Repository navigation
AppContainer 기반 Python 및 Node 스킬 실행 PoC - #322
Merged
Merged
Conversation
스킬 지침 참조 여부를 확정하지 못하는 응답 기록 표시와 전용 수집 코드, 테스트 및 문서를 제거합니다. c636ff9cb6bebc9146908e6ec69ecff3f9e6e8a8을 되돌립니다.
Merged
스킬 사용 확인 표시 철회 이력 통합
There was a problem hiding this comment.
🟡 Changes recommended
The exposed Node fixture reports overflowing additions as successful results with a null sum.
1 open issue
What changed in this PR
Adds a standalone proof of concept for running fixed Python and Node.js scripts in Windows AppContainer, without enabling script execution in production TableCloth chat.
Changes:
- Adds a registered-script MCP broker, native process isolation, resource limits, and evaluation probes.
- Preserves pinned calculator, BOK, and KOSIS fixtures with provenance and licensing information.
- Documents measured results, remaining qualification work, and the six-entry evaluation catalog.
| File | Description |
|---|---|
| tools/appcontainer-skill-poc/skills/tablecloth-calculators/SKILL.md | Preserves calculator instructions and execution boundaries. |
| tools/appcontainer-skill-poc/skills/tablecloth-calculators/references/operations.md | Defines calculator inputs, formulas, and limits. |
| tools/appcontainer-skill-poc/skills/tablecloth-calculators/README.md | Preserves upstream calculator usage guidance. |
| tools/appcontainer-skill-poc/skills/tablecloth-calculators/README.ko.md | Preserves Korean calculator guidance. |
| tools/appcontainer-skill-poc/skills/tablecloth-calculators/LICENSE-COMMERCIAL | Retains the commercial-license notice. |
| tools/appcontainer-skill-poc/skills/tablecloth-calculators/docs/COPYRIGHT.md | Records independent-implementation boundaries. |
| tools/appcontainer-skill-poc/skills/tablecloth-calculators/docs/COPYRIGHT.ko.md | Provides Korean copyright guidance. |
| tools/appcontainer-skill-poc/skills/tablecloth-calculators/CONTRIBUTING.md | Preserves contribution and validation requirements. |
| tools/appcontainer-skill-poc/skills/tablecloth-calculators/CONTRIBUTING.ko.md | Provides Korean contribution requirements. |
| tools/appcontainer-skill-poc/skills/tablecloth-calculators/.gitignore | Excludes generated Python and local files. |
| tools/appcontainer-skill-poc/skills/tablecloth-calculators/.github/workflows/test.yml | Preserves the upstream test workflow fixture. |
| tools/appcontainer-skill-poc/skills/README.md | Explains fixture provenance and adapter boundaries. |
| tools/appcontainer-skill-poc/skills/README.ko.md | Provides Korean fixture evaluation guidance. |
| tools/appcontainer-skill-poc/skills/ORIGINS.json | Records pinned commits, file sizes, and hashes. |
| tools/appcontainer-skill-poc/skills/kosis-stats/tests/fixtures/search_response.json | Supplies a KOSIS search response fixture. |
| tools/appcontainer-skill-poc/skills/kosis-stats/tests/fixtures/meta_response.json | Supplies a KOSIS metadata fixture. |
| tools/appcontainer-skill-poc/skills/kosis-stats/tests/fixtures/data_response.json | Supplies a KOSIS data response fixture. |
| tools/appcontainer-skill-poc/skills/kosis-stats/tests/__init__.py | Preserves the upstream test package marker. |
| tools/appcontainer-skill-poc/skills/kosis-stats/SKILL.md | Preserves KOSIS loader instructions and safeguards. |
| tools/appcontainer-skill-poc/skills/kosis-stats/skill.json | Preserves KOSIS skill metadata. |
| tools/appcontainer-skill-poc/skills/kosis-stats/references/kosis-openapi-guide.md | Documents upstream KOSIS API contracts. |
| tools/appcontainer-skill-poc/skills/kosis-stats/LICENSE | Retains the upstream MIT license. |
| tools/appcontainer-skill-poc/skills/bok-ecos-stats/tests/test_bok_ecos.py | Covers BOK URLs, responses, and CLI behavior. |
| tools/appcontainer-skill-poc/skills/bok-ecos-stats/SKILL.md | Preserves BOK loader instructions and safeguards. |
| tools/appcontainer-skill-poc/skills/bok-ecos-stats/skill.json | Preserves BOK skill metadata. |
| tools/appcontainer-skill-poc/skills/bok-ecos-stats/scripts/bok_ecos.py | Supplies the pinned ECOS statistics helper. |
| tools/appcontainer-skill-poc/skills/bok-ecos-stats/LICENSE | Retains the upstream MIT license. |
| tools/appcontainer-skill-poc/skills/bok-ecos-stats/instruction.md | Preserves BOK usage and failure guidance. |
