assurance: harden runtime capability boundary

tests/test_alpha4_runtime_release_architecture.py

@@ -158,4 +158,88 @@ class Binding:
     assert evidence["cases"]["grand_total"] == 7265
     assert evidence["companion_import_surface"] == "RESTRICTED"
     assert evidence["companion_file_access"] == "MATERIALIZED_PROFILE_TREE_READ_ONLY"
+    assert evidence["companion_dynamic_builtins"] == "DENIED"
+    assert evidence["companion_filesystem_method_aliasing"] == "DENIED"
+    assert evidence["companion_seed_loader_exec"] == "EXACT_SEED_BASE_BYTES_ONLY"
+    assert evidence["runtime_capability_isolation"] == "PASS"
+    assert evidence["process_isolation"] == "NOT_CLAIMED"
     assert evidence["status"] == "PASS"
+
+
+def test_runtime_airgap_rejects_bound_filesystem_capability_alias() -> None:
+    import pytest
+
+    from tools.alpha4_runtime_expression_airgap import (
+        AirgapError,
+        _validate_companion_ast,
+    )
+
+    source = "from pathlib import Path\nprobe = Path('.').iterdir\n"
+    with pytest.raises(
+        AirgapError,
+        match="filesystem inspection forbidden",
+    ):
+        _validate_companion_ast(
+            source,
+            allowed_imports=frozenset({"pathlib"}),
+            allow_seed_loader=False,
+        )
+
+
+def test_runtime_airgap_denies_aliased_dynamic_builtin_at_runtime(
+    tmp_path,
+) -> None:
+    import pytest
+
+    from tools.alpha4_runtime_expression_airgap import (
+        AirgapError,
+        _load_expression,
+    )
+
+    subject = tmp_path / "runtime-subject.py"
+    subject.write_text(
+        "capability = getattr\ncapability((), 'missing')\n",
+        encoding="utf-8",
+    )
+
+    with pytest.raises(
+        AirgapError,
+        match="forbidden runtime capability",
+    ):
+        _load_expression(
+            subject,
+            tmp_path,
+            allowed_imports=frozenset(),
+            allow_seed_loader=False,
+        )
+
+
+def test_runtime_airgap_denies_arbitrary_compile_exec_alias(
+    tmp_path,
+) -> None:
+    import pytest
+
+    from tools.alpha4_runtime_expression_airgap import (
+        AirgapError,
+        _load_expression,
+    )
+
+    subject = tmp_path / "runtime-compile-subject.py"
+    subject.write_text(
+        "compiler = compile\n"
+        "executor = exec\n"
+        "code = compiler('VALUE = 1\\n', 'not-seed.py', 'exec')\n"
+        "executor(code)\n",
+        encoding="utf-8",
+    )
+
+    with pytest.raises(
+        AirgapError,
+        match="compile path is not exact Seed base",
+    ):
+        _load_expression(
+            subject,
+            tmp_path,
+            allowed_imports=frozenset(),
+            allow_seed_loader=True,
+        )

tools/alpha4_runtime_expression_airgap.py

@@ -49,6 +49,43 @@
     }
 )
 
+_FILESYSTEM_MUTATION_METHODS = frozenset(
+    {
+        "write_text",
+        "write_bytes",
+        "unlink",
+        "rename",
+        "replace",
+        "mkdir",
+        "touch",
+        "chmod",
+        "symlink_to",
+        "hardlink_to",
+    }
+)
+
+_DENIED_RUNTIME_BUILTINS = frozenset(
+    {
+        "breakpoint",
+        "copyright",
+        "credits",
+        "delattr",
+        "dir",
+        "eval",
+        "exit",
+        "getattr",
+        "globals",
+        "help",
+        "input",
+        "license",
+        "locals",
+        "quit",
+        "setattr",
+        "type",
+        "vars",
+    }
+)
+
 
 class AirgapError(RuntimeError):
     pass
@@ -105,8 +142,17 @@ def enclosing_function(node: ast.AST) -> str | None:
                 )
         elif isinstance(node, ast.Name) and node.id == "__builtins__":
             raise AirgapError("air-gap companion accesses __builtins__")
-        elif isinstance(node, ast.Attribute) and node.attr.startswith("_"):
-            raise AirgapError(f"air-gap companion private attribute forbidden: {node.attr}")
+        elif isinstance(node, ast.Attribute):
+            if node.attr.startswith("_"):
+                raise AirgapError(f"air-gap companion private attribute forbidden: {node.attr}")
+            require(
+                node.attr not in _FILESYSTEM_INSPECTION_METHODS,
+                f"air-gap companion filesystem inspection forbidden: {node.attr}",
+            )
+            require(
+                node.attr not in _FILESYSTEM_MUTATION_METHODS,
+                f"air-gap companion filesystem mutation forbidden: {node.attr}",
+            )
         elif isinstance(node, ast.Call) and isinstance(node.func, ast.Name):
             if node.func.id in {
                 "__import__",
@@ -218,18 +264,76 @@ def guarded_import(
             raise ImportError(f"air-gap companion import forbidden: {name}")
         return original_import(name, globals, locals, fromlist, level)
 
