Forward-looking planning doc capturing prior-art analysis from OLP's
Phase 7 PR-B re-evaluation, scoped down to OCP's single-provider
(anthropic) deployment.
Documents:
- Multi-tenant gap for OCP (cross-key lateral read, OAuth exposure)
- Why OLP's outer-bwrap PR-B approach is the wrong path to copy
(Anthropic design intent, ~/.claude.json upstream not-planned)
- Three viable alternatives:
A. Ephemeral $HOME via env var (~50 LOC, recommended Phase 1)
B. bwrap --tmpfs $HOME + ro-bind credentials (apt dep, Linux only)
C. OverlayFS lowerdir+upperdir (needs CAP_SYS_ADMIN)
- Orthogonal cross-key isolation layer (per-spawn customConfig denyRead
or per-OS-user spawning)
- Trust-tier framing (single-user / family-zone / shared-host)
Not an ADR — becomes one only when work actually starts. Not binding;
ALIGNMENT.md authority requirements still apply when sandbox code lands.
Cross-references OLP's parallel multi-provider work at
dtzp555-max/olp ADR 0014 Amendment 1 (pending) and archive branch
phase-7-pr-b-outer-bwrap-snapshot.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
