S013: Agent-Name Rule Context

Overview

The CEL evaluation context exposes agent.name so operators can gate policy by the daemon-managed container that originated a request. The container-facing Unix API resolves Linux SO_PEERCRED PID to an immutable Docker container ID. The HTTP proxy and DNS filter resolve the source IP through a lifecycle-managed Docker identity index. All three enforcement paths reject requests when a managed identity cannot be proven.

Background

The agent naming convention strips the trailing -N from container names:

• Container foobar-1 → agent name foobar
• Container foobar-2 → agent name foobar
• Container my-agent-12 → agent name my-agent

The SO_PEERCRED socket option provides the caller's host-namespace PID. Proxy and DNS traffic instead carries a bridge source IP. DockerManager validates both forms against the managed-by=outcalld label and maintains an IP identity index from Docker lifecycle events.

User Scenarios

S013-US-001 [P1] As a host operator, I want to write rules that allow specific agents by name so that I can enforce per-agent access policies.

S013-US-002 [P1] As a host operator, I want agent.name exposed in the CEL context so that existing rule authors can use it immediately.

S013-US-003 [P2] As a host operator, I want to debug which agent made a request by inspecting the agent.name field in evaluation logs.

Requirements Summary

The Unix API and network services use different transport identities but converge on the same validated Docker container name and derive_agent_name helper. A synthetic host-side rule evaluation may omit agent; a request on a container-facing enforcement path may not.

Cross-Spec Dependencies

• Depends on: S003 (CEL context structure, evaluation path)
• Depends on: S008 (lookup_container_name_by_ip exists)
• Required by: Operator rules that need per-agent gating (no downstream specs currently reference this)

Shared Types (outcall-api)

/// Agent identity resolved from a daemon-validated managed container.
#[derive(Debug, Clone, Serialize, Deserialize, Default)]
pub struct AgentContext {
    pub name: String,  // e.g. "foobar" from "foobar-1"
}

/// Full CEL evaluation context (S003, extended with agent).
#[derive(Debug, Clone, Serialize, Deserialize, Default)]
pub struct EvalContext {
    pub network: Option<NetworkContext>,
    pub http: Option<HttpContext>,
    pub dns: Option<DnsContext>,
    pub docker: Option<DockerContext>,
    pub run: Option<RunContext>,
    pub agent: Option<AgentContext>,  // S013-FR-002
}

CEL Usage

Once implemented, operators can write:

rules:
  - id: "allow-foobar-db"
    condition: |
      agent.name == "foobar" &&
      network.port == 5432
    action: allow

  - id: "block-bar-agents-ssh"
    condition: agent.name == "bar" && network.port == 22
    action: block