Isolate patch verification effects (ticket-449)

[tom-sapletta-com]

Patch verification previously ran candidate code in an ordinary host shell. Baseline, staged and in-place verification now use a mandatory Linux bubblewrap/seccomp boundary: source and host mounts are read-only, fresh repository-owned scratch is writable, inherited environment is cleared, and network/Unix socket and namespace escape syscalls are denied. Missing support refuses execution.

Transaction unit tests use explicit verifier doubles; separate kernel tests exercise the real wrapper and a real patch rollback after a denied write. Native-admission fixtures now include their actual project manifest.

Validation: 314 focused/transaction tests plus 22 subtests passed, including kernel denials for source/sibling/tmp writes, traversal, symlinks, hardlinks, descendants and sockets. The required critical suite passed 257 tests; Ruff and managed governance pass.

Known baseline limits: two provider failures and five execution-plan fixture errors exist in the wider queue suite. The local MCP Redup command-shape test also fails on baseline with the installed tool version. Foreign active ticket-446 owns the provider work and was preserved. The full repository suite is not claimed clean.

Ticket-449; parent Maskservice PLF-15923. Linux system bubblewrap and libseccomp are required, and verification is offline. This is verification write/IPC isolation; it grants no editing, lease or publication authority and makes no secret-read, global LLM, MCP or deployment claim. Required exact-head OneDev and independent Validator evidence remain separate.

[ifuri-validator-agent]

Validation rejected:

• Patch contains unsafe validation shortcut: pytest.skip

[ifuri-validator-agent]

Validation rejected:

• Patch contains unsafe validation shortcut: pytest.skip

[ifuri-validator-agent]

Validator approval after policy checks for exact head 1d565cd8199b5739ab3ee9dfb29b54c5a718f0dd.

Ticket: ticket-449
Correlation ID: local-semcod-koru-pr-708-ticket-449
Model: openai/cursor-auto
Reviewed diff chunks: 3
Advisory LLM verdict: BLOCK
Advisory summary: Reviewed all 3 diff chunk(s). The visible chunk consistently routes baseline, staged, and in-place verification through the mandatory sandbox wrapper. In-place verification converts sandbox/setup exceptions into verification failure, and the protected required checks all pass. No independently evidenced defect or security vulnerability is visible in this chunk. | Required checks pass, and the visible tests exercise fail-closed backend handling plus write and socket denial. However, the sandbox exposes the host filesystem read-only to untrusted verification code, creating a confidentiality breach despite preventing mutation and network access. | The visible chunk adds kernel-boundary and transaction rollback coverage for denied verifier writes and updates command-shape verification for the sandbox wrapper. No unresolved code or security defect is evident in this chunk. All protected required checks passed.
Advisory findings: The --ro-bind / / mount exposes the entire host filesystem to candidate verification code. Clearing the environment and changing HOME does not prevent explicit reads of host credentials, keys, configuration, or other sensitive files under paths such as /home, /root, and service directories. Candidate code can emit those contents through captured stdout/stderr, so socket denial does not prevent exfiltration into logs or verification results. Bind only the runtime dependencies and project content required for verification, or mask sensitive host paths with empty/read-only replacements.
The LLM output above is advisory and was not used as the approval trust root.
Semantic review prerequisite: not_required; policy 676cb4516bbfed2a000e40b9b1b6e4a430ecc761ec546aeb53d721a1905cfdd7.

Actual PR impact radar

Exact range: febdb1e2beac504e7ca939b89537f9c507d5dcc5...1d565cd8199b5739ab3ee9dfb29b54c5a718f0dd
Change digest: 5e6e955b98276db376309022a336fa54242bfc8ec4b577a486aac9aead4c1c19
Score: 72/100 (L), estimated 112 min, split recommended: true
Affected services/components: repository-wide/unclassified

