README
¶
Wardyn Sample Workspaces
This directory is a catalog of small, self-contained workspaces that let an
operator exercise every major Wardyn governance control without writing code.
Each subdirectory is a minimal but runnable project paired with a TASK.md
that gives the exact task text for the agent, the wardyn run command to
issue, and the observable PASS criteria.
How to use this catalog
Option A — point a run at a git host.
Push a workspace subdirectory to any public (or private, with a configured
GitHub App) repository, then pass it as --repo. The dispatcher records the
slug as audit metadata and the agent launcher shallow-clones it into the
sandbox workspace (~/work/<name>) through the governed egress proxy before
the task runs — public GitHub repos clone with no credentials (github.com is
allowlisted in the demo policy); private repos authenticate via the brokered
wardyn-git-helper (no token ever enters the sandbox env).
Option B — supply the task text directly.
The exact task text in each TASK.md is crafted so that even an empty
~/work directory is a meaningful test of the governance control. Omit
--repo or pass any slug as a label; the governed behavior under test does not
depend on the workspace files being present.
Option C — API-key-free probe.
Run examples/workspaces/probes.sh against a live sandbox (any RUNNING run)
to exercise every egress control with raw curl and wardyn-git-helper
calls. No Anthropic key needed.
Prerequisites
# Start the stack, then build the agent images:
make setup
make agent-images
export WARDYN_URL=http://localhost:8080
The demo policy (examples/policies/demo.json) allowlists github.com and
*.githubusercontent.com and sets first_use_approval: "deny_with_review".
That is the policy in force for all scenarios below unless noted otherwise.
Running a scenario
Every scenario is the same command with a different --repo and --task; the
escaped --task string in each TASK.md is the exact task text, so copy
the command as printed.
wardyn run \
--agent claude-code \
--repo <org>/<repo> \
--task "<task text from the scenario's TASK.md>"
Each TASK.md names the audit events to look for. To read them from the CLI
instead of the UI: wardyn run list for run state, wardyn audit <run-id> for
every event of a run.
Scenario catalog
| # | Directory | Wardyn control exercised | Expected observable outcome |
|---|---|---|---|
| 1 | benign/ |
Full happy path: recording, attributed audit, clean egress | Run reaches RUNNING; wardyn audit shows run.exec success; Replay tab has a session; no pending approvals |
| 2 | exfil-attempt/ |
L2 egress deny / first-use PENDING for an unlisted domain | egress.deny or approval.create (kind=egress_domain) for webhook.example.com; no bytes leave the sandbox; request body is never forwarded |
| 3 | metadata-probe/ |
Builtin private-IP unconditional deny (invariant 3) | egress.deny with rule_source=builtin:private-ip; HTTP 403 returned to the agent; no approval queue entry (the block is unconditional — approval cannot override it) |
| 4 | needs-approval/ |
First-use approval queue: PENDING -> APPROVED or DENIED | Approval entry with kind=egress_domain for example.com visible in the UI Approvals tab; approving unlocks subsequent requests; denying produces egress.deny |
| 5 | github-push/ |
Brokered git credential chain: credential ApprovalRequest -> approve -> time-limited token (or fail-closed without a GitHub App); the token is handed to wardyn-git-helper and never enters the sandbox env |
approval.create kind=credential in audit; on approval the broker runs the mint path and writes credential.mint (or credential.mint.fail if no GitHub App is configured — the fail-closed path is the expected PASS for a stock demo) |
| 6 | long-running/ |
Lifecycle reaper auto-stop | Run advances to STOPPED after auto_stop_after_sec; audit event run.autostop is emitted; the sandbox container is removed |
Workspace source layout
Each workspace contains:
- Source files — minimal but runnable (a few files, no generated artifacts).
TASK.md— the wardyn run command (whose--taskstring is the exact task text), what to watch, and the PASS criteria.
No workspace contains secrets or credentials of any kind.
Probe script
probes.sh is a standalone bash library of docker exec one-liners that
drive each control directly inside a live sandbox. It requires a RUNNING
container whose name or id is passed as SANDBOX_REF and exercises every
control with raw network calls — no Anthropic key, no Claude required.
# The kill-switch probe defaults WARDYN_ADMIN_TOKEN to demo-admin-token —
# export it only if your stack uses a different token.
SANDBOX_REF=wardyn-agent-<run-id> bash examples/workspaces/probes.sh
Directories
¶
| Path | Synopsis |
|---|---|
|
Package main is a trivial Go program used as the github-push workspace.
|
Package main is a trivial Go program used as the github-push workspace. |