Hugging Face's logo

Spaces:
claytonsamples
/
controlspec
Running

App Files Community
controlspec
File size: 11,710 Bytes
d140fc3
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
{
  "schema_version": "1",
  "synthetic_only": true,
  "sandbox_id": "cf9877e9-b1d4-4c13-b919-f222cc9dae1f",
  "runtime_report_sha256": "c0e375fd5b56c3e3185ed1a98880e70a87d68eea5ad3691dea327b6518eab414",
  "controller_image": "ghcr.io/astral-sh/uv@sha256:531f855bda2c73cd6ef67d56b733b357cea384185b3022bd09f05e002cd144ca",
  "supervisor_base": "ghcr.io/nvidia/openshell/supervisor@sha256:d7b5264bb6bc56f4796e6fa3617b8e4a8d785be0b7293542efd8cc250b0fb67a",
  "supervisor_image_id": "sha256:6991babe94f436fb043f7d3510ba42517d6f248870e3cc852afc2a713f55fa3a",
  "workload_image_id": "sha256:43618714a62a0fd0f1c6889aa6cbe9c1d618f459a69cb1c673da72d721ca9b7f",
  "docker_version": "28.5.1",
  "kernel": "6.6.87.2-microsoft-standard-WSL2",
  "supervisor_logs": [
    "2026-09-30T22:20:19.487Z OCSF NET:OPEN [INFO] ALLOWED /usr/bin/curl(0) -> host.openshell.internal:18081 [policy:synthetic-purchase engine:opa]",
    "2026-09-30T22:20:19.531Z OCSF HTTP:POST [INFO] ALLOWED POST http://host.openshell.internal:18081/purchases [policy:synthetic-purchase engine:l7]",
    "2026-09-30T22:20:19.567Z OCSF HTTP:POST [INFO] ALLOWED POST http://host.openshell.internal:18081/purchases [policy:synthetic-purchase engine:middleware] [failed:false transformed:true]",
    "2026-09-30T22:20:19.659Z OCSF NET:OPEN [INFO] ALLOWED /usr/bin/curl(0) -> host.openshell.internal:18081 [policy:synthetic-purchase engine:opa]",
    "2026-09-30T22:20:19.712Z OCSF HTTP:POST [INFO] ALLOWED POST http://host.openshell.internal:18081/purchases [policy:synthetic-purchase engine:l7]",
    "2026-09-30T22:20:19.742Z OCSF HTTP:POST [MED] DENIED POST http://host.openshell.internal:18081/purchases [policy:synthetic-purchase engine:middleware] [failed:false transformed:false reason:middleware_denied:controlspec-purchases:action_already_reserved]",
    "2026-09-30T22:20:19.813Z OCSF NET:OPEN [INFO] ALLOWED /usr/bin/curl(0) -> host.openshell.internal:18081 [policy:synthetic-purchase engine:opa]",
    "2026-09-30T22:20:19.853Z OCSF HTTP:POST [INFO] ALLOWED POST http://host.openshell.internal:18081/purchases [policy:synthetic-purchase engine:l7]",
    "2026-09-30T22:20:19.876Z OCSF HTTP:POST [MED] DENIED POST http://host.openshell.internal:18081/purchases [policy:synthetic-purchase engine:middleware] [failed:false transformed:false reason:middleware_denied:controlspec-purchases:approval_required]",
    "2026-09-30T22:20:19.943Z OCSF NET:OPEN [INFO] ALLOWED /usr/bin/curl(0) -> host.openshell.internal:18081 [policy:synthetic-purchase engine:opa]",
    "2026-09-30T22:20:19.980Z OCSF HTTP:POST [INFO] ALLOWED POST http://host.openshell.internal:18081/purchases [policy:synthetic-purchase engine:l7]",
    "2026-09-30T22:20:20.007Z OCSF HTTP:POST [MED] DENIED POST http://host.openshell.internal:18081/purchases [policy:synthetic-purchase engine:middleware] [failed:false transformed:false reason:middleware_denied:controlspec-purchases:approval_required]",
    "2026-09-30T22:20:20.145Z OCSF NET:OPEN [INFO] ALLOWED /usr/bin/curl(0) -> host.openshell.internal:18081 [policy:synthetic-purchase engine:opa]",
    "2026-09-30T22:20:20.185Z OCSF HTTP:POST [INFO] ALLOWED POST http://host.openshell.internal:18081/purchases [policy:synthetic-purchase engine:l7]",
    "2026-09-30T22:20:20.217Z OCSF HTTP:POST [INFO] ALLOWED POST http://host.openshell.internal:18081/purchases [policy:synthetic-purchase engine:middleware] [failed:false transformed:true]",
    "2026-09-30T22:20:20.334Z OCSF NET:OPEN [INFO] ALLOWED /usr/bin/curl(0) -> host.openshell.internal:18081 [policy:synthetic-purchase engine:opa]",
    "2026-09-30T22:20:20.384Z OCSF HTTP:POST [INFO] ALLOWED POST http://host.openshell.internal:18081/purchases [policy:synthetic-purchase engine:l7]",