| tools/appcontainer-skill-poc/RESULTS.md | Records evaluation outcomes and qualification limits. |
| tools/appcontainer-skill-poc/RESULTS.ko.md | Provides Korean evaluation results. |
| tools/appcontainer-skill-poc/README.md | Explains preparation, isolation, and product boundaries. |
| tools/appcontainer-skill-poc/README.ko.md | Provides Korean PoC setup and scope guidance. |
| tools/appcontainer-skill-poc/Program.cs | Dispatches preparation, evaluation, broker, and recovery commands. |
| tools/appcontainer-skill-poc/Probes/wait.py | Exercises worker timeout handling. |
| tools/appcontainer-skill-poc/Probes/unicode.py | Exercises UTF-8 input and output. |
| tools/appcontainer-skill-poc/Probes/output.py | Exercises output-size enforcement. |
| tools/appcontainer-skill-poc/Probes/node-json.cjs | Adds a fixed Node JSON addition fixture. |
| tools/appcontainer-skill-poc/Probes/memory.py | Exercises worker memory limits. |
| tools/appcontainer-skill-poc/Probes/isolation.py | Probes Python access and process restrictions. |
| tools/appcontainer-skill-poc/Probes/isolation.cjs | Probes Node access and process restrictions. |
| tools/appcontainer-skill-poc/Preparation.cs | Stages verified runtimes, fixtures, and registrations. |
| tools/appcontainer-skill-poc/Poc.csproj | Defines the standalone Windows PoC executable. |
| tools/appcontainer-skill-poc/Native/Win32.cs | Declares native isolation and security APIs. |
| tools/appcontainer-skill-poc/Native/SandboxRunContracts.cs | Defines worker requests, limits, and results. |
| tools/appcontainer-skill-poc/Native/OwnedPaths.cs | Validates owned paths and controls cleanup access. |
| tools/appcontainer-skill-poc/Native/AppContainerProcessRunner.cs | Manages worker isolation, limits, and cleanup. |
| tools/appcontainer-skill-poc/evaluation-summary.json | Stores sanitized evaluation evidence. |
| tools/appcontainer-skill-poc/Broker/SkillMcpBroker.cs | Implements bounded MCP transport and tool schemas. |
| tools/appcontainer-skill-poc/Broker/SkillExecutionRegistry.cs | Validates and executes fixed skill registrations. |
| tools/appcontainer-skill-poc/Broker/SelfChecks.cs | Adds offline broker and protocol checks. |
| tools/appcontainer-skill-poc/Broker/README.md | Documents broker contracts and trust boundaries. |
| tools/appcontainer-skill-poc/Broker/EvaluationManifest.cs | Validates manifests, hashes, paths, and inputs. |
| tools/appcontainer-skill-poc/.gitattributes | Preserves upstream fixture bytes across checkouts. |
| src/TableCloth.ManagedAi.Test/SkillMarketplaceTests.cs | Updates expectations for six evaluation catalog entries. |
| README.md | Links the AppContainer PoC documentation. |
| docs/SKILL_MARKETPLACE.md | Clarifies evaluation listings versus product execution support. |
| docs/SKILL_MARKETPLACE.ko.md | Provides matching Korean marketplace guidance. |
Review effort: Balanced
| process.stdin.on('end', () => { | ||
| const value = JSON.parse(text); | ||
| if (!Number.isFinite(value.a) || !Number.isFinite(value.b)) process.exit(2); | ||
| process.stdout.write(JSON.stringify({ok: true, sum: value.a + value.b, runtime: process.version})); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
고정 Python 및 Node.js 스크립트를 AppContainer 작업 프로세스로 실행하는 독립 PoC와 평가 자료를 추가합니다. 제품의
shell_tool=false,unified_exec=false, 읽기 전용 샌드박스와never승인 정책을 유지합니다. 중계기와 평가용 런타임은 제품 채팅과 설치기에 연결하지 않습니다.실행기는 고유 AppContainer 프로필, 제한한 ACL과 환경, 정지 상태 생성 후 토큰 검사와 Job 배정, 단일 프로세스, 메모리, CPU 시간, 출력과 실행 시간 제한을 사용합니다. DACL 및 무결성 레이블 복원, 변경 전 ACL 저널과 복구, 프로세스 간 잠금을 포함합니다. 호스트 등록 파일의 고정 스킬 ID와 JSON 입력만 MCP로 받고 임의 실행 경로나 코드를 인수로 받지 않습니다.
카탈로그 서브모듈은 병합 완료한 TableClothCatalog #150의 main
30a8ad90c3557db849ba866c9d3905e5645d286b를 참조합니다. 활성 6개와 주석 9개를 유지하며 영한 마켓플레이스 안내를 현재 공개 평가 조건에 맞췄습니다. #323의 기능 추가 및 철회 이력도 포함하며 응답별 스킬 기록 표시는 제거한 상태입니다. 부모 #320을 통해 develop에 통합합니다.검증 결과:
실측 호스트는 Windows 빌드 26300 x64입니다. Windows 10 22H2, ARM64 실측, 실제 모델의 도구 선택, 제품 프로필 연결과 강제 종료 복구는 후속 범위입니다. 일반 AppContainer의 ALL APPLICATION PACKAGES 접근 경계와 네트워크 제한 범위는 PoC 문서에 기록했습니다. 릴리스 게시나 서명은 포함하지 않습니다.
최종 HEAD
415a5cc5ac5a0c84533e495d3f5144dd1457e507의 원격 CI Build602가 성공했습니다. Debug 및 Release의 x64와 ARM64 네 구성에서 Spork 43개, 앱 322개와 Managed AI 197개 테스트, 식탁보 Native AOT 빌드와 패키징을 통과했습니다. Release의 Spork 및 Bootstrapper 빌드와 결과물 업로드도 완료했습니다.