fix(sandbox): the container rule is not asked of Validate, and a make-based binding executes the tree

[github-actions]

Makes GATE-SANDBOX-2—the rule that a binding executing model-authored code must run in a container—apply to Validate as it does to Test and Build. The issue: CommandValidate bound to make lint executes recipes, and a model can author config files those recipes read (mypy.ini, ruff.toml, eslint.config.js), turning them into arbitrary execution on the host. The fix adds an EXECUTES_CODE capability declaration to adapters; staged_refusal checks for it before allowing materialisation; and both call sites (_checked and _validate_runner) now refuse bindings that execute without a container. RuffValidate declares READS_REPO only, so it is unaffected. Detection's bindings carry the appropriate declaration.

What changed:

• CommandValidate declares EXECUTES_CODE alongside READS_REPO, because a repository's own make lint runs recipes and a model can author the files those recipes read.
• RuffValidate continues to declare READS_REPO only, because ruff is a binary parser and its TOML config cannot execute arbitrary code.
• The staged_refusal function now checks whether an adapter declares EXECUTES_CODE and skips the container check if it does not, allowing bindings like RuffValidate to proceed unaffected.
• The strategy's _checked function calls staged_refusal(ctx, Validate) before materialising the tree, refusing any CommandValidate without a container.
• The run_validate tool's _validate_runner function calls staged_refusal(ctx, Validate) before materialising, refusing the same way and returning an error the model sees.
• Detection's bindings (make …, npm run …) carry EXECUTES_CODE to indicate they execute model-authored files; pure tool bindings like ruff do not.
• Documentation in design/gates.md updated to reflect that the container rule now applies to Validate when the binding declares EXECUTES_CODE, citing fix(sandbox): the container rule is not asked of Validate, and a make-based binding executes the tree #410.
• New test file test_validate_sandbox.py verifies the declaration, the refusal at both call sites, and that read-only bindings are unaffected.

Worth a closer look:

• The denial of service: any repository currently binding CommandValidate(cmd, sandbox=Sandbox()) without an image will now be refused at validation time. This is the intended breaking change to close a security hole, but deployments using such bindings will need to update them to provide a container image.
• staged_refusal now requires the container to have a resolve method; test doubles that only implement has will not be interrogated for capabilities and will not trigger the refusal. This is tolerant but worth noting for test design.
• The diff modifies the capabilities list of an adapter class, not an instance, so all uses of CommandValidate pick up the new declaration immediately—there is no per-binding override here.

Closes #410

The ticket body is untrusted input to a model that held write tools, so review this as you would a change from a stranger who had read your repository — the controls bound where it could write, not what it thought.

Tests: ✅ 2879 passed, 15 skipped, run against the staged change before it was proposed.

Checks: clean — the repository's own checks passed over this change

in-lockstep

{
  "In-Lockstep-Run": "implement-propose-34408733138-20260909T223934Z-8d0d",
  "Ticket": "#410"
}

[github-actions]

in-lockstep review — intent

succeeded · $0.0851 · 3 in / 508 out tokens

	location	finding
⚠️	tests/in_lockstep/test_validate_phase.py:80	Test double gains EXECUTES_CODE but has no sandbox image — the refusal it is supposed to exercise has a different code path.
ℹ️		the lens was given this change's blast radius (2814 chars)

[github-actions]

in-lockstep review — performance

succeeded · $0.0744 · 3 in / 67 out tokens

No findings.

[github-actions]

in-lockstep review — security

succeeded · $0.0880 · 3 in / 677 out tokens

	location	finding
⚠️	src/in_lockstep/adapters/ai/strategy.py:898	staged_refusal refusal in _validate_runner returns a string to the model rather than raising, and the model may proceed past it.
⚠️	src/in_lockstep/adapters/worktree.py:158	capabilities_of is imported inside staged_refusal on every call; not a security issue but worth confirming the import cannot be shadowed by model-authored code on sys.path.
ℹ️		the lens was given this change's blast radius (2814 chars)

[github-actions]

in-lockstep review — tests

succeeded · $0.0912 · 3 in / 912 out tokens

	location	finding
⚠️	tests/in_lockstep/test_validate_sandbox.py:239	The _validate_runner refusal test asserts on the result string but does not assert that validator.seen is empty when the validator reads.
⚠️	tests/in_lockstep/test_validate_sandbox.py:176	The _Ctx.do dispatcher will KeyError for any verb not in self.bound, masking failures if _checked dispatches an unexpected type.
⚠️	tests/in_lockstep/test_validate_sandbox.py:252	Detection test relies on _detect_facts and detected_bindings being importable from those paths; if those are private APIs, a refactor silently breaks the test.
ℹ️		the lens was given this change's blast radius (2814 chars)

[tpouyer]

LGTM