Machine-readable radar JSONL and SVG

{"actual_change":{"additions":450,"base_sha":"febdb1e2beac504e7ca939b89537f9c507d5dcc5","binary_files":0,"categories":{"code":3,"configuration":1,"docs":2,"tests":4},"change_digest":"5e6e955b98276db376309022a336fa54242bfc8ec4b577a486aac9aead4c1c19","comparison":"febdb1e2beac504e7ca939b89537f9c507d5dcc5...1d565cd8199b5739ab3ee9dfb29b54c5a718f0dd","deletions":4,"file_count":10,"files":["project/TICKETS.md","project/ticket-449/README.md","project/ticket-449/intent.json","src/koru/queue/transaction/service.py","src/koru/queue/transaction/staging.py","src/koru/queue/verification_sandbox.py","tests/test_planfile_queue.py","tests/test_queue_governed_patch_admission.py","tests/test_queue_verification_sandbox.py","tests/test_queue_verify_profiles.py"],"head_sha":"1d565cd8199b5739ab3ee9dfb29b54c5a718f0dd","service_count":0,"services":[]},"assessment_mode":"observed-pr","axes":{"coupling":5,"delivery":3,"scope":5,"uncertainty":3,"validation":2},"complexity":"L","confidence":0.9,"diagnostics":["RADAR-ACCEPTANCE-MISSING","RADAR-BUDGET-EXCEEDED"],"estimate":{"budget_minutes":30,"minutes":112,"within_budget":false},"impact":{"components":["bubblewrap","focused","network","project","source","src/koru","tests","write"],"files":["bubblewrap/seccomp","focused/transaction","network/Unix","project/TICKETS.md","project/ticket-449/README.md","project/ticket-449/intent.json","source/sibling/tmp","src/koru/queue/transaction/service.py","src/koru/queue/transaction/staging.py","src/koru/queue/verification_sandbox.py","tests/test_planfile_queue.py","tests/test_queue_governed_patch_admission.py","tests/test_queue_verification_sandbox.py","tests/test_queue_verify_profiles.py","write/IPC"],"public_interfaces":[],"runtime_dependencies":0},"schema":"subactor.ticket-radar/v1","score":72,"split":{"parts":[{"estimated_minutes":13,"name":"Implement bubblewrap","scope":["bubblewrap"]},{"estimated_minutes":13,"name":"Implement focused","scope":["focused"]},{"estimated_minutes":13,"name":"Implement network","scope":["network"]},{"estimated_minutes":13,"name":"Implement project","scope":["project"]},{"estimated_minutes":13,"name":"Implement source","scope":["source"]},{"estimated_minutes":15,"name":"Validate and project to trackers","scope":["tests","planfile","github/gitlab/jira projections"]}],"reason":"estimated_minutes_exceed_budget","recommended":true},"standards":[{"id":"wellmanifest/dsl","revision":"6c60fc4e0dd1f1bb74f46a7745e28019908d1203","version":"0.1.0-dev"},{"id":"wellmanifest/ticket-lifecycle","revision":"5bf581907a87b46a13a73e6c033d3abe4d9a306f","version":"0.1.0-dev"},{"id":"wellmanifest/git-lifecycle","revision":"7d77d4b7af57e69bc75c3a0290b3a4805c5c4438","version":"0.2.0-dev"},{"id":"wellmanifest/logs","revision":"48c284ef7a069055c0bcb6b900147ce5e65f8b43","version":"0.3.0"}],"ticket_ref":"ticket-449"}

