Stability checkpoint v0.8.2 — Item #2 closed: claude -p works end-to-end inside agent container - fix(agent): tmpfs /home/agent so claude can write .claude.json (d0fbb4a) - docs(tasks): record v0.8.1 / CI broker port conflict (0b797b0) CI : - ✅ MR !51 pipeline green (lint + test + security + build all stages) - ✅ Post-MR-!51 main pipeline #2493446131 (smoke:full-stack passing — port 8765 free, no v0.8.1 conflict because local broker downed) - ✅ Earlier tag pipeline #2493419541 (v0.8.1) still green retroactively End-to-end smoke (the FIRST true E2E since redaction shipped) : - ✅ `secured-claude up` brings up cerbos + dns + egress + agent + auto-starts host-side broker (v0.8.1) + agent gets writable HOME tmpfs (v0.8.2) - ✅ `docker exec secured-claude-agent claude -p "say hello in 3 words"` returns "Hello there, friend!" in ~5 s — was : 30 s silent hang in v0.8.1 - ✅ `docker exec secured-claude-agent claude -p "read /workspace/test-read.txt..."` triggers PreToolUse hook → broker `POST /check HTTP 200 OK` → Cerbos ALLOW → audit row in SQLite - ✅ Trace: `2026-05-01T10:44:08.603+00:00 ALLOW file /workspace/test-read.txt` Local test pass : - ✅ uv run pytest — 303 tests pass (one transient state-pollution failure when local broker was up ; passed clean once downed) - ✅ uv run ruff check src/ tests/ — All checks passed - ✅ uv run ruff format --check — 38 files already formatted - ✅ uv run mypy src/secured_claude/ — Success: no issues found in 17 source files - ✅ uv run bandit -r src/secured_claude/ — Medium: 0, High: 0 Regression check vs v0.8.1 : - ✅ Broker auto-start (v0.8.1 feature) still works — `secured-claude up` brings up broker on PID, status table shows it - ✅ Redaction (v0.8.0 feature, ADR-0046) still functional — gateway tests all green - 🆕 The agent container is finally USABLE for what it was designed for : `claude -p` inside a confined sandbox, with every tool call gated by Cerbos. - ⏭ N/A — secured-claude is a security wrapper around Claude Code, not an LLM-using app. - 4-layer defense-in-depth (ADR-0012) intact AND now PROVEN end-to-end - L1 PreToolUse hook → Cerbos PDP : verified live (claude → hook → broker → cerbos → audit) - L2 tinyproxy CONNECT allowlist + L3 dnsmasq DNS allowlist : verified `*.anthropic.com` reachable, blocking everything else by default - L4 hardening (read_only:true, cap_drop ALL, no-new-privileges, nosuid/nodev tmpfs) preserved ; new HOME tmpfs is unprivileged-user-owned and only 8 MB — minimal new attack surface - On-the-fly secret redaction (v0.8.0, ADR-0046) still in force - 🆕 The whole point of the project is now demonstrably working : an LLM agent runs inside a Cerbos-gated sandbox + every tool call leaves an audit row + denied tools provide reason to the model so it can reformulate - 25 orchestrator tests + 33 redaction tests + the full broker/cerbos/store stack at 91.27 % coverage - Docker compose orchestration cleaned up : agent container hardening preserved while making `claude -p` actually work - Host-side broker auto-managed by `secured-claude up`/`down` (v0.8.1) - Audit log SQLite hash-chain integrity intact - Broker /metrics endpoint exports Prometheus counters (REDACTION_MATCHES_TOTAL, hook latency, decisions) - pytest 303/303 pass, 91.27 % coverage (gate 90 %) - mypy strict clean, ruff clean, bandit Medium: 0 - 🆕 Full end-to-end smoke now reproducible - 7-stage GitLab pipeline still green (lint → test → security → build → smoke → publish → release) - macbook-local arm64 runner, cosign keyless OIDC signing on tags - 🆕 New TASKS item filed for the v0.8.1 / CI compose port-8765 architectural conflict (low-risk : only affects when local user runs `up` during CI) - ADR-0029 hardening preserved with the tmpfs HOME pattern (small, unprivileged-owned, capped) - The v0.8.0+v0.8.1+v0.8.2 trilogy completes the v0.8 milestone : redaction + broker auto-management + agent actually-runs-claude - ⏭ N/A — CLI only - 🆕 `secured-claude up && docker exec ... claude -p ...` is now a 1-command working flow (was : broken since v0.8.0 smoke 2026-05-01) - New diagnostic doc at docs/dev/agent-container-debug.md captures the EROFS investigation methodology for future debug sessions - ☐ CI smoke + host-side broker port-8765 conflict on macbook-local — see TASKS.md. Workaround : stop the local broker before triggering CI. - ☐ `secured-claude audit --since N` filter bug — discovered during v0.8.2 verification ; row WAS in SQLite DB, but the CLI `--since 2m` returned 0. Low priority — doesn't affect security posture. - v0.8.3 or v0.9.0 : address the CI port-8765 architectural conflict (option (a) preferred per TASKS — single architecture path for prod + CI). - v0.9.0 candidates : signed Cerbos policy bundles, multi-principal support, SIEM export of audit log.