feat(sandbox): quarantine untrusted patch/code/data analysis with exact evidence

[seonghobae]

Buyer / product problem

Noema needs a reusable quarantine boundary for untrusted repository patches, code, files and later graph/data analysis without exposing reviewer, model, GitHub write, NVIDIA NIM, OIDC, release/deployment or host-Docker authority to the analyzed workload. A buyer must be able to verify exactly what source and patch were analyzed, by which immutable runtime, under which constraints, and what evidence came back.

The product goal is not “run arbitrary shell in a container.” It is an evidence-producing sandbox plane with typed allowlisted operations, exact source identity, hostile-input validation, bounded execution, credential separation and independently verifiable result provenance.

Current protected / implementation lineage

Protected main is c85d710804139c0697d7ef8fa47d02b1389e6d84; #76's bounded nanoid@3.3.17 remediation is protected truth. Historical PR #65 is closed unmerged and is no longer the active implementation owner.

Phase A — exact-source patch quarantine: clean successor #93

PR #93 (feat(sandbox): restack exact patch quarantine after nanoid) is the current clean direct-main implementation line. Exact current head: fe3074a188739705f89ff67b46712ac9d228081d.

The direct-main diff contains the bounded 27-path patch-quarantine product/docs/test workstream plus a current-baseline ## Unreleased changelog entry and contains no package, lockfile, workflow or nanoid changes.

Implemented boundaries include:

• exact repository/base/head/patch SHA-256/profile binding;
• enum-only validation profiles with no caller-provided shell command;
• strict patch path/mode/hunk/file-count validation and governance-path exclusion;
• exact Git HEAD/clean-worktree and exact-tree/object verification;
• archive/materialized file parity against authenticated Git object identities;
• descriptor-safe/no-follow/size-bounded reads;
• no-network, read-only, non-root container isolation with no Docker socket;
• trusted-host result validation and retained evidence rather than giving untrusted execution final host-evidence authority;
• beginner-readable docs, hostile-input regressions and repository coverage/docstring gates.

Fresh exact-head technical evidence for unchanged #93 head fe3074a188739705f89ff67b46712ac9d228081d:

• application ci run 31375580944: terminal success;
• reviewer-ci run 31375580959: terminal success;
• central Security Scan run 31375580983: terminal success under its own scanner/revision semantics;
• formal GitHub review submissions: 0;
• inline review threads: 0;
• GitHub reports the PR mergeable.

These checks do not create live ruleset evidence or qualifying independent formal approval. #27/#29 retain those governance/reviewer boundaries.

Phase B — dedicated validator image: stale #67 lineage, clean restack still required

PR #67 contains the unique validator-image/supply-chain work but remains on the historical #65 feature-base lineage and must not be treated as a protected-current successor merely because earlier image work ran.

The image line includes:

• closed node_patch_verify_v1 image-owned command profile;
• static Node runtime in a shell-free/package-manager-free numeric-non-root image;
• authenticated Node source/build inputs and static/runtime identity checks;
• real no-network/read-only/non-root smoke path;
• Syft/Grype/Trivy evidence and exact image/runtime component identity;
• SBOM/vulnerability receipt verification and stale-head refusal;
• no GitHub/model/NVIDIA NIM/Cloudflare/OIDC/signing/release/deployment credentials inside untrusted validation.

Earlier image work found and corrected a real Unicode-regex runtime mismatch (--with-intl=none vs required Unicode property regular expressions) and removed an invented OCI LicenseRef-Proprietary label because repository visibility or package metadata cannot create outbound legal authority.

After #93 reaches protected main, preserve only #67's unique image delta on a clean protected successor and reacquire every exact-head/source, application, reviewer, eligible Security Scan and supply-chain runtime proof. Old #67/#65 checks/reviews never transfer.

Issue #66 owns later immutable publication/signature/attestation/digest-lock activation after the local exact image path is proven.

Scope split

1. Patch evidence sandbox — authenticated exact source + typed patch validation (feat(sandbox): restack exact patch quarantine after nanoid #93 current owner).
2. Dedicated validator runtime — clean-restacked reproducible isolated exact image and supply-chain evidence (feat(sandbox): build and verify patch-validator image #67/feat(supply-chain): build, attest, and activate the patch-validator image #66 unique work).
3. Reviewer integration — consume validator evidence without allowing it to become approval/merge authority.
4. Graph/code/data analysis profiles — add only bounded typed profiles with independent threat model, realistic fixtures and evidence contracts; never reopen arbitrary shell authority.
5. Operational acceptance — protected-main end-to-end proof, cleanup/recovery and buyer-verifiable provenance.

A future graph/data profile must preserve the same separation: source/data bytes are untrusted, model output is untrusted evidence, credentials stay outside the execution compartment, and deterministic host verification decides whether retained artifacts are structurally valid. Mathematical/statistical production arithmetic introduced by a profile follows the repository Rust-first CPU/GPU policy where material rather than embedding ad-hoc Python arithmetic in the sandbox.

Acceptance criteria

Exact-source quarantine

• Integrate fix(security): update transitive nanoid for CVE-2026-67213 #76 so protected-base dependency audit is clean.
• Rebuild feat(sandbox): add quarantined patch validation #65's unique patch-quarantine work on current protected main as feat(sandbox): restack exact patch quarantine after nanoid #93 without stale package/workflow state.
• Obtain fresh feat(sandbox): restack exact patch quarantine after nanoid #93 exact-head application CI, reviewer-ci and central Security Scan terminal-success evidence.
• Satisfy live chore(governance): protect main and enforce release checks #27/chore(operations): provision and activate hourly maintainer App #29 governance and qualifying independent formal-review requirements.
• Merge unchanged feat(sandbox): restack exact patch quarantine after nanoid #93 under protected policy.
• Re-run protected-main exact-source patch-quarantine operational acceptance after integration.

Dedicated image

• After feat(sandbox): restack exact patch quarantine after nanoid #93 integration, restack only feat(sandbox): build and verify patch-validator image #67's unique validator-image work onto the then-current protected lineage.
• Require exact static runtime identity and required JavaScript runtime capabilities.
• Require a real no-network/read-only/non-root smoke on the exact image.
• Bind SBOM, vulnerability and embedded-runtime inventories to exact image and reviewed source.
• Fail closed on unknown/unmapped component identity; no VEX/ignore/severity shortcut.
• Complete feat(supply-chain): build, attest, and activate the patch-validator image #66 publication/signing/attestation/activation separately without giving untrusted execution publication credentials.

Extended graph/code/data capability

• Define versioned allowlisted operation profiles instead of arbitrary caller commands.
• Bound file count/bytes, output bytes, CPU, memory, process count, wall time and network authority per profile.
• Preserve exact source/data/artifact hashes and provenance for every retained result.
• Add hostile/malformed/oversized/symlink/special-file/fork/network/timeout/forged-result tests per profile.
• Add realistic graph/code/data fixtures with deterministic or independently checkable expected results.
• Keep model judgement, sandbox evidence, required checks, formal review, merge, release and deployment as distinct authorities.
• Update canonical PRD/TRD/Architecture/UML/ERD/Threat Model/Test Strategy/Traceability on the single canonical documentation line; do not duplicate fix(security): bind workflow source and document MSA boundaries #71.

Guardrails

• No arbitrary model-generated shell command as a production validation profile.
• No .github/workflows/repair-*, self-modifying or branch-patching write workflow.
• No Docker socket or host-writable final evidence directory inside untrusted execution.
• No GitHub write, reviewer/model, NVIDIA NIM, OIDC, signing, publication, release or deployment credentials exposed to analyzed code/data.
• No invented outbound license or transfer-rights claim.
• No claim that sandbox PASS is approval, merge authorization, release acceptance or acquisition readiness.

Related: #27, #29, #65, #66, #67, #76, #93

[seonghobae]

Implemented and merged the first enforceable quarantine slice in #32 (322d142b3444005680810a42c9bea0f37a3bc624).

The central reviewer now separates:

• Evidence collection: exact target-head checkout, symlink rejection, hardened CodeGraph, complete check/review/security collection, and bounded manifest serialization using a repository-scoped read-only App token. This job has no LLM credential and no PR-write authority.
• Verdict publication: no target-source checkout; consumes only the one-day manifest artifact, verifies SHA-256 plus repository/PR/live-head binding, and then runs strict manifest-only review with the publication token.

Verification on the merged head passed release:verify, reviewer 100% line/branch and docstring gates, Scorecard, OSV, Trivy, and dependency review. The PR had no unresolved review threads or actionable review findings.

This does not close #9. Remaining acceptance work is a true execution sandbox with read-only source mounts, outbound-network deny-by-default, explicit CPU/memory/wall-clock/file/output limits, and adversarial tests proving optional untrusted analysis or test execution cannot reach reviewer credentials.