Hardening: close the residues recorded through layer 8 - #184

…the OCI wrap

The containerized backend was the one mechanism restricting the network,
which made "containerized" carry a promise the direct mechanisms never
made — and the direction of the recorded decision is symmetry: nothing
pretends to a control it does not apply. The wrap now emits no --network
flag, the attestation says `allowed` like landlock and seatbelt, and the
`denied` literal stays reserved for a mechanism that genuinely emits a
denial flag. This also retires the Perlmutter spike item about
`--network none` hanging on compute nodes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016CRERrB5zWdVXD6uPv2BRa

Closes the cross-write residue: a concurrent task landing bytes in a
sibling's output directory before the sibling hashed produced a manifest
that was self-consistent and wrong — undetectable by any checksum, so
prevention is the only fix. exec_policy gains one keyword (output_dir),
handed down from the worker's task; a probe has no output id and keeps
results/ whole, which is now the one probe/recipe asymmetry: the
probe→recipe promise excludes exactly the commands that write outside
their own output directory. All three mechanisms express the narrower
shape natively (the same nested-writable-directory form, one level
deeper), and the OCI mount table inherits it from the write set with no
backend change. Integrity-answering stays data_version's job alone.

The enforcement test is mutation-checked: the same cross-write through
Unavailable() succeeds (verified rc 0, bytes replaced).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016CRERrB5zWdVXD6uPv2BRa

The engine-closure decision's concrete loss was that nothing recorded
which uv converged the environment — the one tool between the lock and
the installed artifacts. The driver probes `uv --version` once per run
and hands it down (the HEAD discipline; the rerun entry point probes its
own), and the worker records it beside lc_version. Attestation, never
identity: defaulted empty, outside both hashes, never read by classify,
and an unparseable probe records "" rather than failing a run.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016CRERrB5zWdVXD6uPv2BRa

… as sha256

Every file in an output directory now appears in the crate as a File
under its dataset's hasPart, carrying sha256 and contentSize parsed from
its SHA256E annex key — the raw digest `sha256sum` can verify after a
`git archive` deposit, available with none of the bytes fetched because
keys are repository state (dataset.annex_keys; `--include=*` is
load-bearing — bare `find` lists only present files). A non-SHA-256
backend key yields size and no digest, never a wrong one; git-carried
files (the lock, universes, manifests) hash their own bytes. The key map
is injected into render like the writer, so the builder stays git-free
and the render pure.

This also fixes a latent honesty bug: an out-of-tree declared input's
recorded input_versions digest is lc's *framed* hash, and publishing it
under the workflow-run `sha256` term claimed a checksum nothing could
verify. Externals now publish no digest — the manifests keep the full
story, the layer's stated weaker promise.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016CRERrB5zWdVXD6uPv2BRa

The rerun-lag residue made visible. The render pins datePublished to the
newest manifest finished_at, so status can read lag off the document
itself — a content comparison against the manifests the walk already
read, with no git call and no rocrate import (the crate stays the one
materialize-only dependency on status's path; license_of and
CRATE_FILENAME move to project.py for the same reason). Four states:
not maintained / will be created / up to date / behind, plus an honest
"unreadable" for a corrupted file — and the line lands in --json through
as_dict like the rest of the header.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016CRERrB5zWdVXD6uPv2BRa

The mid-run edit hole, surfaced: the dirty check runs at start of run
while manifests are written per-output later, so an edit in between left
manifests whose git_sha no longer described the code that ran, silently.
The run now ends with one dataset.status call — the tree started clean
and save/restore keeps results/ clean, so any dirt appeared mid-run —
and warns with the edited paths. Still a warning, never a manifest
field: the spec's git_dirty stays unwritten by decision.

Also closes the recorded review item: a metadata test now pins that no
[project.scripts] entry ever targets lightcone.engine or the sandbox
shim — every entry point is the CLI or a mirrored git-annex executable.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016CRERrB5zWdVXD6uPv2BRa

The uv identity holes (scrub landed, machine-config advisory), the
crate's raw-digest rule and the injected key map, the status crate line,
and the launcher-scrub note resolved.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016CRERrB5zWdVXD6uPv2BRa

The sweep: dataset.save now commits with the same pathspec it stages —
a partial commit, built from HEAD plus its own paths alone — so work the
user staged while a graph ran stays staged and warned-about, never swept
into an output or crate commit. The nothing-to-commit probe is scoped
the same way, and the annex per-add config rides on the commit too,
since a partial commit takes the paths through the clean filter again.
The stronger move — a frozen execution worktree — is recorded as
deferred to the venue era, not rejected.

