Add vendor-only egress and phase policy (D3)

[mchwang]

Problem and resulting behavior

D2 isolates agents in pinned containers, but those containers still need a narrowly controlled path to the selected model vendor and a phase-specific tool policy. This change adds D3 / T2: each agent runs on an internal Docker network whose CONNECT-only proxy permits only the pinned vendor hosts, while Claude/Codex web and MCP access are disabled and phase policies deny writes and command dispatch where the plan requires.

This PR is stacked on #40 (codex/agent-isolation-d2) and should be reviewed as the D3 increment only.

Scope

• Add ownership-bound internal vendor networks and a locked-down proxy container.
• Pin Claude to api.anthropic.com; pin Codex to api.openai.com and chatgpt.com.
• Attach agent containers only to the internal network and validate the daemon-resolved attachment and proxy environment before start.
• Add trusted phase policies:
  • planning/questions: read, list, and search only; read-only worktree; no runner command
  • review: read-only worktree; exact approved runner argv only
  • execute/fix: writable worktree plus exact approved runner argv
• Disable Claude Bash/WebFetch/WebSearch/NotebookEdit and all MCP servers; disable Codex web search and MCP servers.
• Add real-Docker allow/deny coverage, all-phase worktree checks, and authenticated Codex/Claude probes through the restricted network.

Owned files:

• .github/workflows/agent-isolation.yml
• agents/container/Dockerfile
• agents/container/image.ts
• agents/container/profile.ts
• agents/container/run.ts
• agents/network/network.ts
• agents/network/proxy.mjs
• agents/policy.ts
• test/agent-container.test.ts
• test/agent-network.test.ts
• test/agent-policy.test.ts
• test/questions.test.ts

Validation

Validated head: 981e831637c1d19c3b4c759e18cc5ec06e8a5f33

• npm run typecheck
• npx vitest run --no-file-parallelism — 16 files, 255 tests passed (serialized locally to avoid Docker resource contention; CI runs the default command)
• CLAUDE_CODE_OAUTH_TOKEN=... CODEBOOST_RUN_AUTH_PROBES=1 CODEBOOST_CODEX_AUTH_FILE=... npx vitest run test/agent-container.test.ts — 23 tests passed, including live Codex and Claude startup through vendor-only egress
• Real-Docker network test proves the vendor host is reachable, an unrelated proxy target returns 403, and direct egress fails.

Dependencies and deferrals

• Depends on D2 / D2: Add pinned restricted agent containers #40 and remains intentionally stacked until that prerequisite lands.
• D4 owns the production Claude/Codex adapters, cancellation settlement, and bounded output.
• D5 owns the combined real-Docker and hostile-input boundary gate.
• No merge authorization has been given.

Review record

• Pre-review and round-1 self-review: full D3 diff inspected; no remaining local findings.
• Round 1: accepted all six findings. Container commands are now policy-generated opaque capabilities; every invocation owns a separate validated network; launch revalidates the proxy, network, subnet, and endpoint set; Claude receives an exact tool set; Codex shell is disabled. Added copied-command, cross-invocation, concurrent-network, and endpoint-mutation regressions. Nothing declined.
• Round 2: accepted all five findings. Command capabilities now include exact vendor identity; both CLI builders reject the wrong vendor; proxy validation covers namespace/device state; network validation consumes the caller deadline. Added vendor-mismatch, proxy-replacement, and timeout regressions. Nothing declined.
• Round 3: accepted all three findings. Proxy validation now requires the exact entrypoint and environment, binds the stored proxy address, and agent containers disable normal DNS while using that validated address. Added proxy-environment, DNS-mutation, and direct embedded-resolver regressions. Nothing declined.
• Round 4: accepted all four findings. Container profiles now exclusively own and dispose their vendor network; the full agent container is revalidated immediately before start; proxy and agent validation reject daemon DNS, host and published-port overrides. Added cleanup, final-attachment and daemon-mutation regressions. Nothing declined.
• Round 5: no new findings. Copilot confirmed all four round-4 findings resolved on 981e831.
• Review lesson audit: command-policy binding is covered by the existing phase-enforcement and exact-argv rules; launch-time network revalidation and per-invocation network ownership are concrete applications of the existing external-state and isolation rules. No new broadly reusable rule is needed before merge.

