Native read confinement, Linux proxy enforcement, and grade A

[O6lvl4]

38 commits. Two enforcement gaps closed, one second implementation removed, and the code quality grade moved from 75 (B) to 92 (A).

Enforcement

--read-policy strict on both platforms. Reads are confined to the mounts you granted plus the system directories a command needs to start; every home directory is closed. Linux uses Landlock ABI 1, macOS sandbox-exec.

The macOS read set could not be guessed — a wrong one aborts every process, including /bin/echo, and the profile's (trace ...) facility is itself denied. The kernel records each denial in the unified log, so it was read back from there to a fixed point. scripts/probes/macos_read_set.py is that loop and reads the set out of sandbox_profile.rs, so it cannot drift from what porta applies. Apple moves these paths between releases; re-run verify on a new one.

The command itself is subject to the policy: a toolchain under /opt needs -v on its own installation, and porta says which grant is missing instead of letting the kernel answer with a bare Permission denied.

Proxy mode is enforced on Linux instead of refused. Landlock's network rules reach TCP and nothing else, so porta could not hold the claim that the loopback proxy is the only egress. A seccomp filter closes the rest: socket(2) returns EAFNOSUPPORT unless it asks for AF_INET with SOCK_STREAM, and io_uring is refused outright because a ring can open a socket without ever issuing socket(2). A kernel that will not take the filter refuses the run.

Rejections say what was wrong. A tool call whose arguments fail the declared schema now names the violations. Measured on the containment suite, that moved task completion from 6/15 to 9/15 with execution still at 0 — the apparent safety-versus-capability trade-off was a missing error message.

Removals

serve read a module's exports with a hand-rolled WASM parser while validate and inspect read the same module through wasmtime. Two independent readings of one format is the hazard the wasmtime migration exists to prevent. serve now reads them the same way, which left nothing calling the parser; it goes, along with the WASI implementation beside it that had been unreferenced since that migration. 776 lines.

Grade

75 (B) → 92 (A) on the pinned analyzer, enforced in CI at the grade-A boundary of 90. docs/roadmap/done/04-code-quality-grade.md records what moved it, what was deliberately left, and why — including the evaluation harnesses whose line counts are not worth chasing, and the .almd complexity numbers that are artifacts of the analyzer's parse coverage. No threshold was relaxed.

Verification

Every commit passed almide check, almide build, almide test --ci (110 tests), the integration suites and a Linux container run before it was pushed, and CI is green on both platforms for all of them.

Three native modules carry #![cfg(target_os = "linux")], so on macOS they are not compiled at all — every local gate can pass while one of them does not build. CLAUDE.md now says so and carries the container command that does check them.

Not closed

• The isolation-matched benchmark arm still cannot run: docker agent run --sandbox reports requires Docker Desktop with sandbox support on Desktop 4.82.0. The startup and memory numbers compare against native execution and must not be read as a container-versus-WASM isolation result.
• The containment scenarios are author-written, five of them, on one small quantized model on macOS. That is a measurement, not a security proof.
• ACCESS_NET_BIND_TCP is unused, so a child may still listen on a port. That is ingress; the invariant is about egress.
• --read-policy still defaults to open. Flipping it is a version boundary.

🤖 Generated with Claude Code