+    original_compile = builtins.compile
+    original_exec = builtins.exec
+    approved_exec_codes: dict[int, object] = {}
+    expected_seed_base = (
+        allowed_root / "base" / "seed" / "python" / "aset_seed_alpha4.py"
+    ).resolve()
+
+    def denied(*args: object, **kwargs: object) -> object:
+        raise AirgapError("air-gap companion attempted forbidden runtime capability")
+
+    def guarded_compile(
+        source_value: object,
+        filename: object,
+        mode: object,
+        *args: object,
+        **kwargs: object,
+    ) -> object:
+        require(
+            allow_seed_loader,
+            "air-gap companion compile forbidden outside exact Seed base loader",
+        )
+        require(
+            isinstance(source_value, (str, bytes)) and isinstance(filename, str) and mode == "exec",
+            "air-gap companion compile permitted only for exact Seed base loader",
+        )
+        candidate = Path(filename).resolve()
+        require(
+            candidate == expected_seed_base,
+            "air-gap companion compile path is not exact Seed base",
+        )
+        with original_io_open(candidate, "rb") as stream:
+            expected_bytes = stream.read()
+        actual_bytes = (
+            source_value.encode("utf-8") if isinstance(source_value, str) else source_value
+        )
+        require(
+            actual_bytes == expected_bytes,
+            "air-gap companion compiled Seed source bytes mismatch",
+        )
+        code = original_compile(
+            source_value,
+            filename,
+            mode,
+            *args,
+            **kwargs,
+        )
+        approved_exec_codes[id(code)] = code
+        return code
+
     safe_builtins = dict(vars(builtins))
+    for name in _DENIED_RUNTIME_BUILTINS:
+        if name in safe_builtins:
+            safe_builtins[name] = denied
     safe_builtins["__import__"] = guarded_import
     safe_builtins["open"] = guarded_open
+    safe_builtins["compile"] = guarded_compile
 
     def guarded_exec(
         code: object,
         globals_dict: dict[str, Any] | None = None,
         locals_dict: dict[str, Any] | None = None,
     ) -> None:
+        require(
+            allow_seed_loader and approved_exec_codes.get(id(code)) is code,
+            "air-gap companion exec permitted only for exact Seed base code",
+        )
+        approved_exec_codes.pop(id(code), None)
         target_globals = {} if globals_dict is None else globals_dict
-        target_globals.setdefault("__builtins__", safe_builtins)
-        exec(code, target_globals, locals_dict)
+        target_globals["__builtins__"] = safe_builtins
+        original_exec(code, target_globals, locals_dict)
 
     safe_builtins["exec"] = guarded_exec
     namespace: dict[str, Any] = {
@@ -521,6 +625,11 @@ def check_expression_airgap(profiles_root: Path) -> dict[str, Any]:
         "generator_runtime_dependency": "NONE",
         "companion_import_surface": "RESTRICTED",
         "companion_file_access": "MATERIALIZED_PROFILE_TREE_READ_ONLY",
+        "companion_dynamic_builtins": "DENIED",
+        "companion_filesystem_method_aliasing": "DENIED",
+        "companion_seed_loader_exec": "EXACT_SEED_BASE_BYTES_ONLY",
+        "runtime_capability_isolation": "PASS",
+        "process_isolation": "NOT_CLAIMED",
         "seed_base": {"sha256": sha256(seed_base), "status": "EXACT"},
         "profile_tree_digest": tree_before,
         "cases": {
@@ -560,7 +669,8 @@ def main() -> int:
             f"{cases['identity_sensitivity']}/5 PASS"
         )
         print(f"ALPHA4_RUNTIME_PYTHON_AIRGAP_GRAND_TOTAL={cases['grand_total']}/7265 PASS")
-        print("ALPHA4_RUNTIME_PYTHON_COMPANION_RUNTIME_ISOLATION=PASS")
+        print("ALPHA4_RUNTIME_PYTHON_COMPANION_RUNTIME_CAPABILITY_ISOLATION=PASS")
+        print("ALPHA4_RUNTIME_PYTHON_COMPANION_PROCESS_ISOLATION=NOT_CLAIMED")
         print(
             "ALPHA4_RUNTIME_PYTHON_EVIDENCE_SET_ORDER="
             f"{evidence['evidence_set_order_checks']}/{evidence['evidence_set_order_checks']} PASS"

