Fence native Muse Code file access with bubblewrap - #1120

Scope

Native Muse Code's shell sandbox permits reads outside its workspace, and MCP
servers and hooks run outside that sandbox. Add a bubblewrap launcher around
the unchanged CC lane's exact muse exec argv, with named read-only inputs,
only worktree/log writable binds, a synthetic home, a sanitized settings copy,
and only the specific read-only sign-in bind. Every live invocation first passes
an OS and native echo probe. The CC launcher is unchanged.
Omitted user settings use inert defaults when the default file is absent;
explicit invalid settings still refuse. Every role refuses Git pointer-file
layouts, reader included; runs use their own clone with read-only ordinary
Git metadata. The pointer-resolution implementation is removed, and no parity
claim for pointer layouts remains. Published native-run custody uses artifact names and a task/time
reference, preserving measured results without raw-output digest commitments.

Prior CC-ruled delta: adjudication-pr1120-81008f54-20261015.md:13-23 and
MICRO-81008f54.md:14-17, implementation and tests at pinned 5cfb8346.
Prior narrowly ruled completion at pinned d8afbf04:
adjudication-pr1120-5cfb8346-20261015.md:19-25 and
GPT-VERDICT-5cfb83462.md, blocker1. Implementation:
tools/muse_file_fence.py:205, :249; regression:
tests/test_muse_file_fence.py:416. Finding details remain in those files.
Independent CC DELTA and GPT delta remain required. No rebase before both pass
and the CC registry cue; the sealed loop stop controls any residual disposition.
Current authority: adjudication-pr1120-5cfb8346-20261015.addendum-01.md, items1-4,
and MICRO-delta-d8afbf04.md, P2-a. Required refusal regression:
test_reader_git_pointer_refused. Final CC DELTA and GPT delta run at max;
after those reads, anything below P1 goes to Follow-ups per sealed disposition.

• Base commit: 0f4ee075b2ab3af1b099d5ca1ecb8cae02ee3f5b
• Lane: lane:foundation
• Owned paths: tools/muse_file_fence.py, tests/test_muse_file_fence.py,
  docs/decisions/2026-10-14-muse-file-fence.md,
  notes/muse-file-fence-20261014/{receipt,fix-round-1,fix-round-2,ruled-extra}.json and their evidence registry rows.

The later explicit co-op registry cue supersedes the earlier rebase-order hold:
the read commit is e8734f8241ffd7fc29bcb45e1d8284ccfb8bc76f; its pure registry
rebase is 42f81e80b7584b0503d8055a57d885dc7609cc45 on the base above. Exact
lander lg_change_id with the evidence registry excluded is
cfdb8b1caf5b324f0ad37b128d4ed27fcb67879d at both heads. All seven owned
non-registry files are byte-identical; only the evidence registry conflicted.
CC/GPT fix5 reads bind the ruled commit and carry by this change identity.

SOTA sources

• containers/bubblewrap v0.11.1,
  installed 0.11.1 / Ubuntu 0.11.1-1ubuntu0.3. Pinned
  bwrap.xml
  documents every used flag; the decision lists them explicitly. In particular,
  --remount-ro / seals root while preserving nested writable binds. The
  caller defines the mount and namespace policy, per upstream README. Ordered
  bind mounts give /tmp named inputs and worktree-local inputs read-only
  overlays while temporary writes stay in the log tree.
• CPython v3.13.16 tempfile.py,
  _bin_openflags, _mkstemp_inner, NamedTemporaryFile and
  _TemporaryFileCloser: exclusive randomized creation and context cleanup
  preserve existing user files during the mandatory filesystem probe.
• Git v2.53.0 worktree details
  and repository layout,
  matching installed Git 2.53.0. The CC addendum-01 requires every role to
  refuse pointer layouts and use its own clone. Only ordinary metadata layouts
  are accepted; upstream pointer-layout parity is not claimed.
• openai/codex rust-v0.162.1 permissions.rs:2347-2367,
  default_read_only_subpaths_for_writable_root: the adopted Git metadata
  boundary. bubblewrap.c:380-388
  at the existing pin defines parent lifetime. CPython v3.13.16
  os.rst,
  open/fdopen/dir_fd, and
  subprocess.rst,
  Popen.wait/terminate/kill, supply the native interfaces.
  Source commit 092d3acd6bec3e3a14bdc7e7a2810ab628ab759d was verified from the
  pinned mirror. The prior pointer-layout implementation is superseded by the
  sealed addendum-01; current source adoption covers ordinary directory metadata.
• The owner-named co-op rankedfeeds_fence.sh, fence_checks_rankedfeeds.sh
  and fence_probe_rankedfeeds.sh reference implementation from the
  muse-rankedfeeds-20261014 kit: named read-only binds, private home, bounded
  writable run area and model-free named checks. Source hashes are retained in
  the acceptance receipt. This native route uses host networking for Meta;
  it does not adopt that Claude/OmniRoute arm's isolated network bridge.
• Meta headless execution,
  configuration,
  hooks,
  MCP,
  sandbox,
  approval modes,
  and Muse Wonder, read 2026-10-14.
  Installed Muse 1.4.7-R6101.1 help and native echo probes verify the relevant
  surface. Both current mcpServers and documented legacy mcp_servers are
  removed; project .muse/hooks.json is masked despite --trust-workspace.

