Sever an allowlist run this worker cannot filter

[ppXD]

Summary

• On a confining worker that cannot filter, an allowlist run is severed. Before, a worker with ip and nft installed planned every allowlist run Filtered (FilteredEgressNetns.IsSupported). The shipped worker (uid 1654, no capabilities) then admitted the run, spent on it, and aborted it at ip netns add ("Filtered-egress netns setup failed").
  • A root worker whose /proc/sys is read-only did worse. procps' sysctl -w net.ipv4.ip_forward=1 warns and exits 0 there, so the run launched as filtered while none of its allowed hosts was reachable.
  • Now, where bubblewrap confines, the plan keys on FilteredEgressNetns.CanFilter (renamed from CanSeal). That is the tools, one throwaway namespace, and ip_forward reading 1 or passing access(W_OK), a check that changes nothing.
  • Where that does not hold, the allowlist fails closed to no egress, as SandboxEgressPolicy documents. bubblewrap severs the run, its record says NetworkSevered, and a brokered run still reaches its broker through the relay.
• Unconfined hosts behave exactly as before. Where bubblewrap does not confine (the worker as docker-compose.yml ships it), nothing would enforce a severance, so a severed allowlist would share the worker's network. There the binaries alone still plan the run Filtered: its setup filters it or aborts the launch, and it never reaches the worker's network.
  • The launch and the admission both read that one host fact: LocalProcessRunner.FiltersAllowlist / HostFiltersAllowlist in LocalProcessRunner.Durable.cs.
  • Dockerfile.worker describes both postures.
• Runs in flight keep what they had. Tearing a namespace down by name and the legacy re-bind still key on the tools alone.
• Boot line. The posture line reports CanFilter and FilterUnavailableReason. FilteredEgressNetns.FilterProbe(path) is the probe CanFilter runs, with the forwarding file passed in, so the root lane can pin the whole probe and not only its parts.

Test plan

• Unit, full suite, macOS: 11499/11500 (1 skipped).
• Unit, touched classes, on Linux in a privileged container, run as root, as uid 1654 where bubblewrap confines, and as uid 1654 unconfined: 427 each. The one failure, LocalProcessDurableRunnerTests.Supervisor_seals_logs_only_after_a_background_descendant_closes_its_output_writer, fails identically on the base.
  • AllowlistFilterProbeTests covers:
    • the probe truth table (tools, namespace, forwarding);
    • the posture table (confines, canFilter, tools);
    • forwarding against real files.
  • SealedEgressAdmissionTests pins the public admission against this host's probes.
• Integration (AgentRunExecutorTests, macOS): 144/144.
• Sandbox, root, with the real claude and codex CLIs: 77/77.
  • The allowlist run is still filtered.
  • A file reading 0, bound read-only, is named by FilterProbe, and a writable one is not.
• Sandbox, non-root (uid 1654, no capabilities, no_new_privs): 10/10.
  • The allowlist arm is admitted and launched with no namespace, is recorded NetworkSevered, and reaches its broker through the relay. The allowlisted IP stays unreachable.
  • The fixture asserts that its wall is the namespace, not forwarding.
• Sandbox, unconfined (new Category=SandboxUnconfined: uid 1654, CODESPACE_BWRAP_PATH pointing at no binary, RequireConfinement unset): 3/3.
  • The allowlist run is aborted at setup, durable or not, and never launched on the worker's network.
  • The admission predicts its namespace.
• The workflow's assertion blocks pass against these trx files. The new step and its assertion pass when replayed verbatim.
• Mutations turn red, then pass once restored:
  • forwarding step dropped from FilterProbe;
  • CanFilter everywhere (the unconfined lane launches unfiltered);
  • IsSupported everywhere (the non-root run aborts again);
  • the public admission reads CanFilter;
  • the non-root wall assertion removed (a staged uid that can build a namespace passes the guard);
  • the reads-1 branch dropped.