Classic confinement request for axqa-smart-agent

store-requests classic-confinement
1
  • name: axqa-smart-agent
  • description: AXQA Smart Agent is the local execution component of the AXQA QA automation platform.
  • snapcraft: PRIVATE
  • upstream: PRIVATE
  • upstream-relation: AXQA TECHNOLOGY LTDA is the original developer, owner, maintainer, and publisher of AXQA Smart Agent.
  • supported-category: There is not an exact match among the currently listed supported categories.The relevant classic-confinement characteristics for AXQA Smart Agent are that it executes user-configured workloads and may need to run commands or access host applications and resources that cannot be known when the snap is built. We therefore request review of this use case for classic confinement.
  • reasoning: Classic confinement is required because AXQA Smart Agent’s core purpose is to execute authorized QA automation workloads in the user’s actual host environment. The Smart Agent is not intended to operate only on resources packaged inside the snap. A customer’s automation can target applications, executables, files, development/testing tools, and other resources installed or selected on the host at runtime. These resources and paths cannot all be declared when the snap is built because they depend on each customer’s environment and QA project. Strict confinement would isolate the Smart Agent from parts of the real host execution environment that it is specifically intended to test and automate. For example, an authorized workload may need to: - interact with applications installed on the host; - execute user-configured local tools or commands; - access files selected or configured by the user for a QA workflow; - communicate with local or remote APIs and testing environments; - perform automation against resources whose paths and executables are determined by the customer at runtime. This is a core functional requirement of AXQA Smart Agent rather than a request for classic confinement merely to simplify packaging. The same Smart Agent is also distributed as a native Linux package, and the classic Snap build has been successfully built, installed, and functionally tested locally. Local installation used: sudo snap install AXQA-SmartAgent_1.2.1_amd64.snap --classic --dangerous The application operated correctly under classic confinement. We are happy to provide additional technical details, testing information, or examples of the required host interactions if needed.

I understand that strict confinement is generally preferred over classic

I’ve tried the existing interfaces to make the snap to work under strict confinement.

2

This request has been added to the queue for review by the @reviewers team.

3

Hello,

I hope you are doing well.

I would like to kindly follow up and check if there are any updates regarding this request, or if there is anything else you need from my side to assist with the review.

Thank you very much for your time and support.

Have a great day.

4

Hello,

Thank you for the detailed request and apologies for the delay! While I agree this does not fall under an explicit supported-category, I believe it is a candidate for the potentially-supported use case of “running arbitrary command (esp if user-configurable such as a developer tool to organize dev environments)”. But this will require a manual override from an architect to be granted.

To support your claim, can you provide some concrete examples of use cases where classic confinement is necessary? Additionally, if you can, it would be helpful if you could provide any links to information about the product and company distributing the snap.

Lastly, classic snaps vary from strict snaps in that there is added complexity to ensuring they work reliably across distributions. Can you provide a detailed outline of how you address this complexity for your snap, and a description of your testing plan that validates cross-distro functionality?

Thank you.

5

Hello,

Thank you for reviewing the request and for considering AXQA Smart Agent for classic confinement.

I would like to clarify the primary purpose and security model of the Smart Agent, as this may help with the review.

AXQA Smart Agent is the local execution component of the AXQA QA platform.

Instead of executing an API test from AXQA’s cloud infrastructure, the Smart Agent allows the authorized test to be executed directly from the customer’s own machine and network environment.

This is important for customers who need to test services that are not publicly accessible, for example:

APIs available only inside the customer’s private network

Services reachable only through the customer’s VPN

Internal development or staging environments

localhost services

Devices or services available only on the customer’s LAN

Internal endpoints protected by firewalls or network access policies

This allows customers to test internal systems without exposing those systems to the public Internet.

The general flow is:

AXQA Platform→ sends an authorized API test execution request→ AXQA Smart Agent validates the request against its configured Zero Trust policy→ the Smart Agent executes the permitted request locally from the customer’s environment→ the result is returned to the AXQA platform

The Smart Agent is not designed as a general-purpose arbitrary command or unrestricted network execution tool.

Local execution is controlled by the customer’s configured Zero Trust policy. Requests that are not authorized by the configured policy are not permitted to execute.

Our reason for evaluating classic confinement is to ensure that the Smart Agent operates using the customer’s actual host networking environment and can reliably access the same private network, VPN, local services, DNS configuration, and internal resources that the customer intends to test.

We are also evaluating whether strict confinement together with the available Snap interfaces can fully support these requirements. If strict confinement can provide the required networking behavior without limiting the intended functionality of the Smart Agent, we are happy to use strict confinement instead.

Product and company information:

Product:AXQA Smart Agent

Company:AXQA TECHNOLOGY LTDA

Website: https://axqa.ai

Documentation: https://docs.axqa.ai/

AXQA TECHNOLOGY LTDA is the developer, owner, maintainer, and publisher of AXQA Smart Agent.

Regarding testing and cross-distribution compatibility:

The current Snap has been successfully built, installed, and functionally tested on Ubuntu.

Before releasing a production revision to the stable channel, we plan to validate the Smart Agent on supported Ubuntu LTS versions and additional snapd-supported Linux distributions such as Debian, Fedora, and Linux Mint.

The compatibility testing will focus on:

installation and application startup

connection to the AXQA platform

execution of authorized API tests from the local environment

access to localhost and private-network services

access to services through the customer’s VPN/network environment

Zero Trust policy enforcement

result reporting back to AXQA

restart and update behavior

We will not claim compatibility with distributions that we have not tested.

If you believe the required networking behavior can be fully supported using strict confinement and specific interfaces, we would appreciate guidance on the recommended interfaces so we can evaluate that approach before requesting an architect override.

Thank you again for your assistance and review.

6

Hello Elise,

I hope you are doing well.

I just wanted to kindly follow up on the classic confinement review for AXQA Smart Agent.

As a small product update, AXQA Smart Agent has now also been approved and published on the Microsoft Store:

https://apps.microsoft.com/detail/9n4s1x76b0sg

I completely understand that the classic confinement request requires additional review and a manual architect override, so I just wanted to check whether there have been any updates or if there is any additional technical information, testing detail, or documentation that I can provide to help with the review.

Thank you again for your time and support. I really appreciate it.

Have a great day!