[Phase 0][WP7D] Activate bounded operator-snapshot Chroma detection and atomic report finalization

[Agenvana]

Closes #24

Security objective

Activate one-shot Chroma detection only from a complete offline/full-filesystem snapshot created separately by the operator. Direct/live Chroma access and monitor new scans remain disabled.

Starting SHA: d3a5145baaee86c17441cc431b934cc42ac8a076
Reviewed head corrected: 3ca740328bef7a9c5a77c95f51ef712098c48aa3
Correction commit and corrected immutable head: 18d6ea5d2265eb5dab8e421061416ba1f2e02448

Scope

• Adds an aggregate-only public snapshot API; no raw-record or partial iterator.
• Publicly gates exact ChromaDB 1.5.9 to Linux/ext4 Python 3.10–3.12, macOS 15/APFS Python 3.12, and Windows/NTFS Python 3.12.
• Preserves synchronous opaque-argument read_chroma() denial, the private WP7C 1.5.0/1.5.9 evidence path, and the existing ten-cell WP7C workflow.
• Runs detection once per first-pass canonical source segment inside the isolated Chroma worker; the second pass independently verifies keyed identity/content/completeness.
• Returns only bounded connector counters and validated entity-type counts after exact equality, worker termination/revalidation, and cleanup.
• Adds restrictive bounded same-directory report finalization with file fsync, atomic replacement, directory durability where supported, identity checks, and fail-closed rollback.
• Keeps Chroma out of base dependencies and adds only chroma-snapshot = ["chromadb==1.5.9"].
• Updates English and Traditional Chinese claims without changing package version or release state.

Fable correction pass

Fable identified two material findings against reviewed head 3ca740328bef7a9c5a77c95f51ef712098c48aa3:

• M-1 — retained path-bearing exception chains: report and public connector boundaries now recursively scrub exception types, messages, representations, arguments, filename/filename2, causes, contexts, tracebacks, and nested exception groups. Static public failures are raised only after leaving the original exception handler.
• M-2 — filesystem gate occurred after source copy: public activation now validates the work-parent directory, native filesystem identity, exact dependency version, OS, Python, architecture, and the approved tuple before snapshot preparation or any source traversal/copy. The same tuple is revalidated against the actual isolated work copy.

No code changes were made for Fable's informational observations 2–6; they remain outside this narrowly scoped correction pass.

Numeric decision

The deterministic synthetic measurements and selected values are recorded in Issue #24 comment 5302549996. Selected ceilings: 1,000 collections; 10,000 records; 100,000 segments; 268,435,456 detector UTF-8 bytes; 65,536 bytes/segment; 4,096 findings/segment; 1,000,000 findings; 64 entity types; 16,384-byte detector response; 1,048,576-byte report; 30-second report finalization; existing 1,200-second worker maximum; zero automatic retries.

Correction validation

Deliberate correction red baseline, with regression tests applied to the reviewed production head: 14 failed, 102 deselected. The failures demonstrated the five retained report exception graphs, retained dependency exception graph, three unsupported-filesystem pre-source violations, and five missing approved-tuple cases.

Green local evidence at corrected head 18d6ea5d2265eb5dab8e421061416ba1f2e02448:

• The original 14 correction regressions pass; the final expanded recursive-graph set is 15 passed, 102 deselected.
• Focused WP7D, private Chroma, WP7B, and fail-closed coverage: 323 passed, 43 skipped.
• Exact ChromaDB 1.5.9 Windows/NTFS synthetic public scan: 1 passed (one upstream deprecation warning); source hashes unchanged; work directory empty.
• Exact candidate profile: pip check clean; complete suite 649 passed, 43 skipped.
• Chroma-free detect/dev profile: chromadb absent; pip check clean; complete suite 649 passed, 43 skipped.
• Python AST (25 files), all 3 workflow YAML files, and pyproject.toml parse successfully.
• Repository-relative Markdown links and git diff --check pass.
• Recursive privacy canaries, secret/path-canary checks, and residue scans are clean.
• The existing WP7C workflow is byte-for-byte unchanged; Git blob ID remains d3d0dc8f0f29d0131ff152a3f07dcb579b391584; SHA-256 is d2ae97dda65d9058d05777f414605f1867324c5a58ac2db4169cfaf99a38b584.

Fresh exact-head GitHub evidence is green:

• WP7D run 31928232041: all 5 mandatory cells passed.
• Private WP7C run 31928231922: all 10 unchanged cells passed.
• Baseline CI run 31928231952: all 4 cells passed.

The WP7D matrix covers Linux/ext4 Python 3.10–3.12, macOS 15/APFS Python 3.12, and Windows/NTFS Python 3.12 with ChromaDB 1.5.9. Every successful cell records its resolved environment, dependency consistency, native-filesystem identity, OS-level egress denial, focused evidence, and applicable complete suite. Transitive dependencies and runner images are not claimed to be locked.

Boundaries and residual risks

The operator—not RAGLeakGuard—must create a complete, quiescent/full-filesystem snapshot. The acknowledgement does not prove provenance, quiescence, completeness, or transactional atomicity. Detection is best-effort; absence of findings is not proof of safety or compliance. Python interception is not a general sandbox, native calls may block below cooperative deadlines, transitive dependencies and runner images may regress, crashes can leave cleanup residue requiring investigation, deletion is not certified erasure, and directory durability is unavailable on some platforms/filesystems.

PyPI 0.1.0 remains unsafe for Chroma scanning. No corrective release has been published. This PR does not authorize release, publication, direct/live access, monitor activation, later work packages, approval, readiness, or merge.

Review

Keep this PR draft. Required next action after all checks pass: fresh independent security re-review of the corrected immutable head by Fable.

[Agenvana]

Independent security review record — Fable PASS FOR FINAL REVIEW

This PR conversation comment records Fable's independent final security result. It is not a formal GitHub approval, and no approval review is being submitted on behalf of the PR author.

• Approved base/start SHA: d3a5145baaee86c17441cc431b934cc42ac8a076
• Exact independently reviewed head: 18d6ea5d2265eb5dab8e421061416ba1f2e02448
• Findings: 0 blocking, 0 material, 3 informational; none of the informational observations was introduced by the correction
• Material corrections: M-1 closed, M-2 closed
• Verdict: the corrected head is eligible for the maintainer review-record, ready-for-review, and merge decision

Exact-head workflow evidence remains green:

• Baseline CI 31928231952: 4/4 passed
• WP7D 31928232041: 5/5 passed
• Private WP7C 31928231922: 10/10 passed