    "2026-09-30T22:20:20.425Z OCSF HTTP:POST [MED] DENIED POST http://host.openshell.internal:18081/purchases [policy:synthetic-purchase engine:middleware] [failed:false transformed:false reason:middleware_denied:controlspec-purchases:approval_required]",
    "2026-09-30T22:20:20.575Z OCSF NET:OPEN [INFO] ALLOWED /usr/bin/curl(0) -> host.openshell.internal:18081 [policy:synthetic-purchase engine:opa]",
    "2026-09-30T22:20:20.623Z OCSF HTTP:POST [INFO] ALLOWED POST http://host.openshell.internal:18081/purchases [policy:synthetic-purchase engine:l7]",
    "2026-09-30T22:20:20.635Z OCSF HTTP:POST [MED] DENIED POST http://host.openshell.internal:18081/purchases [policy:synthetic-purchase engine:middleware] [failed:false transformed:false reason:middleware_denied:controlspec-purchases:action_changed]",
    "2026-09-30T22:20:20.781Z OCSF NET:OPEN [INFO] ALLOWED /usr/bin/curl(0) -> host.openshell.internal:18081 [policy:synthetic-purchase engine:opa]",
    "2026-09-30T22:20:20.822Z OCSF HTTP:POST [INFO] ALLOWED POST http://host.openshell.internal:18081/purchases [policy:synthetic-purchase engine:l7]",
    "2026-09-30T22:20:20.852Z OCSF HTTP:POST [MED] DENIED POST http://host.openshell.internal:18081/purchases [policy:synthetic-purchase engine:middleware] [failed:false transformed:false reason:middleware_denied:controlspec-purchases:policy_denied]",
    "2026-09-30T22:20:20.949Z OCSF NET:OPEN [INFO] ALLOWED /usr/bin/curl(0) -> host.openshell.internal:18081 [policy:synthetic-purchase engine:opa]",
    "2026-09-30T22:20:20.988Z OCSF HTTP:POST [INFO] ALLOWED POST http://host.openshell.internal:18081/purchases [policy:synthetic-purchase engine:l7]",
    "2026-09-30T22:20:21.014Z OCSF HTTP:POST [INFO] ALLOWED POST http://host.openshell.internal:18081/purchases [policy:synthetic-purchase engine:middleware] [failed:false transformed:true]",
    "2026-09-30T22:20:21.208Z OCSF NET:OPEN [INFO] ALLOWED /usr/bin/curl(0) -> host.openshell.internal:18081 [policy:synthetic-purchase engine:opa]",
    "2026-09-30T22:20:21.253Z OCSF HTTP:GET [MED] DENIED GET http://host.openshell.internal:18081/state [policy:synthetic-purchase engine:l7] [reason:L7_REQUEST deny GET host.openshell.internal:18081/state reason=GET /state not permitted by policy]",
    "2026-09-30T22:20:21.346Z OCSF NET:OPEN [MED] DENIED /usr/bin/curl(0) -> 172.30.0.2:18081 [reason:transparent_tcp_policy_denied]",
    "2026-09-30T22:20:21.462Z OCSF NET:OPEN [MED] DENIED /usr/bin/curl(0) -> 172.30.0.2:17670 [reason:transparent_tcp_policy_denied]",
    "2026-09-30T22:20:21.556Z OCSF NET:OPEN [MED] DENIED /usr/bin/curl(0) -> 172.30.0.2:50051 [reason:transparent_tcp_policy_denied]",
    "2026-09-30T22:20:21.878Z OCSF NET:OPEN [INFO] ALLOWED /usr/bin/curl(0) -> host.openshell.internal:18081 [policy:synthetic-purchase engine:opa]",
    "2026-09-30T22:20:21.920Z OCSF HTTP:POST [INFO] ALLOWED POST http://host.openshell.internal:18081/purchases [policy:synthetic-purchase engine:l7]",
    "2026-09-30T22:20:21.921Z OCSF HTTP:POST [MED] DENIED POST http://host.openshell.internal:18081/purchases [policy:synthetic-purchase engine:middleware] [failed:true transformed:false reason:middleware_failed: external_service_error]"
  ],
  "recovery": {
    "scenario": "middleware_recovery",
    "command": [
      "openshell",
      "--gateway-endpoint",
      "http://127.0.0.1:17670",
      "sandbox",
      "exec",
      "--name",
      "csrt-20260930-8e3f",
      "--no-tty",
      "--no-login-shell",
      "--",
      "/usr/bin/curl",
      "-sS",
      "-i",
      "--max-time",
      "12",
      "https://host.openshell.internal:18081/purchases",
      "-H",
      "content-type: application/json",
      "--data",
      "{\"schema_version\":\"1\",\"action_id\":\"runtime-43e46fd5e9-recovery\",\"amount_minor\":4200,\"currency\":\"USD\",\"merchant\":\"demo-store\",\"recurring\":false}"
    ],
    "exit_code": 0,
