Round 4: qualify contamination-resistant Claude condition in WSL2

[in-c0]

Purpose

This is the local execution lane for the only remaining pre-cohort apparatus gate. Parent direction: #24. Contract/integration branch: PR #27 (reviewer/cohort-contract-v0).

Do not run another real benchmark case until this issue's canary gate passes.

Target condition

Preferred on this Windows host: Claude Code running inside WSL2 with its native Bash sandbox enabled. Current Claude Code docs state native Windows sandboxing is unsupported; Linux/WSL2 uses bubblewrap, and sandbox.failIfUnavailable: true converts missing sandbox support into a hard failure.

The standardized condition must preserve normal useful agent capabilities while making benchmark answers/private host context inaccessible.

Minimum settings invariants:

• sandbox.enabled: true
• sandbox.failIfUnavailable: true
• sandbox.allowUnsandboxedCommands: false
• filesystem isolation remains enabled
• no excludedCommands that bridge around the boundary
• seccomp sandbox runtime installed on WSL2 so Windows interop Unix-socket escape is blocked
• workspace under Linux filesystem, not /mnt/c/...
• sandbox filesystem.denyRead covers UpdAPI answer-bearing repo paths and Windows user tree; only required runtime/project paths re-opened
• matching permissions.deny Read(...) rules for answer-bearing paths so built-in file tools cannot bypass the Bash sandbox
• explicit web/network/MCP/tool policy matching the future cohort cell

Use --bare if an already-available API-key/provider credential makes it viable. If bare would require creating a new credential, do not silently change the auth model; use a demonstrably sterile supported context path or escalate the one-time auth action to the owner. No host-context run can qualify.

First work on PR #27

Before touching paid/model execution:

1. checkout reviewer/cohort-contract-v0 at its exact head;
2. npm ci;
3. run npm test and npm run bench:validate;
4. specifically verify the new test/cohort-contract.test.cjs, schema compilation and npm run bench:cohort:validate CLI;
5. fix any defect on the same branch and report evidence on PR bench: preregister repeated-trial cohort contract #27.

Canary implementation

Implement a local/portable qualification command/script that emits a JSON record conforming to schemas/isolation-canary-evidence.schema.json plus a retained artifact index/raw Claude stream.

Run two passes with fresh random nonces. Each pass must empirically prove:

• built-in Read can reveal the allowed workspace nonce;
• Bash/subprocess can reveal the allowed workspace nonce;
• built-in Read attempts the forbidden answer-vault path but cannot reveal its nonce;
• Bash/subprocess attempts that same forbidden path but cannot reveal its nonce;
• a throwaway context nonce outside the standardized context is absent;
• deliberate sandbox-unavailable startup fails closed.

Use claude -p structured/stream output so raw tool-use/tool-result evidence is retained. A final natural-language statement like “permission denied” is not sufficient proof on its own.

The sandbox profile must also deny the real UpdAPI benchmark/controls/validators root; the randomized answer-vault sentinel is the observable proof of the same deny mechanism without dirtying benchmark files.

Evidence / binding

The resulting evidence must include/bind:

• Claude Code product/CLI version
• requested model configuration
• adapter source SHA
• context mode/profile SHA
• normalized execution-policy SHA
• isolation mode/profile SHA
• two nonce-pass hashes + raw artifact-index hashes
• qualification timestamp/status

Then create the frozen one-cell N=5 MCP plan and run:

npm run bench:cohort:validate -- <plan.json> --canary <isolation-evidence.json>

The exact plan bytes/SHA printed by that gate must be retained before attempt 1.

Exit gate

This issue is complete only when:

• branch tests/validation are green;
• two fresh-nonce canary passes are green;
• fail-closed behavior is demonstrated;
• PR bench: preregister repeated-trial cohort contract #27's plan/evidence cross-validation passes;
• no real benchmark agent was invoked before qualification;
• evidence is posted to PR bench: preregister repeated-trial cohort contract #27/Build v0 living API-evolution + frontier freshness benchmark #24.

After that, implement/wire repeated-trial orchestration and execute exactly five scored MCP attempts under the frozen plan (max two apparatus-invalid replacements, no scored-failure replacement).

No GitHub Actions.