$ the-wire · showcase
Approval digests get RFC 8785 float serialization; sandbox-runtime 0.0.80 kills a 300 ms path
By RepoJournal · Filed · About Agent Security · Composed from the cited sources · methodology
Two operator-facing fixes landed: agent-mesh approval digests now emit RFC 8785-correct JSON numbers, so digests computed by other implementations will match, and anthropics/sandbox-runtime shipped v0.0.80 with permission checks that no longer stall on bracket-heavy read rules.
fix(agent-mesh): serialize JCS numbers per RFC 8785 microsoft/agent-governance-toolkit
approval_protocol.canonicalize used Python's repr for finite floats and collapsed integer-valued floats to ints, so 1e21 serialized as a 21-digit integer and the max double as a 309-digit integer where RFC 8785 section 3.2.2.3 requires 1e+21 and 1.7976931348623157e+308. Floats are now formatted the way ECMAScript Number::toString does, which matters most if you verify approval digests against a...
Release v0.0.80 (#664) anthropics/sandbox-runtime
Version 0.0.80 is out, and it carries the permission-check fix: getFsWriteConfig() now reads brackets in linear time and compiles each read rule once, taking a bracket-heavy profile from up to 300 ms per call on main down to 4 ms, the figure the changelog cites for 0.0.79. If your sandbox profiles use glob read rules with many brackets, upgrade rather than pinning an earlier cut.
fix(agent-hypervisor): do not treat a quoted < or > as a redirection (#4340) microsoft/agent-governance-toolkit
RingEnforcer.check_command treated a quoted or escaped < or > (FOO=">" ls, echo ">", echo \>) as a redirection whose target swallowed the rest of the command, and denied it for having no executable. Closed quotes and backslash escapes are now skipped when redirections are detected, so those invocations pass the hypervisor again; an unterminated quote behaves as before.
fix: paginate cluster_detect.py search/REST calls past page 1 microsoft/agent-governance-toolkit
The cluster_detect.py detector now paginates _search() and the three plain REST call sites (a seed account's repos, a repo's forks, an issue's comments) instead of stopping at page 1. The accounts most likely to trip real detection, with many repos, forks and comments, were exactly the ones being truncated, so a clean report from this script is worth more than it was yesterday.
fix(agent-mesh): serialize JCS numbers per RFC 8785 (#4341) microsoft/agent-governance-toolkit
The JCS number serializer landed in agent-mesh. Operators who cross-check approval digests against a second implementation should treat digests produced before this change as non-compliant.
Action items
- → Upgrade anthropics/sandbox-runtime to v0.0.80 to pick up the linear-time bracket parsing and single-compile read rules anthropics/sandbox-runtime [plan]
