Add inactive sandbox-policy evaluator - #212
Conversation
Codex reviewer (cross-vendor, read-only)Reviewed-head: 56beaec BugsNo findings. The complete shell driver, jq evaluator, policy, decision, documentation, manifest change, and all 46 focused cases were reviewed. Canonical parsing rejects BOMs, multiple roots, noncanonical input, oversized or deep input, unknown fields, invalid paths, and malformed types. Exact ceilings cover environment, filesystem, resources, tools, limits, network, isolation, sensitive material, target writes, and external writes. Violation precedence dominates inconclusive state. Duty violations, inconclusive duty evidence, stale policy-set relations, and stale stage-result relations fail closed. Output is canonical and deterministic with sorted unique reason identifiers and content-bound references. The exact-head targeted proof passed all 46 cases. SecurityNo findings. Caller documents enter jq only as data. The driver rejects nonphysical and final-symlink paths, snapshots dependencies and inputs into private scratch, and rechecks live identities before emitting output. The jq executable is absolute, fixed to the accepted jq 1.6 digest, privately snapshotted, and revalidated. The mirrored policy-set validator runs under a clean environment with private jq-first PATH and digest-bound identities. A self-consistent caller policy-set cannot masquerade as enforcement or qualified provenance: the output binds those exact supplied identities and is permanently inactive, observation-only, declaration-only, with authority and qualification effects set to none. This unit executes no tool, candidate, or adapter; reads no credential; makes no network request; activates no profile; and performs no target, publish, deploy, or external write. ComplianceNo findings. The exact diff is one bounded Roadmap item 2 concern across eight declared paths. Restore-manifest additions are append-only. Constitution, workflow, construction-mode, frozen-plan, and forbidden paths are untouched. Documentation distinguishes declaration satisfaction from effective sandbox enforcement or qualification. Required app-15368 CI run 33521427395 and check 99901385553 succeeded on this exact head/base. Branch ancestry preserves the prepared commits and merges current main without rebase or rewrite. No exceptional implementation or scope expansion was found. |
|
Construction merge receipt
Postflight verified squash-only ancestry, exact tree equality, and the main ref. |
1 participant
What this adds
This adds the inactive sandbox-policy evaluator from Roadmap item 2. It checks an
identity-bound execution-environment claim against the fixed sandbox ceiling and
returns a canonical
satisfied,violated, orinconclusiveobservation.It also documents the inactive boundary and appends the five restore-critical
files to the manifest.
Exact candidate
6a46c62f85e8dcf1d0e169f468956bb68634930456beaecd65c5e6aa611fc987602e48973217808cThe diff is limited to these eight paths:
README.mdRESTORE.mdci/required-files.txtcontrol/v1/evaluate-sandbox.shcontrol/v1/sandbox-decision.jsoncontrol/v1/sandbox-policy.jsoncontrol/v1/sandbox.jqscripts/test/control-sandbox-policy.test.shLocal proof on the exact head
bash scripts/test/control-sandbox-policy.test.sh: 46 focused checks passed.whitespace, exact-path, and clean-worktree checks passed.
The targeted matrix executes the mirrored policy-set validator and validates the
duty result used by this evaluator. Risk-gates and kill-switch are separate
control sections and are not runtime dependencies of this unit.
Inactive boundary
This is repo-only construction. A
satisfieddeclaration does not prove that areal sandbox enforced the claim and grants no authority, qualification, or
permission. This change runs no candidate or adapter, reads no credential,
activates no profile, and performs no network, publish, release, install, deploy,
target-write, or external-write action.