Evidence-class table

Local commands run

MUSE_FENCE_NATIVE_PROBE=1 python3 -B -m unittest tests.test_muse_file_fence -v
  rc0,26fence tests (native echo, original controls and scoped CC-ruled regression coverage)
MUSE_FENCE_NATIVE_PROBE=1 python3 -B -m unittest -v tests.test_muse_file_fence tests.test_published_digest_privacy tests.test_provenance_digest_custody tests.test_evidence_manifest tests.test_registry_rows
  rc0,84tests,1host-name guard skip (normal pre-push runs that guard with host source enabled)
python3 -B tools/muse_file_fence.py --role reader --timeout 180 <worktree> <brief> <fresh-log-dir>
  ONE reserved live smoke;22:57:44Z–22:57:58Z;rc0;39events
  model muse-wonder-full-1.0;one run.terminal.completed;expected reply
python3 scripts/evidence_manifest.py --write
python3 scripts/evidence_manifest.py --check
  rc0;owned rows registered through host_receipts.register_file
python3 scripts/validate.py
  final round rc1:only9model-currency age errors,the same CI-wide incident expressly exempted in Astra verdict
  no other reported errors;prior round rc0,71components,12029hashedfiles,240receipts
Registry-only rebase onto0f4ee075:
python3 scripts/validate.py
  rc0;71components,12047hashedfiles,240receipts;integrity/scope only
git merge-tree --write-tree origin/main HEAD
  rc0;exact lander change-id unchanged;all7owned non-registry files byte-identical
git diff --check
  rc0

Decision record

docs/decisions/2026-10-14-muse-file-fence.md describes mount/config policy,
upstream sources, the reference adaptation, tests, evidence and alternatives.
notes/muse-file-fence-20261014/receipt.json retains derived native results and
non-content-derived private custody references. Raw event streams, session IDs
and prompts stay private; unpublished native output digests are not published.
The single reserved smoke is finished; no additional live call is authorized.
The live receipt preserves original timestamps/counts/model facts. Historical
fence argv and precise source identity were not captured for independent review.
These fix rounds rerun model-free OS and native echo controls; they make no
second live-smoke claim. Source fingerprints identify versioned vendor and
launcher/reference scripts separately from private native run content.

Host evidence

No host status, default or runtime readiness change. No credentials are opened,
hashed, copied or logged by this wrapper. The single explicitly mounted sign-in
file remains readable by the native process and same-UID tools. Its contents are
outside every receipt. Shared networking permits Meta endpoints, other outbound
hosts and loopback services; disabled web tools do not create an egress allowlist.
Builder/reviewer modes, hostile same-UID host races, resource limits and kernel
security are not qualified by the reader smoke. No broker/account/unit action.

Follow-ups

• CC DELTA P3-a: docs/decisions/2026-10-14-muse-file-fence.md:245-248 at
  ruled head e8734f82 is superseded by the addendum-01 decision. Record-only
  correction remains a Follow-up. Citation:
  research-cc-role-20261008/pr1120-claude-micro-e8734f82.md:22, P3-a,
  SHA256 72ef1102cb7f57472e10aae0c9c0ce1a44d953ab4a5c9e77445c2e7c5842836c.

