[schlessera]

Refs #1665

Second layer of the #1665 stack. Parent: #2399 (feat/1665-durable-egress-records-r2). Child: #2645.

What changed

Git's SSH transport now works from an egress worker. The trusted worker bootstrap sets a first-party CONNECT helper (egress-connect.ts) as Git's ProxyCommand, unless the caller already chose GIT_SSH_COMMAND. The proxy sees only host, port and opaque bytes.

The new tests/egress-first-party-paths.test.ts is the gate's measurement. It runs Git over HTTPS and SSH, curl, the brain CLI's Gemini embedding provider and headless Chromium in real governed workers through the turn proxy. The fixture runs in its own network namespace with a fixture /etc/hosts and /run, so every upstream is a loopback fixture; a loopback sshd serves the SSH clone. The socket walk covers each mask root completely and the rest of the visible filesystem under a deadline. It fails if any socket outside the masks accepts a connection.

The measurement table is in docs/hosting/agent-workers.md, and the decision record notes the result.

Why this shape

#1665 makes the measurement the gate, and the decision record calls for a ProxyCommand CONNECT helper for SSH. A helper that dials the bind-mounted proxy socket directly needs no extra tool in the worker. The whole fixture runs in a private namespace, so the proxy's real DNS resolution can reach a named fixture host without touching a public name.

Proof

Head 547795928, parent 8406e0062 (#2399 refreshed onto origin/main 4ba50d824). Round 3 merged the refreshed parent in cleanly (4958d6aa3), reran the socket walk with #2657's all-/var mask (66e3072be), and merged the parent again after #2671 landed (547795928, clean).

Socket walk, round 3. With all of /var masked, the walk passes in both profiles. It covers the visible filesystem completely (complete: true) and finds no socket outside the masks (reachable: {}). The test now asserts EGRESS_SOCKET_WALK_NO_REACHABLE_HOST_SOCKET, and the measurement table and decision record say the walk passes.

• Mutation: HOST_MASKS reverted to the pre-fix(ui-sdk): mask all host /var in worker profiles #2657 /var/run + /var/lib. Both profiles fail EGRESS_SOCKET_WALK_NO_REACHABLE_HOST_SOCKET with /var/snap/cups/common/run/cups.sock reachable (5 pass / 2 fail). Restored byte-for-byte; 7/7 green.

bun run check:pr --base feat/1665-durable-egress-records-r2

Result on 547795928: passed (exit 0). Lint, metadata and the fast phase pass (770 tests), and import-graph feedback passes 7/7 (tests/egress-first-party-paths.test.ts).

The receipts below were taken on round 1's head 290f8fe3c. The later merges change none of the files they guard.

• All five paths pass, each with a completed opaque CONNECT recorded to the fixture origin. The socket walk passes in both profiles: no socket below a mask, and the fixture /run and home sockets are unreachable. Including the existing egress runtime, proxy, relay and citation suites, the focused set passes 73 tests.
• Mutations (restored, then re-run green 7/7):
  • Bootstrap GIT_SSH_COMMAND set to plain ssh: the git over SSH through the CONNECT helper row fails with ssh: connect to host ithaca.odysseus.test port …: Connection refused (exit 128 ≠ 0).
  • /home removed from HOST_MASKS: EGRESS_HOST_HOME_SOCKET_UNREACHABLE fails in both profiles.
  • Removing /run breaks the egress bind at launch setup, so it is not used as a receipt.

Checklist

• Focused local preflight/behavioral receipts and complete selected hosted proof passed; actual head/base/job checkout evidence is in Proof. (Local preflight above; hosted proof is the coordinator's.)
• Acceptance criteria from the issue are all met, or the gap is named below.
• The PR and completed/advanced issues have verified release milestones under docs/process/github.md.
• A changeset is included, or this changes nothing a consumer can see.
• No personal data anywhere in the diff — the leakage gate covers the whole tree.
• The integration contract index or relevant component is updated in this same commit, or nothing in the machine surface moved.
• Docs under docs/ reflect the change, or nothing documented moved.
• Provider history stays append-only (docs/decisions/provider-history.md): the provider-history guard passes, or nothing on a turn's path changed.

Anything left open

• The socket-walk gap is closed: ui-sdk: governed and strict workers can still reach host sockets under /var outside today's masks #2633 was decided and shipped as fix(ui-sdk): mask all host /var in worker profiles #2657 (mask all of /var), and the walk now passes on the measured host.
• Pi inference through the relay is not measured; Pi has no ordinary relay consumer yet.
• The measured tuple is a WSL2 host, so this is a path measurement, not a qualified host row.

🤖 Generated with Claude Code