<svg xmlns="http://www.w3.org/2000/svg" width="128" height="128" viewBox="0 0 128 128" role="img"><title>ticket-449: Isolate patch verification effects (ticket-449)</title><rect width="128" height="128" rx="12" fill="#f8fafc"/><g stroke-width="1"><polygon points="64,55 72,61 69,71 59,71 56,61" fill="none" stroke="#d7dde5"/><polygon points="64,47 80,59 74,78 54,78 48,59" fill="none" stroke="#d7dde5"/><polygon points="64,38 89,56 79,85 49,85 39,56" fill="none" stroke="#d7dde5"/><polygon points="64,30 97,53 84,92 44,92 31,53" fill="none" stroke="#d7dde5"/><polygon points="64,21 105,51 89,99 39,99 23,51" fill="none" stroke="#d7dde5"/><line x1="64" y1="64" x2="64" y2="21" stroke="#aab4c0"/><line x1="64" y1="64" x2="105" y2="51" stroke="#aab4c0"/><line x1="64" y1="64" x2="89" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="39" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="23" y2="51" stroke="#aab4c0"/></g><polygon points="64,21 105,51 79,85 54,78 39,56" fill="#fb923c" fill-opacity="0.45" stroke="#c2410c" stroke-width="2"/><circle cx="64" cy="64" r="3" fill="#c2410c"/><g font-family="sans-serif" font-size="7" fill="#334155"><text x="64" y="11" text-anchor="middle">SCO</text><text x="114" y="48" text-anchor="middle">COU</text><text x="95" y="107" text-anchor="middle">UNC</text><text x="33" y="107" text-anchor="middle">VAL</text><text x="14" y="48" text-anchor="middle">DEL</text></g><text x="64" y="124" text-anchor="middle" font-family="sans-serif" font-size="8" fill="#0f172a">L · 112m</text></svg>

Merge will be attempted after this approval when explicitly authorized. ## Decision record (recomputable)

DECISION D-449-1968
TICKET ticket-449
HEAD_SHA 1d565cd8199b5739ab3ee9dfb29b54c5a718f0dd
CORRELATION_ID local-semcod-koru-pr-708-ticket-449
ACTOR agent:ifuri-validator-agent[bot]
APPLIED_RULE P-CORE-015
INPUT author_login = "tom-sapletta-com"
INPUT observed_checks = ["governance / enforce=PASS","standard packs / conformance=PASS","governance / remote lifecycle=PASS","onedev/local-verify=PASS"]
INPUT required_checks = ["onedev/local-verify","standard packs / conformance"]
INPUT required_checks_source = "protected registry + GitHub applied rules (env/request)"
INPUT reviewer_login = "ifuri-validator-agent[bot]"
INPUT semantic_review_assessment = {"schema":"subactor.validator/semantic-review-assessment/v1","subject":{"repository":"semcod/koru","pull_request":708,"head_sha":"1d565cd8199b5739ab3ee9dfb29b54c5a718f0dd","base_sha":"febdb1e2beac504e7ca939b89537f9c507d5dcc5","diff_sha256":"7ebe6c96002a9129d62402394df799eea5b30b4e74ce22353bf4a2e1b2ac43b3"},"policy":{"policy_schema":"subactor.validator/semantic-review-policy/v1","policy_version":1,"policy_sha256":"676cb4516bbfed2a000e40b9b1b6e4a430ecc761ec546aeb53d721a1905cfdd7","required":false,"critical_paths":[],"observed_paths":["project/TICKETS.md","project/ticket-449/README.md","project/ticket-449/intent.json","src/koru/queue/transaction/service.py","src/koru/queue/transaction/staging.py","src/koru/queue/verification_sandbox.py","tests/test_planfile_queue.py","tests/test_queue_governed_patch_admission.py","tests/test_queue_verification_sandbox.py","tests/test_queue_verify_profiles.py"]},"grounding":"full-diff-not-per-finding-proof","execution_authority":false,"status":"not_required","reason":null,"review_sha256":null,"unresolved":[]}
INPUT superseded_checks = ["smoke"]
INPUT ticket_radar_receipt = {"schema":"subactor.ticket-radar/v1","base_sha":"febdb1e2beac504e7ca939b89537f9c507d5dcc5","head_sha":"1d565cd8199b5739ab3ee9dfb29b54c5a718f0dd","change_digest":"5e6e955b98276db376309022a336fa54242bfc8ec4b577a486aac9aead4c1c19","score":72,"complexity":"L","estimated_minutes":112,"split_recommended":true,"services":[],"authority":"ADVISORY","promotion":"FORBIDDEN"}
VERDICT APPROVE AUTHORITY DETERMINISTIC
REJECTED REQUEST_CHANGES BECAUSE NO_UNSAFE_CHANGE_REASON_FOUND
ADVISORY llm_verdict = "BLOCK" MODEL "openai/cursor-auto"
ASSERT VERDICT_AUTHORITY != "ADVISORY"