Fix automatic remediation output-path permission policy #176

New issue

Closed

opened 2026-08-16 08:53:29 +01:00 by nimmo · 0 comments

nimmo commented

2026-08-16 08:53:29 +01:00

Owner

Context

The automatic remediation controller generated diagnosis-only issues #165, #166, #167, #171, #172, and #174 because OpenCode could not create its required output files. The policy allows relative output paths, while the sandboxed tool calls use /workspace/.remediation-output/... absolute paths.

Scope

Permit only the two exact absolute output paths exposed inside the Bubblewrap sandbox.
Add regression coverage that verifies the generated OpenCode policy authorises those actual tool paths.
Preserve the read-only repository mount and all existing denied tool/file boundaries.

Completion criteria

A real OpenCode write to each permitted sandbox output path is authorised.
Other edits remain denied.
The remediation regression suite passes.
The change is validated through the normal MR checks and a Nova canary before closing.

## Context The automatic remediation controller generated diagnosis-only issues #165, #166, #167, #171, #172, and #174 because OpenCode could not create its required output files. The policy allows relative output paths, while the sandboxed tool calls use `/workspace/.remediation-output/...` absolute paths. ## Scope - Permit only the two exact absolute output paths exposed inside the Bubblewrap sandbox. - Add regression coverage that verifies the generated OpenCode policy authorises those actual tool paths. - Preserve the read-only repository mount and all existing denied tool/file boundaries. ## Completion criteria - A real OpenCode write to each permitted sandbox output path is authorised. - Other edits remain denied. - The remediation regression suite passes. - The change is validated through the normal MR checks and a Nova canary before closing.

nimmo added this to the Automated Update Remediation milestone

2026-08-16 08:53:29 +01:00

nimmo added the

host:nova

project:auto-update-remediation

service:auto-update

priority:high

labels

2026-08-16 08:53:29 +01:00

nimmo referenced this issue from a commit

2026-08-16 08:55:56 +01:00

fix(remediation): allow sandbox output paths