tools/alpha4_runtime_public_release_audit.py

@@ -171,7 +171,11 @@ def check_public_release(
         and python_airgap.get("structural_cases") == 7260
         and python_airgap.get("identity_sensitivity_cases") == 5
         and python_airgap.get("grand_total_cases") == 7265
-        and python_airgap.get("runtime_isolation") == "PASS",
+        and python_airgap.get("runtime_capability_isolation") == "PASS"
+        and python_airgap.get("process_isolation") == "NOT_CLAIMED"
+        and python_airgap.get("dynamic_builtins") == "DENIED"
+        and python_airgap.get("filesystem_method_aliasing") == "DENIED"
+        and python_airgap.get("seed_loader_exec") == "EXACT_SEED_BASE_BYTES_ONLY",
         "Python air-gap public evidence invalid",
     )
     require(certificate.get("archive_binding") == "EXACT", "archive binding is not exact")

tools/alpha4_runtime_release_admission.py

@@ -114,7 +114,12 @@ def check_release_admission(
         airgap.get("semantic_source_runtime_dependency") == "NONE"
         and airgap.get("generator_runtime_dependency") == "NONE"
         and airgap.get("companion_import_surface") == "RESTRICTED"
-        and airgap.get("companion_file_access") == "MATERIALIZED_PROFILE_TREE_READ_ONLY",
+        and airgap.get("companion_file_access") == "MATERIALIZED_PROFILE_TREE_READ_ONLY"
+        and airgap.get("companion_dynamic_builtins") == "DENIED"
+        and airgap.get("companion_filesystem_method_aliasing") == "DENIED"
+        and airgap.get("companion_seed_loader_exec") == "EXACT_SEED_BASE_BYTES_ONLY"
+        and airgap.get("runtime_capability_isolation") == "PASS"
+        and airgap.get("process_isolation") == "NOT_CLAIMED",
         "Runtime Python air-gap independence boundary drift",
     )
 
@@ -164,7 +169,11 @@ def check_release_admission(
             "structural_cases": airgap["cases"]["total"],
             "identity_sensitivity_cases": airgap["cases"]["identity_sensitivity"],
             "grand_total_cases": airgap["cases"]["grand_total"],
-            "runtime_isolation": "PASS",
+            "runtime_capability_isolation": "PASS",
+            "process_isolation": "NOT_CLAIMED",
+            "dynamic_builtins": "DENIED",
+            "filesystem_method_aliasing": "DENIED",
+            "seed_loader_exec": "EXACT_SEED_BASE_BYTES_ONLY",
         },
         "release": {
             "tree_digest": release_tree,
@@ -231,7 +240,8 @@ def main() -> int:
         print(f"ALPHA4_RUNTIME_RELEASE_ADMISSION_PYTHON_AIRGAP={cases}/{cases} PASS")
         print("ALPHA4_RUNTIME_RELEASE_ADMISSION_PYTHON_AIRGAP_IDENTITY_SENSITIVITY=5/5 PASS")
         print("ALPHA4_RUNTIME_RELEASE_ADMISSION_PYTHON_AIRGAP_GRAND_TOTAL=7265/7265 PASS")
-        print("ALPHA4_RUNTIME_RELEASE_ADMISSION_PYTHON_RUNTIME_ISOLATION=PASS")
+        print("ALPHA4_RUNTIME_RELEASE_ADMISSION_PYTHON_RUNTIME_CAPABILITY_ISOLATION=PASS")
+        print("ALPHA4_RUNTIME_RELEASE_ADMISSION_PYTHON_PROCESS_ISOLATION=NOT_CLAIMED")
         print("ALPHA4_RUNTIME_RELEASE_ADMISSION_ARCHIVE_BINDING=EXACT")
         print("ALPHA4_RUNTIME_PUBLIC_ASSURANCE_REPRESENTATIONS=OPERATIONAL,RELATIONAL,CAUSAL")
         print("ALPHA4_RUNTIME_PUBLIC_POST_BUILD_FORMAL_ASSURANCE=PASS")

tools/alpha4_runtime_triangulated_expression.py

@@ -229,9 +229,7 @@ def print_evidence(evidence: dict[str, object]) -> None:
         "ALPHA4_RUNTIME_RELATIONAL_SOURCE_DERIVATIONS="
         f"{relational_derivations}/{relational_derivations} PASS"
     )
-    print(
-        f"ALPHA4_RUNTIME_INTERFACE_VALIDATOR_INDEPENDENCE={validator_cases}/{validator_cases} PASS"
-    )
+    print(f"ALPHA4_RUNTIME_INTERFACE_VALIDATOR_CROSSCHECK={validator_cases}/{validator_cases} PASS")
     print(f"ALPHA4_RUNTIME_IDENTITY_FIELD_SENSITIVITY={sensitivity}/{sensitivity} PASS")
     print(f"ALPHA4_RUNTIME_EVIDENCE_SET_ORDER_INVARIANCE={evidence_set}/{evidence_set} PASS")
     print("ALPHA4_RUNTIME_REPRESENTATION_SOURCE_INDEPENDENCE=PASS")