profiles: extract shared sandbox profile for enzo + kusanagi

Move the yokai agent-sandbox account (user, ikai group, /srv/git drop dir,
scoped sudo de-escalation, and the local-clones workflow docs) out of
machines/enzo into a shared profiles/sandbox.nix that both machines import.

The only per-machine value is the human owner allowed to drop into the
sandbox, exposed as a `sandbox.owner` string option so the profile stays
username-agnostic (enzo: hwebs, kusanagi: henz). kusanagi gains the sandbox
it didn't have before; enzo's inline block collapses to one setting.

Assisted-by: claude-code:claude-opus-4-8

1 files changed, 135 insertions, 0 deletions

diff --git a/profiles/sandbox.nix b/profiles/sandbox.nix
new file mode 100644
index 0000000..40b962d
--- /dev/null
+++ b/profiles/sandbox.nix
@@ -0,0 +1,135 @@
+# Agent sandbox profile — a bare `yokai` user for running coding agents under a
+# separate UID, isolated from the machine owner's files and secrets. yokai has
+# no privileged group memberships and its own $HOME.
+#
+# Opt-in per machine: import this profile and set `sandbox.owner` to the human
+# user allowed to drop into the sandbox (enzo: hwebs, kusanagi: henz). The
+# profile stays username-agnostic; only that one option differs per machine.
+#
+# Model: LOCAL CLONES, not a shared working tree. yokai owns its own clone of
+# each repo under /srv/git; the owner keeps the canonical repo in ~. Work moves
+# between the two over git remotes — never by sharing one tree.
+#
+# Why not one shared tree: git executes hooks and config out of .git, so a tree
+# yokai can write must never be one the owner runs `git` *inside* — a planted
+# hook/config would run as the owner and escape the sandbox. Git's "dubious
+# ownership" warning is exactly that guard; don't defeat it with safe.directory
+# on a yokai-writable repo.
+#
+# CARDINAL RULE: the owner never runs git with CWD inside /srv/git/<repo>.
+# Review the agent's work by FETCHING its commits into your own repo and reading
+# them there.
+#
+# /srv/git is created below as 2770 root:ikai — group-writable + setgid, so the
+# owner and yokai (both in ikai) can each drop clones without sudo and new files
+# inherit the ikai group. It sits outside ~ so /home/<owner> stays 700 and yokai
+# never needs to traverse into home. (Tradeoff: yokai has write on the /srv/git
+# dir itself, i.e. its own play area — fine for a sandbox.)
+#
+# Seed the agent's clone (hand a fresh clone to yokai):
+#     git clone ~/git/<repo> /srv/git/<repo>
+#     sudo chown -R yokai:ikai /srv/git/<repo>    # yokai now owns its tree
+#   TODO: wrap seed (clone + chown) in a one-shot helper (shell fn / just).
+#
+# Pull the agent's work back into YOUR repo (stay in your trusted tree):
+#     git -C ~/git/<repo> remote add sandbox /srv/git/<repo>
+#     git -C ~/git/<repo> fetch sandbox
+#     git -C ~/git/<repo> log --oneline sandbox/main   # review, then merge
+#
+# Land + SIGN on main (signatures attest that the owner reviewed+vouches, so the
+# owner signs — never put a signing key in yokai's home, and never give yokai
+# yours). Squash the agent's WIP into one commit you author + sign; satisfies
+# "require signed commits" branch protection trivially and keeps history clean:
+#     git -C ~/git/<repo> checkout main
+#     git -C ~/git/<repo> merge --squash sandbox/main   # stage, don't commit
+#     git -C ~/git/<repo> commit -S -m "...\n\nAssisted-by: claude-code:<model>"
+#     git -C ~/git/<repo> push origin main
+#   Alt — keep granular commits instead of squashing: rebase re-commits each
+#   one signed by the owner (also all-signed, but review commit-by-commit):
+#     git -C ~/git/<repo> checkout -b land sandbox/main   # local branch at tip
+#     git -C ~/git/<repo> rebase -S main                  # replay onto main, sign each
+#     git -C ~/git/<repo> checkout main
+#     git -C ~/git/<repo> merge --ff-only land && git -C ~/git/<repo> branch -d land
+#     git -C ~/git/<repo> push origin main
+#   Alt — INTERACTIVE, for exploring/curating the agent's history by hand: opens
+#   a todo list (pick/squash/fixup/reword/drop/reorder per commit), then the
+#   message editor. Good when you want to hand-pick what lands. Run it in a real
+#   terminal — interactive git can't be driven through the agent harness:
+#     git -C ~/git/<repo> checkout -b land sandbox/main
+#     git -C ~/git/<repo> rebase -i -S main    # -S signs each resulting commit
+#     # ...then merge --ff-only land into main + push, as above.
+#   (Signing config lives in the owner's dotfiles, not here: commit.gpgsign +
+#    user.signingkey.)
+#
+# Airtight variant — exchange via bundles (inert data, no hooks/config run):
+#     (yokai) git -C /srv/git/<repo> bundle create /srv/git/x.bundle main
+#     (owner) git -C ~/git/<repo> fetch /srv/git/x.bundle main:sandbox/main
+#
+# Run the agent as yokai:  sudo -u yokai claude
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  owner = config.sandbox.owner;
+in
+{
+  options.sandbox.owner = lib.mkOption {
+    type = lib.types.str;
+    example = "hwebs";
+    description = ''
+      Human user permitted to `sudo -u yokai` into the agent sandbox, and joined
+      to the `ikai` group so they share the /srv/git drop dir with yokai. Set
+      per machine (enzo: hwebs, kusanagi: henz).
+    '';
+  };
+
+  config = {
+    # The owner joins ikai so they can drop clones into /srv/git without sudo.
+    users.users.${owner}.extraGroups = [ "ikai" ];
+
+    # Let the owner drop to yokai without a password. This grants NO new
+    # privilege — it's a de-escalation to a weaker account — so NOPASSWD here is
+    # low-risk, unlike a run-as-root rule. Scoped to runAs=yokai only; root
+    # stays gated.
+    security.sudo.extraRules = [
+      {
+        users = [ owner ];
+        runAs = "yokai";
+        commands = [
+          {
+            command = "ALL";
+            options = [
+              "NOPASSWD"
+              "SETENV"
+            ];
+          }
+        ];
+      }
+    ];
+
+    users.groups.ikai = { };
+    users.users.yokai = {
+      isNormalUser = true;
+      description = "Sandbox account for coding agents";
+      group = "ikai";
+      packages = with pkgs; [
+        git
+        claude-code
+        pi-coding-agent
+      ];
+    };
+
+    # Drop dir for the agent's local clones. Created at activation as 2770
+    # root:ikai — setgid (new entries inherit ikai) + group-writable so the
+    # owner and yokai can each place clones here without sudo; world sees
+    # nothing. Sits outside ~ so /home/<owner> stays a sealed 700. Trailing "-"
+    # = no age-cleaning. Each clone's own ownership is set when seeded (above).
+    systemd.tmpfiles.rules = [
+      "d /srv/git 2770 root ikai -"
+    ];
+  };
+}