[Phase 0][WP7D] Activate bounded operator-snapshot Chroma detection and atomic report finalization

.github/workflows/wp7d-snapshot-chroma.yml

@@ -0,0 +1,241 @@
+name: WP7D operator-snapshot Chroma activation
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  wp7d-snapshot-activation:
+    name: WP7D / ${{ matrix.platform }} / Python ${{ matrix.python }} / Chroma ${{ matrix.chroma }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            platform: Linux-ext4
+            python: "3.10"
+            chroma: "1.5.9"
+          - os: ubuntu-latest
+            platform: Linux-ext4
+            python: "3.11"
+            chroma: "1.5.9"
+          - os: ubuntu-latest
+            platform: Linux-ext4
+            python: "3.12"
+            chroma: "1.5.9"
+          - os: macos-15
+            platform: macOS15-APFS
+            python: "3.12"
+            chroma: "1.5.9"
+          - os: windows-latest
+            platform: Windows-NTFS
+            python: "3.12"
+            chroma: "1.5.9"
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up exact Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python }}
+
+      - name: Install exact public candidate and evidence inputs
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install ".[chroma-snapshot,detect,dev]" "chromadb==${{ matrix.chroma }}"
+          python -m spacy download en_core_web_sm
+          python -m pip check
+          python -m pip list --format=freeze --disable-pip-version-check
+          python -c "import importlib.metadata,sys; assert sys.version_info[:2] == tuple(map(int, '${{ matrix.python }}'.split('.'))); assert importlib.metadata.version('chromadb') == '${{ matrix.chroma }}'"
+
+      - name: Prepare explicitly mounted native ext4 volume
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          sudo useradd --system --user-group --no-create-home --shell /usr/sbin/nologin rlgwp7d
+          test_user=rlgwp7d
+          test_uid="$(id -u "${test_user}")"
+          test "${test_uid}" != "$(id -u)"
+          echo "RLG_WP7D_TEST_USER=${test_user}" >> "${GITHUB_ENV}"
+          echo "RLG_WP7D_TEST_UID=${test_uid}" >> "${GITHUB_ENV}"
+          truncate -s 2G "${RUNNER_TEMP}/rlg-wp7d-ext4.img"
+          mkfs.ext4 -q -F "${RUNNER_TEMP}/rlg-wp7d-ext4.img"
+          sudo mkdir -p /mnt/rlg-wp7d-ext4
+          sudo mount -o loop "${RUNNER_TEMP}/rlg-wp7d-ext4.img" /mnt/rlg-wp7d-ext4
+          sudo mkdir /mnt/rlg-wp7d-ext4/home
+          sudo mkdir /mnt/rlg-wp7d-ext4/repository
+          git archive --format=tar HEAD | sudo tar -xf - -C /mnt/rlg-wp7d-ext4/repository
+          sudo chown -R "${test_user}:${test_user}" /mnt/rlg-wp7d-ext4
+          sudo -u "${test_user}" test -r /mnt/rlg-wp7d-ext4/repository/pyproject.toml
+          test "$(findmnt -n -o FSTYPE /mnt/rlg-wp7d-ext4)" = ext4
+
+      - name: Assert native APFS
+        if: runner.os == 'macOS'
+        shell: bash
+        run: |
+          test "$(sw_vers -productVersion | cut -d. -f1)" = 15
+          device="$(df "${RUNNER_TEMP}" | awk 'END {print $1}')"
+          test -n "${device}"
+          diskutil info "${device}" | grep -Eiq 'File System Personality:.*APFS'
+
+      - name: Assert native NTFS
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $drive = [IO.Path]::GetPathRoot($env:RUNNER_TEMP).Substring(0, 1)
