Add reviewed read-only Muse toolchain directory grants - #1156

Scope

Implements the named read-only toolchain-root extension ruled in ruling-f1-meta-fence-dirbind-20261015.md:9-18 (SHA256 9ba078028c1762f71a78791a24ea02949944d870df376cee6d7d402b78745ec3). The fixed initial inventory selects Go 1.25.12; native argv construction continues through the unchanged CC launcher. F1 waits for this isolation PR's two-family reads and landing.

• Base commit: ec15c903751cf2f6ed906a6ad10df8c61f04f1c7
• Lane: lane:foundation
• Owned paths: tools/muse_file_fence.py, tests/test_muse_toolchain_dirs.py, the dated decision and controls receipt, prior decision's amendment pointer, owned rows in manifests/evidence.json.
• Isolation references: tools/muse_file_fence.py:35-82,261-300,326-327; tests/test_muse_toolchain_dirs.py:39-199. Finding details remain in the sealed CC record under coordination/command-center/research-cc-role-20261008/.

SOTA sources

• containers/bubblewrap v0.11.1, commit 124c4cdf4321f63ef17a1cb0ce8f9dd45bd7adbe: bwrap.xml:251-259,293-318, bubblewrap.c:1237-1254,1610-1639, bind-mount.c:378-406,461-486. Uses documented ordinary recursive --ro-bind; no new namespace or remount flag.
• openai/codex rust-v0.162.1, commit 092d3acd6bec3e3a14bdc7e7a2810ab628ab759d: codex-rs/linux-sandbox/src/bwrap.rs:411-425,717-743,1445-1485; reference regression locations 1906-1930,2436-2463. CC-specific inventory policy is identified separately in the decision.
• Muse Code installed pin 1.4.7-R6101.1; unchanged launcher cites official headless execution, approval modes, and configuration flags. Prior pinned runtime measurements remain in the Fence native Muse Code file access with bubblewrap #1120 decision.

Evidence-class table

Local commands run

MUSE_FENCE_TOOLCHAIN_PROBE=1 MUSE_FENCE_NATIVE_PROBE=1 python3 -m unittest tests.test_muse_file_fence tests.test_muse_toolchain_dirs
rc 0; 39 tests, 0 skips; includes all 26 landed fence controls.

python3 scripts/evidence_manifest.py --write
rc 0

python3 scripts/validate.py
rc 0; 71 components, 12057 hashed files, 4 profiles, 240 receipts.

git diff --check
rc 0

The first fail-first baseline is a missing-API TypeError at ec15c90. Subsequent stages are assertion failures against the intermediate implementation before their respective guards. No Meta model calls or toolchain installs occurred in this change. Network remains shared; native roles and flags are unchanged.

Decision record

docs/decisions/2026-10-15-muse-toolchain-directory-grants.md records source pins, CC record hash, measurement classes, alternatives and supersession criteria.

Host evidence

No files under evidence/hosts/ are changed. The derived controls receipt is hash-listed. Two-family isolation review is explicitly requested before use.

Follow-ups

• P2: tools/muse_file_fence.py:259,274,300; tools/muse_file_fence.py:327-328; tools/muse_file_fence.py:510,388,438,451,518; bubblewrap.c:1610-1639; docs/decisions/2026-10-15-muse-toolchain-directory-grants.md:56-59.

• P3: docs/decisions/2026-10-15-muse-toolchain-directory-grants.md:34; notes/muse-toolchain-directory-grants-20261015/controls.json:6; tools/muse_file_fence.py:326-327,479-480; tools/muse_file_fence.py:327-328,480-481; tools/muse_file_fence.py:232,259,416-422; docs/decisions/2026-10-14-muse-file-fence.md:45-49; tools/muse_file_fence.py:285-287; docs/decisions/2026-10-14-muse-file-fence.md:3-5.

• P3: tree/tests/test_secret_path_guard.py:3149,3155; merged-overlay/scripts/hooks/secret_path_guard.py:3104.

• P3: tree/docs/decisions/2026-10-15-muse-toolchain-directory-grants.md:34; tree/notes/muse-toolchain-directory-grants-20261015/controls.json:6; pr-body.md:10,56.

Additional toolchain versions require reviewed inventory changes. F1 resumes only after the required reads and landing cue. No unrelated Muse work is included.

Checklist

• No GitHub Actions changed; existing workflow pins and permissions are preserved.
• No secrets printed, logged or committed; no required secret added.
• No new hosting, subscription or billing surface introduced.
• Peer-owned worktrees and files preserved.