• CC DELTA P3-b: tests/test_muse_file_fence.py:433,463 at ruled head
  e8734f82; correction retained by citation at
  research-cc-role-20261008/pr1120-claude-micro-e8734f82.md:23, P3-b,
  SHA256 72ef1102cb7f57472e10aae0c9c0ce1a44d953ab4a5c9e77445c2e7c5842836c.

• Local review Follow-up: /var/tmp/ns2604-local-review-20261013/pr1120-e8734f82/review_output.json,
  title [P2] Mount the runtime after the /tmp overlay. Retained under the CC's
  no-further-round disposition; no branch change is made for this finding.

• GPT fix4 P3-1: GPT-VERDICT-d8afbf046.md, FOLLOW-UPS1; input qualification and
  shared-network boundaries stay open. The current layout narrowing supersedes
  that verdict's accepted pointer-layout discussion; no new qualification claim.

• GPT fix4 P3-2: same verdict, FOLLOW-UPS2; phase/failure receipts, event-shape
  validation and safe fresh-log recovery remain separate follow-up work.

• GPT fix4 P3-3: same verdict, FOLLOW-UPS3; portable evidence, citation custody,
  verdict-copy fingerprint reconciliation and historical registry locators
  remain open. Supplied review records do not certify missing historical bytes.

• CC delta P3-a/P3-b: MICRO-delta-d8afbf04.md, Findings P3-a/P3-b. Retain
  their source-class dispositions for later work. Addendum-01 disposes of the
  pointer and linked-worktree classes by refusing those layouts for every role;
  no claim about unmeasured cases is introduced.

• GPT fix3 P3-1: GPT-VERDICT-5cfb83462.md, FOLLOW-UPS1; qualification and shared
  network scope remain under the prior adjudication. No additional qualification
  or network claim is introduced by the current scoped correction.

• GPT fix3 P3-2: same verdict, FOLLOW-UPS2 and tools/muse_file_fence.py at
  5cfb8346:289,294,421,426,430,454; retain safe failure/receipt recovery and
  event-shape validation work for later authorization.

• GPT fix3 P3-3: same verdict, FOLLOW-UPS3; portable evidence, policy-compliant
  source custody and inherited numerical registry locators remain open. No
  historical reconstruction is labelled measured by this correction.

• CC micro P3-1: MICRO-81008f54.md:18; input-path qualification remains a
  separate follow-up, preserving fail-closed behavior.

• CC micro P3-2: MICRO-81008f54.md:19; filesystem socket masks and the shared
  network namespace are distinct. Abstract Unix sockets remain part of that
  shared namespace; no service reachability measurement is claimed.

• CC micro P3-3: MICRO-81008f54.md:20 and
  tests/test_provenance_digest_custody.py:1-12; inherited notes custody fields
  must follow the repository rule. Use reviewed published captures or custody
  locators in follow-up work; no new private-file digest is added by this delta,
  and no scanner exception or baseline is introduced.

• Astra P3, portable evidence and historical source identity: retain reviewed
  reference-script captures and pinned Muse documentation/help captures when
  available. The cited Meta pages remain UNMIRRORED, and the historical live
  fence argv/source identity is OPEN. Do not label reconstructed metadata a
  measurement; present native echo/canary results at their tested source state.

• Astra P3, failure/retry receipts: add safe phase/failure records and refusal,
  timeout and recovery tests in later authorized work. Version/probe errors
  currently leave partial artifacts and a generic refusal; retry uses fresh
  logs. No replay or restore may bypass the mandatory probe.

• Astra P3, historical manifest locators: preserve the inherited pinned/history
  citations. Registry insertions shift numeric line locators; the review found
  no newly introduced current-head defect. A later registry-locator improvement
  should cover those inherited unpinned references without rewriting history.

The final local validator reports the same nine model-currency age errors
classified as the exempt CI-wide incident by the supplied Astra read. No
model-currency record or validation gate is changed by this bounded fix.

Checklist

• No workflow/dependency change; existing upstream bubblewrap is used.
• Fail-first canary and named model-free/config probes pass.
• Exactly one authorized native reader smoke; exit/count/model receipt retained.
• Protected CC launcher and host settings unchanged; sign-in only mounted read-only.
• No secrets printed or committed; no new secret or paid surface.
• Peer-owned worktrees and files preserved.
• GPT-family Astra and local review explicitly requested before CC landing.