Harden inbox service and close visual receipts

[evanfollis]

What changed

• version and install a mandatory-baseline synaplex-inbox.service using a dedicated identity, empty capabilities, strict read-only filesystem protection, private temp/devices, kernel and namespace protections, and localhost-only cgroup networking
• enforce those controls in the deterministic deployment-contract check
• record the exact-unit canary, durable rollback artifact, installed outcome, independent operator verification, and smallest dated PrivateNetwork exception
• document the rejected no-Preflight Tailwind 4 regression and the accepted final screenshot comparison
• strengthen Cadence verification from status-only to exact title, canonical, content-boundary, byte-count, and digest witnesses on apex and immutable deployment
• update CURRENT_STATE.md with the converged runtime and route state

Why

The live inbox service was still root-running with full capabilities and no mandatory sandbox controls. Separately, an early Tailwind 4 candidate and a propagation-edge Cadence response showed why visual and route identity must be verified rather than inferred from build success or HTTP 200.

Outcome

The exact hardened unit passed a reversible canary and permanent transactional install. The nonce-scoped payload remained byte-identical, the service is active with zero observed restarts, the central containment auditor reports zero findings, and systemd-analyze security improved from 9.6 UNSAFE to 1.3 OK. Fresh apex and immutable Cadence bodies are identical and route-specific.

Checks

• PATH=/root/.nvm/versions/node/v24.18.0/bin:$PATH make check
• 54 Python tests
• 19/19 external canon conformance fixtures
• canon/programme guards and two governed prompt baselines
• projection generation and strict packaging/schema validation
• 24-page Astro 7.1.3 build under Node 24.18.0
• expanded deployment-contract check
• systemd-analyze verify deploy/synaplex-inbox.service
• exact-unit loopback canary and permanent payload comparison
• central runtime containment audit: 0 findings
• final Chromium before/after screenshot comparison and visual inspection
• exact external Cadence identity checks on custom and immutable origins

[Copilot]

Pull request overview

This PR hardens the synaplex-inbox.service systemd unit (dedicated user/group, strict sandboxing, localhost-only egress, and read-only filesystem posture) and strengthens verification/receipts so operational identity and visual correctness are proven by explicit witnesses (not inferred from 200s or build success).

Changes:

• Add a hardened deploy/synaplex-inbox.service baseline unit and enforce its required sandbox directives in scripts/check_deploy_contract.py.
• Add operational receipts documenting the inbox hardening canary/rollback/verification and the Tailwind/visual/Cadence identity verification outcomes.
• Update CURRENT_STATE.md to reflect the verified runtime and route state.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
scripts/check_deploy_contract.py	Adds inbox-specific deployment-contract assertions for the hardened unit.
deploy/synaplex-inbox.service	Introduces the hardened systemd unit configuration for the inbox server.
docs/inbox-service-hardening-2026-07.md	Records the operational hardening canary, rollback boundary, and observed outcome.
docs/dependency-migration-2026-07.md	Documents the rejected Tailwind 4 no-Preflight candidate and final visual/Cadence checks.
CURRENT_STATE.md	Updates the front-door state to include the verified Cadence identity and inbox hardening status.

Comments suppressed due to low confidence (1)

scripts/check_deploy_contract.py:59

• The inbox contract check currently relies on finding "CapabilityBoundingSet=\n" / "AmbientCapabilities=\n" substrings via INBOX_REQUIRED, which makes the validation depend on the unit file’s newline format and doesn’t explicitly reject non-empty values if an empty line is also present. It’s more robust to validate these directives line-by-line (whitespace/CRLF tolerant) and reject any non-empty assignments.

        for requirement in INBOX_REQUIRED:
            if requirement not in text:
                errors.append(
                    f"synaplex-inbox.service: missing {requirement.rstrip()}"
                )

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.