+          $volume = Get-Volume -DriveLetter $drive
+          if ($volume.FileSystem -ne 'NTFS') { throw 'Required NTFS evidence is absent.' }
+
+      - name: Deny outbound traffic for the test identity
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          test -n "${RLG_WP7D_TEST_UID}"
+          sudo iptables -I OUTPUT 1 -m owner --uid-owner "${RLG_WP7D_TEST_UID}" -j REJECT
+          sudo iptables -I OUTPUT 1 -o lo -j ACCEPT
+          sudo iptables -C OUTPUT -o lo -j ACCEPT
+          sudo iptables -C OUTPUT -m owner --uid-owner "${RLG_WP7D_TEST_UID}" -j REJECT
+
+      - name: Deny outbound traffic for the Python worker
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $rule = "RLG-WP7D-$env:GITHUB_RUN_ID-$env:GITHUB_RUN_ATTEMPT"
+          $python = (Get-Command python).Source
+          New-NetFirewallRule -DisplayName $rule -Direction Outbound -Program $python -Action Block -Profile Any | Out-Null
+          "RLG_WP7D_FIREWALL_RULE=$rule" >> $env:GITHUB_ENV
+          $observed = Get-NetFirewallRule -DisplayName $rule
+          if ($observed.Enabled.ToString() -ne 'True' -or $observed.Action.ToString() -ne 'Block') {
+            throw 'Required Windows outbound-denial evidence is absent.'
+          }
+
+      - name: Run focused WP7D evidence on native ext4 with OS egress denial
+        if: runner.os == 'Linux'
+        shell: bash
+        env:
+          ANONYMIZED_TELEMETRY: "False"
+          PYTHONWARNINGS: ignore
+          RLG_REQUIRE_NATIVE_SNAPSHOT_FS: "1"
+          RLG_WP7C_COMPATIBILITY: "1"
+          RLG_WP7C_OS_EGRESS_DENIED: "1"
+          RLG_WP7D_ACTIVATION: "1"
+          RLG_WP7D_MANDATORY: "1"
+          RLG_WP7D_OS_EGRESS_DENIED: "1"
+          TMPDIR: /mnt/rlg-wp7d-ext4
+        run: |
+          python_path="$(command -v python)"
+          cd /mnt/rlg-wp7d-ext4/repository
+          sudo --preserve-env=ANONYMIZED_TELEMETRY,PYTHONWARNINGS,RLG_REQUIRE_NATIVE_SNAPSHOT_FS,RLG_WP7C_COMPATIBILITY,RLG_WP7C_OS_EGRESS_DENIED,RLG_WP7D_ACTIVATION,RLG_WP7D_MANDATORY,RLG_WP7D_OS_EGRESS_DENIED,TMPDIR \
+            -u "${RLG_WP7D_TEST_USER}" env HOME=/mnt/rlg-wp7d-ext4/home \
+            "${python_path}" -m pytest tests/test_wp7d_snapshot_activation.py tests/test_chroma_snapshot_private.py -q --basetemp /mnt/rlg-wp7d-ext4/focused
+
+      - name: Run complete suite on native ext4 with OS egress denial
+        if: runner.os == 'Linux'
+        shell: bash
+        env:
+          ANONYMIZED_TELEMETRY: "False"
+          PYTHONWARNINGS: ignore
+          RLG_REQUIRE_NATIVE_SNAPSHOT_FS: "1"
+          RLG_WP7C_COMPATIBILITY: "1"
+          RLG_WP7C_OS_EGRESS_DENIED: "1"
+          RLG_WP7D_ACTIVATION: "1"
+          RLG_WP7D_MANDATORY: "1"
+          RLG_WP7D_OS_EGRESS_DENIED: "1"
+          TMPDIR: /mnt/rlg-wp7d-ext4
+        run: |
+          python_path="$(command -v python)"
+          cd /mnt/rlg-wp7d-ext4/repository
+          sudo --preserve-env=ANONYMIZED_TELEMETRY,PYTHONWARNINGS,RLG_REQUIRE_NATIVE_SNAPSHOT_FS,RLG_WP7C_COMPATIBILITY,RLG_WP7C_OS_EGRESS_DENIED,RLG_WP7D_ACTIVATION,RLG_WP7D_MANDATORY,RLG_WP7D_OS_EGRESS_DENIED,TMPDIR \
+            -u "${RLG_WP7D_TEST_USER}" env HOME=/mnt/rlg-wp7d-ext4/home \
+            "${python_path}" -m pytest -q --basetemp /mnt/rlg-wp7d-ext4/complete
+
+      - name: Run focused WP7D evidence on APFS with OS egress denial
+        if: runner.os == 'macOS'
