saphan confine-exec

saphan confine-exec

Apply this host's filesystem confinement and exec the command (far-side confinement)

saphan confine-exec --policy <json> -- <command> [args...]

Re-entry point used on a REMOTE machine: apply the boundary described by --policy using THIS host's own filesystem-confinement facility, then exec the given command inside it.

The facility is chosen by the host, not by the policy — the policy describes a boundary, and which mechanism can express it is a fact of the machine that received it:

linux a Landlock domain applied to THIS process, which then execs the command. Nothing runs between the restriction and the command, and the domain cannot be lifted once applied. darwin an inline seatbelt profile, entered by exec'ing /usr/bin/sandbox-exec with the command inside it. Seatbelt cannot restrict its own process, so this arm depends on one more host binary than the Linux arm does.

There is no best-effort mode on either arm: a kernel without Landlock or below the policy's min_abi, a darwin host without sandbox-exec, and a policy this host cannot express are all named REFUSALS with nothing executed. A degrading sandbox would report success while enforcing less than it claims, which is the failure this whole mechanism exists to remove.

min_abi is a Landlock concept. Seatbelt has no versioned ruleset to compare it against, so a policy carrying min_abi is REFUSED on darwin rather than executed under a floor nothing there can check.

agent_scratch is the mirror image: a DECLARED RULE rather than a path, because the harness keys its scratch directory on the executing host's own temp root and uid and the dispatcher may not know either. This host resolves the rule against itself into one narrow grant (<tmproot>/claude-<uid>, never the temp root), and REFUSES a rule it cannot resolve — including on the Landlock arm, which has no way to express it at all.

Known limit on the Landlock arm, measured rather than assumed: metadata mutation (chmod, chown, utimes, setxattr) is OUTSIDE Landlock at every ABI, so a policy there means "cannot write file CONTENT outside these roots", not "cannot modify anything". Seatbelt's write class is wider and may cover them; that has NOT been measured on this lane, so nothing here claims it either way.

Options