Acceptance checks¶
This checklist is for maintainers and contributors validating a change to ExOShell itself; daily use needs none of it.
For each agent, launch a sandbox and verify the working directory, sandbox
user, host-owned writes below /workspace, and the agent-specific state paths.
Then verify inference through each configured backend and GitHub/GitLab CLI
access. Recreate the sandbox and confirm runtime history is absent.
Smoke tests¶
After recreating the sandbox, verify identity and configuration without printing credential variables:
id -un
printf '%s\n' "$HOME" "$PWD"
command -v gh glab git
printf '%s\n' "$GH_HOST" "$GITLAB_HOST"
gh auth status --hostname github.example.com
glab auth status --hostname gitlab.example.com
git ls-remote https://github.example.com/example/project.git
git ls-remote https://gitlab.example.com/example/project.git
Expected results:
- The user is
sandbox, home is/sandbox, and the project is below/workspace. - API queries, clone, and fetch work at baseline.
- API mutations and Git pushes remain blocked until explicitly allowed by both policy and token scope.
openshell policy get <sandbox> --fullcontains one GraphQL endpoint for each configured source-control host.
When a request fails, inspect openshell logs <sandbox> --tail --source sandbox.
Check the destination, binary path, HTTP method and path, policy enforcement,
and credential_endpoint_mismatch. Fix a credential endpoint mismatch in the
provider profile only when the destination is an intended credential recipient;
widening user policy alone does not change credential binding.