Closes the D3 increment tracked in #28; it does not close the full lane.

[Copilot]

Copilot review overview

🟡 Changes recommended

Critical policy enforcement, network validation, and isolation issues remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 6

Open (6)

• Enforce approved command policy before container execution · New
• Revalidate network ownership and isolation before container start · New
• Revalidate network and proxy state at launch · New
• Prevent cross-agent traffic on shared vendor networks · New
• Restrict Claude tools to the phase-approved tool set · New
• Disable Codex shell tool for agent invocations · New

What changed in this PR

Adds D3 vendor-only Docker egress and phase-specific agent policies, with expanded integration and policy tests.

Changes:

• Adds restricted vendor proxy networks.
• Enforces phase-specific tool and worktree controls.
• Expands Docker, network, policy, and CI validation.
• Critical review findings remain unresolved.

File	Description
test/​agent-policy.test.ts	Tests phase policy enforcement
test/​agent-network.test.ts	Tests vendor-only egress
test/​agent-container.test.ts	Tests container isolation
agents/​policy.ts	Defines phase and vendor controls
agents/​network/​proxy.mjs	Implements CONNECT filtering
agents/​network/​network.ts	Creates and manages vendor networks
agents/​container/​run.ts	Validates network and proxy settings
agents/​container/​profile.ts	Attaches networks and policies
agents/​container/​image.ts	Updates Docker build context
agents/​container/​Dockerfile	Includes the egress proxy
.github/​workflows/​agent-isolation.yml	Runs expanded isolation tests

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Unresolved critical vendor-binding and proxy/network validation issues remain.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 4 · 1

Open (5)

• Bind command capabilities to the invocation vendor · New
• Validate proxy devices and namespace settings · New
• Validate policy vendor before building commands · New
• Reject non-Codex policies in Codex commands · New
• Use the shared timeout for network validation · New

Resolved since last review (6)

• Disable Codex shell tool for agent invocations
• Restrict Claude tools to the phase-approved tool set
• Prevent cross-agent traffic on shared vendor networks
• Revalidate network and proxy state at launch
• Revalidate network ownership and isolation before container start
• Enforce approved command policy before container execution

[Copilot]

Copilot review overview

🟡 Changes recommended

Unresolved critical network-hardening findings and deadline-handling issues block approval.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 3

Open (3)

• Require an exact proxy entrypoint array · New
• Reject unexpected proxy environment variables · New
• Block Docker DNS exfiltration from internal networks · New

Resolved since last review (5)

• Reject non-Codex policies in Codex commands
• Validate policy vendor before building commands
• Validate proxy devices and namespace settings
• Bind command capabilities to the invocation vendor
• Use the shared timeout for network validation

[Copilot]

Copilot review overview

🟡 Changes recommended

Six unresolved findings, including four critical issues, block approval.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 4

Open (4)

• Container profile disposal leaks proxy networks and containers · New
• Final start check misses agent container network attachment · New
• Proxy validation omits daemon-resolved DNS and host overrides · New
• Proxy validation allows externally published ports · New

Resolved since last review (3)

• Block Docker DNS exfiltration from internal networks
• Reject unexpected proxy environment variables
• Require an exact proxy entrypoint array

[Copilot]

Copilot review overview

🔵 Needs a closer look

Unresolved moderate findings cover network cleanup behavior and weakened authenticated probe assertions.

Review effort: Lite
Findings: None

Resolved since last review (4)

• Proxy validation allows externally published ports
• Proxy validation omits daemon-resolved DNS and host overrides
• Final start check misses agent container network attachment
• Container profile disposal leaks proxy networks and containers