Skip to content

Keep strict rendering without exposing extra Python packages - #228

Merged
merlerm merged 1 commit into
mainfrom
pr/strict-render-runtime
Sep 19, 2026
Merged

merlerm merged 1 commit into
mainfrom
pr/strict-render-runtime

Conversation

@merlerm

@merlerm merlerm commented Sep 19, 2026 •

Copy link
Copy Markdown
Collaborator

Strict blackbox images exposed extra packages through a separate MCP virtualenv. Remove that environment and the importable project package, and serve the two rendering tools with a standalone stdlib server under the strict numerical interpreter. Rendering remains available without exposing robocode, mcp, pydantic, or httpx to agent code.

Applies to strict Docker and Apptainer images; rebuild strict images. The Apptainer launcher rejects the old layout. Regular Docker rendering retains its existing implementation.

Validated with strict package and rendering unit tests, SDK interoperability, and a deterministic audit against the rebuilt Apptainer image. Docker runtime execution was not available; its shared configuration is covered by unit tests.

@merlerm
merlerm added this pull request to stack #232 September 19, 2026 14:53
@merlerm
merlerm marked this pull request as ready for review September 19, 2026 14:54
@merlerm
merlerm force-pushed the pr/strict-render-runtime branch from a9059cb to 69a0749 Compare September 19, 2026 14:57
@merlerm
merlerm requested a review from tomsilver September 19, 2026 15:13

@tomsilver tomsilver left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security is hard

@merlerm
merlerm force-pushed the pr/strict-render-runtime branch from 69a0749 to fc5f8ef Compare September 19, 2026 15:22
@merlerm
merlerm removed this pull request from stack #232 September 19, 2026 15:30
@merlerm
merlerm force-pushed the pr/strict-render-runtime branch from fc5f8ef to a5c45f8 Compare September 19, 2026 15:31
@merlerm
merlerm changed the base branch from pr/validated-model-broker to main September 19, 2026 15:31
@merlerm
merlerm added this pull request to stack #233 September 19, 2026 15:31
@merlerm merlerm changed the title Remove the importable MCP environment from strict blackbox images Keep strict rendering without exposing extra Python packages Sep 19, 2026
@merlerm
merlerm merged commit 76e5dc0 into main Sep 19, 2026
4 checks passed
@merlerm
merlerm deleted the pr/strict-render-runtime branch September 19, 2026 16:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants