Run package builds in hermetic, policy-governed developer environments #91

Goal

Treat secure developer/build environments as a mandatory package intake boundary, especially for AI-authored or untrusted dependency changes.

Requirements

• run build/test/install hooks in ephemeral least-privilege sandboxes;
• deny ambient host credentials and home-directory state by default;
• explicit capability grants for network, filesystem writes, process spawn, package manager access, and secret references;
• immutable base image/toolchain identity and locked dependency graph;
• bounded CPU/memory/disk/time/output;
• egress allowlists with DNS/endpoint evidence where enabled;
• no production/cloud credentials in PR/package build lanes;
• retain source/artifact/toolchain/capability digests in a build receipt;
• integrate with ores-compose for local parity without making local developer machines the trust anchor;
• support Linux first, with explicit macOS/Windows worker policy rather than silently weaker isolation.

AI-generated code policy

A submission may be marked as AI-assisted/generated for provenance, but isolation policy must not depend on self-reporting. High-risk lifecycle scripts and newly introduced executables should receive the same sandbox treatment regardless of origin.

Tests

Prove blocked credential reads, blocked undeclared network access, bounded fork/process storms, path escape denial, deterministic receipt identity, and explicit opt-in for allowed toolchains/endpoints.