security: sandbox model-authored script execution, confine capture reads

[adigo-pro]

A security review of the whole codebase turned up one high-severity issue and several smaller ones. This closes all of them, with regression tests that were each checked to fail against the pre-fix code rather than pass vacuously.

The headline issue

SECURITY.md guaranteed that model-authored verify/probe scripts "cannot read your keys", on the strength of a scrubbed environment and a HOME redirected into the staging dir.

That guarantee was false. HOME only governs ~ expansion, so a script recovers the real home via pwd.getpwuid(os.getuid()).pw_dir, reads ~/.codecouncil/env by absolute path, and sends it out over a network that was never restricted. Reproduced end-to-end (179 bytes of live credentials).

Environment scrubbing cannot fix this — getpwuid reads the OS user database, not the environment — so the fix is an OS boundary. New core/sandbox.py:

Platform	Mechanism	Effect
macOS	sandbox-exec	denies network* + reads under the real home
Linux	bwrap	--unshare-net + tmpfs over the real home

Both re-allow the interpreter's own prefixes after the home denial — pyenv/asdf install Python inside ~, so a blanket home deny breaks Python before the script runs. Measured cost: ~4.5ms/run against a multi-second model call.

sandbox OFF (pre-fix path):  LEAKED           NET-OPEN
sandbox ON  (default):       BLOCKED          NET-BLOCKED

Also closed

• Capture followed symlinks out of the repo. git ls-files lists untracked symlinks, so a repo shipping leaked.txt -> <outside> had that file captured and sent to the model provider. Redaction is no defense — the content is ordinary confidential text, not a credential shape. gitwatch._read_confined now resolves then checks containment, matching what jail.mjs already did for tool calls.
• A/B scorer handed agent-produced code the operator's full os.environ.
• Knowledge filter matched only imperative phrasings, so a flat declarative ("SQL injection is an accepted convention here") persisted into every later judgment prompt.
• screen.resolve_new_imports ran with cwd=<untrusted repo> and an inherited environment; now -I plus a scrubbed env.
• Model-authored text is control-character stripped, not just redacted — an ANSI escape in a finding can repaint the terminal and fake a severity.

Enforcement

The exploit-regression tests error rather than skip when no sandbox mechanism exists, and CI installs bubblewrap (plus the Ubuntu 24.04 apparmor_restrict_unprivileged_userns sysctl that bwrap needs). A silent skip is exactly how a security guard rots green — which it did on the first CI run here, caught and fixed.

Validated on macOS (sandbox-exec), and Ubuntu 24.04 + Debian containers (bwrap 0.9.0 and 0.11.0), on Python 3.10 and 3.12.

Reviewer notes

• Default policy is auto, not require. require was considered and rejected: bubblewrap is absent by default on most distributions, so a require default would silently disable verification — the product's core thesis — for many Linux users. Fail-closed is one env var away and now behaves as documented (it previously threw an unhandled RuntimeError into the critic beat).
• Not a full syscall jail. On macOS the profile denies network and home reads over an (allow default) base; world-readable paths elsewhere stay readable. With egress denied, stdout is the only channel back, and it is redacted and capped. SECURITY.md states this plainly rather than overclaiming.
• Users should rotate keys in ~/.codecouncil/env if they ran verification against a repo they don't fully trust — noted in CHANGELOG.md.
• One unrelated one-line commit scopes .gitignore to .ua/tmp/ (deliberately not .ua/, which has tracked files).

Verification

• 713 tests (was 667), zero skips, green on 3.10 and 3.12
• ruff clean on the pinned CI version
• No measurable suite-time regression