The crate's byte fallback re-checks the annex pointer shape before
hashing: annex_keys answers empty for the whole repository when
git-annex cannot answer at all, and a pointer file reads perfectly well,
so one failed `git annex find` would otherwise publish a well-formed
digest of the pointer text for every output file. The key parse splits
from the last tab (git-annex emits ${file} unescaped; keys never contain
tabs), and _file stops hashing the license file twice.

The scrub allowlist keeps four more plumbing variables —
UV_PYTHON_INSTALL_DIR (the interpreter store has no project-level
spelling, so scrubbing it shipped a remedy that does not exist),
UV_LINK_MODE, UV_PYTHON_INSTALL_MIRROR, UV_KEYRING_PROVIDER — and the
warning is composed once (project.uv_scrub_warning) and surfaced by
every uv-acting verb: init and build now say it too, instead of leaving
a corporate-mirror user with uv's raw resolution error. The machine
config probe covers XDG_CONFIG_DIRS, keeping its "complete" claim true.

Honesty edges: the crate status line says "up to date with the outputs"
/ "behind the outputs" — the exact scope of its datePublished proxy,
correct in both directions (a dropped output regresses the newest stamp
as a rerun advances it); the write-denial remedy names the recipe's own
output directory instead of results/; the Landlock/Seatbelt divergence
the narrowing exposed (`rm -rf $OUT` is EACCES on Linux, fine on macOS)
is recorded with its fix — delete the redundant prelude, the worker
resets the directory; the deposit-vs-consumed meaning of a File's sha256
is recorded where the old conflict rule used to be; and a comment that
referenced the spec stands on its own now.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016CRERrB5zWdVXD6uPv2BRa

Reuse: the annex pointer-shape test is assets.is_pointer now — one
spelling of git-annex's isPointerFile rule, used by require_fetched and
the crate's byte fallback alike, ending the cross-module reach into
private constants. dataset gains _ask, the one seam for git reads where
"cannot say" must be an answer (last_writer and annex_keys shared the
shape verbatim).

Altitude: the uv-scrub warning has one composer and only engine
surfaces — convergence's report, materialize's warnings, and the probe's
outcome notes — so the CLI never composes engine facts and lc run's
--json-less echo asymmetry is gone. The lc build echo is deleted
outright: the image's uv runs inside the container build, where the host
environment does not reach. The driver-resolved run facts (env_version,
HEAD, the versions memo, runtime, uv_version) are one frozen RunContext
handed to every task, so the next attestation field is one line instead
of an edit to five signatures.

Simplification: scrubbed_uv_vars folded into uv_scrub_warning (its only
caller); the test-only defaults on execute's uv_version and
LockScan.machine_config are gone — a real caller can no longer forget
either silently.

Efficiency: _dataset selects an output's files by bisecting one sorted
key list instead of re-sorting and rescanning the whole map per output,
and _integrity reads a file once.

Tests: one _git_calls helper in test_container, one _cluster helper for
the custom-scheduler tests in test_materialize.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016CRERrB5zWdVXD6uPv2BRa

Two host facts the runners exposed: CI pins its matrix interpreter
through an ambient UV_PYTHON, which the scrub correctly drops and
reports — so every converge grew the warning and warnings == []
depended on the host; an autouse fixture now strips scrubbable UV_*
suite-wide, derived from the scrub's own predicate. And the annex_keys
clone test ran `git annex init` in a clone with no git identity — a
clone inherits no local config, and init in a clone has remote
git-annex branch state to commit, where a fresh repo's init tolerates
the absence; the test sets identity the way the repo fixture does.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016CRERrB5zWdVXD6uPv2BRa

Widens #183's label gate: the eval runs on every non-draft PR, with
`ready_for_review` beside the default types so flipping a draft to
ready triggers the run the draft guard skips. The per-PR concurrency
group already cancels superseded runs, so a push train costs one eval.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016CRERrB5zWdVXD6uPv2BRa