection from snapshot) passes with zero leftovers.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #3.
What
E2e sessions are now physically isolated from the plugin repo, with an empirical post-run guarantee:
run.shsnapshots the plugin payload once per suite run (rsyncof the working tree minus.git/.venv/caches) and everyclaudeinvocation gets the snapshot as--plugin-dir— sessions never receive the real repo path. Fanout children (parallel/stress modes) inherit the parent's snapshot viaCLAUDITY_E2E_PLUGIN_DIR.__pycache__sits outside the integrity contract (interpreter byproduct: the vendored scripts compile.pycinto the snapshot at runtime).git statuscheck stays as defense in depth — now delta-based against suite-start state, so developer work-in-progress no longer false-positives; any delta would indicate a path leak.Consequences documented in TESTING.md/CLAUDE.md: editing plugin content during a background run is now safe (sessions hold the frozen snapshot); editing the harness scripts themselves mid-run still races.
Verification
tests/test_e2e_isolation.py): runtime payload present, junk excluded, edit/add/delete tamper detection with drifted-path reporting, fanout snapshot adoption. Tier 1 total: 254.10-record(MCP server runs from the snapshot — proven incidentally by the.pycfiles the server compiled into the snapshot on the first verified run) and02-routing(skill injection from the snapshot), both PASS with zero/tmpleftovers..pyccompilation) before the exclusion existed — the detection mechanism has a live catch on record.🤖 Generated with Claude Code