+        shell: bash
+        env:
+          ANONYMIZED_TELEMETRY: "False"
+          PYTHONWARNINGS: ignore
+          RLG_REQUIRE_NATIVE_SNAPSHOT_FS: "1"
+          RLG_WP7C_COMPATIBILITY: "1"
+          RLG_WP7C_OS_EGRESS_DENIED: "1"
+          RLG_WP7D_ACTIVATION: "1"
+          RLG_WP7D_MANDATORY: "1"
+          RLG_WP7D_OS_EGRESS_DENIED: "1"
+        run: sandbox-exec -p '(version 1) (allow default) (deny network*)' python -m pytest tests/test_wp7d_snapshot_activation.py tests/test_chroma_snapshot_private.py -q --basetemp "${RUNNER_TEMP}/rlg-wp7d-focused"
+
+      - name: Run complete suite on APFS with OS egress denial
+        if: runner.os == 'macOS'
+        shell: bash
+        env:
+          ANONYMIZED_TELEMETRY: "False"
+          PYTHONWARNINGS: ignore
+          RLG_REQUIRE_NATIVE_SNAPSHOT_FS: "1"
+          RLG_WP7C_COMPATIBILITY: "1"
+          RLG_WP7C_OS_EGRESS_DENIED: "1"
+          RLG_WP7D_ACTIVATION: "1"
+          RLG_WP7D_MANDATORY: "1"
+          RLG_WP7D_OS_EGRESS_DENIED: "1"
+        run: sandbox-exec -p '(version 1) (allow default) (deny network*)' python -m pytest -q --basetemp "${RUNNER_TEMP}/rlg-wp7d-complete"
+
+      - name: Run focused WP7D evidence on NTFS with OS egress denial
+        if: runner.os == 'Windows'
+        shell: pwsh
+        env:
+          ANONYMIZED_TELEMETRY: "False"
+          PYTHONWARNINGS: ignore
+          RLG_REQUIRE_NATIVE_SNAPSHOT_FS: "1"
+          RLG_WP7C_COMPATIBILITY: "1"
+          RLG_WP7C_OS_EGRESS_DENIED: "1"
+          RLG_WP7D_ACTIVATION: "1"
+          RLG_WP7D_MANDATORY: "1"
+          RLG_WP7D_OS_EGRESS_DENIED: "1"
+        run: python -m pytest tests/test_wp7d_snapshot_activation.py tests/test_chroma_snapshot_private.py -q --basetemp "$env:RUNNER_TEMP/rlg-wp7d-focused"
+
+      - name: Run complete suite on NTFS with OS egress denial
+        if: runner.os == 'Windows'
+        shell: pwsh
+        env:
+          ANONYMIZED_TELEMETRY: "False"
+          PYTHONWARNINGS: ignore
+          RLG_REQUIRE_NATIVE_SNAPSHOT_FS: "1"
+          RLG_WP7C_COMPATIBILITY: "1"
+          RLG_WP7C_OS_EGRESS_DENIED: "1"
+          RLG_WP7D_ACTIVATION: "1"
+          RLG_WP7D_MANDATORY: "1"
+          RLG_WP7D_OS_EGRESS_DENIED: "1"
+        run: python -m pytest -q --basetemp "$env:RUNNER_TEMP/rlg-wp7d-complete"
+
+      - name: Remove Windows outbound-denial rule
+        if: always() && runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          if ($env:RLG_WP7D_FIREWALL_RULE) {
+            Remove-NetFirewallRule -DisplayName $env:RLG_WP7D_FIREWALL_RULE
+          }
+
+      - name: Remove Linux outbound-denial rule
+        if: always() && runner.os == 'Linux'
+        shell: bash
+        run: |
+          sudo iptables -D OUTPUT -o lo -j ACCEPT || true
+          if [ -n "${RLG_WP7D_TEST_UID:-}" ]; then
+            sudo iptables -D OUTPUT -m owner --uid-owner "${RLG_WP7D_TEST_UID}" -j REJECT || true
+          fi
+
+      - name: Unmount and remove native ext4 volume
+        if: always() && runner.os == 'Linux'
+        shell: bash
+        run: |
+          sudo umount /mnt/rlg-wp7d-ext4 || true
+          sudo rmdir /mnt/rlg-wp7d-ext4 || true
+          rm -f "${RUNNER_TEMP}/rlg-wp7d-ext4.img"
+          if [ -n "${RLG_WP7D_TEST_USER:-}" ]; then
+            sudo userdel "${RLG_WP7D_TEST_USER}" || true
+          fi