    "stdout": "HTTP/1.1 200 OK\ndate: Wed, 30 Sep 2026 22:21:47 GMT\nserver: uvicorn\ncontent-length: 618\ncontent-type: application/json\n\n{\"schema_version\":\"1\",\"synthetic_only\":true,\"status\":\"committed\",\"action_id\":\"runtime-43e46fd5e9-recovery\",\"scope\":{\"gateway_id\":\"controlspec-runtime-18a317b6341a\",\"sandbox_id\":\"cf9877e9-b1d4-4c13-b919-f222cc9dae1f\"},\"request_digest\":\"sha256:f7c068f1e05f61a3fb5dd6f658cbacf04d64e34a633caf35360ae663c2a977fa\",\"nonce\":\"3dde692254cedb2d1c061d5e0e7b3ba27b0f2467b4c94a262b68337ecc2a2d5e\",\"amount_minor\":4200,\"committed_at\":\"2026-09-30T22:21:48.071657Z\",\"evidence_id\":\"sha256:eaae0f87ecdb0d3a8f8c73821e670f583d7850f6d9a87f53a4c311603a823766\",\"evidence_mac\":\"e3fe357b29f5771c565a67bc36acd10be1686a159838700dc2cab1b6b13a1603\"}",
    "stderr": "",
    "http": {
      "status": 200,
      "headers": {
        "date": "Wed, 30 Sep 2026 22:21:47 GMT",
        "server": "uvicorn",
        "content-length": "618",
        "content-type": "application/json"
      },
      "body": {
        "schema_version": "1",
        "synthetic_only": true,
        "status": "committed",
        "action_id": "runtime-43e46fd5e9-recovery",
        "scope": {
          "gateway_id": "controlspec-runtime-18a317b6341a",
          "sandbox_id": "cf9877e9-b1d4-4c13-b919-f222cc9dae1f"
        },
        "request_digest": "sha256:f7c068f1e05f61a3fb5dd6f658cbacf04d64e34a633caf35360ae663c2a977fa",
        "nonce": "3dde692254cedb2d1c061d5e0e7b3ba27b0f2467b4c94a262b68337ecc2a2d5e",
        "amount_minor": 4200,
        "committed_at": "2026-09-30T22:21:48.071657Z",
        "evidence_id": "sha256:eaae0f87ecdb0d3a8f8c73821e670f583d7850f6d9a87f53a4c311603a823766",
        "evidence_mac": "e3fe357b29f5771c565a67bc36acd10be1686a159838700dc2cab1b6b13a1603"
      }
    },
    "target_purchase_delta": 1,
    "target_spend_delta_minor": 4200,
    "completion_verified": true,
    "effective_policy_unchanged": true,
    "policy_after": {
      "active_version": 2,
      "config_revision": 16511938764146938059,
      "hash": "672621067d5e56ef6db856be8c756d9a1529ef66327428263026eea079f779fd",
      "policy": {
        "filesystem_policy": {
          "include_workdir": true,
          "read_only": [
            "/usr",
            "/lib",
            "/etc",
            "/var/log",
            "/proc",
            "/dev/urandom"
          ],
          "read_write": [
            "/tmp",
            "/dev/null"
          ]
        },
        "network_middlewares": {
          "controlspec-purchases": {
            "config": {
              "profile": "synthetic-purchases-v1"
            },
            "endpoints": {
              "include": [
                "host.openshell.internal"
              ]
            },
            "middleware": "controlspec-demo",
            "name": "ControlSpec synthetic purchases",
            "on_error": "fail_closed",
            "order": 100
          }
        },
        "network_policies": {
          "synthetic-purchase": {
            "binaries": [
              {
                "path": "/usr/bin/curl"
              }
            ],
            "endpoints": [
              {
                "enforcement": "enforce",
                "host": "host.openshell.internal",
                "port": 18081,
                "protocol": "rest",
                "rules": [
                  {
                    "allow": {
                      "method": "POST",
                      "path": "/purchases"
                    }
                  }
                ]
              }
            ],
            "name": "Synthetic purchases"
          }
        },
        "version": 1
      },
      "policy_source": "sandbox",
      "sandbox": "csrt-20260930-8e3f",
      "scope": "sandbox",
      "status": "effective",
      "version": 2
    },
    "synthetic_only": true,
    "status": "passed"
  }
}