CONTRIBUTING.md

@@ -64,26 +64,30 @@ A locale contribution must:
 
 ## Connectors and integrations
 
-**Implemented now:** no source-scanning connector is available. Direct local Chroma entry points fail closed before Chroma import or source access. [Issue #15](https://github.com/Agenvana/RAGLeakGuard/issues/15) was deferred as `not planned`, not completed. Executable endpoint evidence established durable mutation with ChromaDB 1.5.0 and 1.5.9; other versions have not established an acceptable read-only boundary.
-
-Snapshot-backed Chroma scanning remains unavailable. WP7B contains the private, bounded
-filesystem-confinement foundation for a complete snapshot that the operator created separately.
-WP7C privately evaluates exact candidate dependencies inside a held WP7B work copy and returns only
-an opaque counter receipt after bounded two-pass enumeration, teardown, semantic revalidation, and
-effect classification. It exposes no source rows or detector input and is not detector or scan
-completion. Neither layer proves quiescence or atomic multi-file consistency or exposes a public
-function, CLI, connector, package extra, report, monitor, or webhook path.
-
-Do not activate or extend these private layers into a scanning surface, claim a supported Chroma
-range, or commit to future support without a separate WP7D issue, executable evidence, exact-commit
-independent review, and human authorization. PyPI 0.1.0 contains the unsafe direct Chroma path and
-must not be used for Chroma scanning.
+**Implemented now:** one aggregate-only operator-snapshot Chroma connector is available for exact
+ChromaDB 1.5.9 on Linux/ext4 Python 3.10–3.12, macOS 15/APFS Python 3.12, and Windows/NTFS Python
+3.12. Direct/live Chroma entry points remain disabled and fail closed before Chroma import or source access.
+[Issue #15](https://github.com/Agenvana/RAGLeakGuard/issues/15) was deferred as `not planned`, not
+completed. Executable endpoint evidence established durable mutation with ChromaDB 1.5.0 and 1.5.9;
+1.5.0 remains private evidence only and every other version is rejected publicly.
+
+WP7D consumes a held WP7B work copy through WP7C's bounded two-pass enumeration and runs detection
+inside the isolated worker. It exposes bounded connector counters and detector entity-type counts
+only after exact equality, teardown, semantic/capability revalidation, proven cleanup, and atomic
+aggregate-report finalization. The operator—not RAGLeakGuard—must create a complete,
+quiescent/full-filesystem snapshot separately. The implementation does not prove provenance,
+quiescence, completeness, or atomic multi-file consistency. Monitor new scans remain unavailable.
+
+Do not widen the version/environment matrix, limits, IPC/report surface, retry policy, or connector
+scope without a separate issue, executable evidence, exact-commit independent review, and human authorization.
+PyPI 0.1.0 contains the unsafe direct Chroma path and must not be used for Chroma
+scanning; no corrective release has been published.
 
 The private foundation passed independent review at exact implementation head
 `128decb3e0d78825e884f6dce019898b568c6ba2` and was merged through
 [PR #20](https://github.com/Agenvana/RAGLeakGuard/pull/20) as merge commit
-`5db765689d35eec8ba918f0f616d5fea34e56955`. That review record does not authorize a public
-snapshot consumer, direct Chroma access, a release, or WP7D.
+`5db765689d35eec8ba918f0f616d5fea34e56955`. That review record does not authorize direct/live
+Chroma access, a release, or any expansion beyond the finite WP7D boundary.
 
 Changes to the private snapshot lifecycle must preserve its hard maxima, no-follow regular-object
 allowlist, same-device containment, observed-stability checks, restrictive work permissions,
@@ -97,6 +101,12 @@ pagination and canonicalization, keyed bounded manifests, worker termination bef
 static privacy-safe failures, zero child output, OS egress evidence, and explicit classification of
 all work-copy effects. Run its isolated candidate matrix as well as the complete no-Chroma suite.
 
+Changes to the public WP7D surface must preserve aggregate-only results, first-pass-only detection,
+exact connector/detector count equality, pre-source acknowledgement/locale/source-ID/runtime/host
+gates, exact ChromaDB 1.5.9 activation, report atomicity, cleanup-before-result ordering, recursive
+privacy canaries, and all five mandatory native-filesystem cells. Keep the ten-cell WP7C private
+matrix intact.
+
 Any future connector change requires an independently reviewed read-only boundary and must test application and dependency effects, bounds, completeness, malformed input, cancellation, concurrent mutation, filesystem mutation, and outbound network behavior. An incomplete or inconsistent scan must never report success.
 
 Integrations must not emit raw detected values. Any metadata egress needs a documented allowlist and threat-model update.