feat(casan): establish assurance kernel and harden control plane

packages/casan-harness/scripts/bash/sandbox-run.sh

@@ -36,6 +36,37 @@ CPU_SECONDS="${CASAN_SANDBOX_CPU_SECONDS:-30}"
 # check is the real gate; a container --pids-limit is the production backstop.
 MAX_PROCS="${CASAN_SANDBOX_MAX_PROCS:-}"
 TIMEOUT="${CASAN_SANDBOX_TIMEOUT:-30}"
+SANDBOX_MODE="${CASAN_SANDBOX_MODE:-}"
+STRICT_SANDBOX=0
+if [[ "${CASAN_PROFILE:-}" == "prod" || "${CASAN_PROFILE:-}" == "production" || "${CASAN_PROFILE:-}" == "strict" \
+   || "${CASAN_ENFORCEMENT_MODE:-}" == "enforce" || "${CASAN_SANDBOX_STRICT:-0}" == "1" ]]; then
+  STRICT_SANDBOX=1
+fi
+[[ -n "$SANDBOX_MODE" ]] || { if [[ "$STRICT_SANDBOX" == "1" ]]; then SANDBOX_MODE="container"; else SANDBOX_MODE="static"; fi; }
+
+record_sandbox() { # decision reason backend capability-json
+  local decision="$1" reason="$2" backend="$3" capabilities="$4"
+  local log="$CASAN_STATE_ROOT/logs/sandbox/decisions.jsonl"
+  mkdir -p "$(dirname "$log")"
+  CASAN_SANDBOX_CAPABILITIES="$capabilities" python3 - "$log" "$decision" "$reason" "$backend" "${CASAN_EXECUTION_ID:-sandbox-$$}" <<'PY'
+import json, os, sys
+path, decision, reason, backend, execution_id = sys.argv[1:]
+try:
+    capabilities = json.loads(os.environ.get("CASAN_SANDBOX_CAPABILITIES", "{}"))
+except ValueError:
+    capabilities = {}
+record = {
+    "schema_version": "1.0.0", "category": "runtime_control",
+    "policy_id": "casan.sandbox.backend", "decision": decision,
+    "reason_code": reason, "backend": backend, "execution_id": execution_id,
+    "capabilities": capabilities,
+}
+with open(path, "a", encoding="utf-8") as handle:
+    handle.write(json.dumps(record, sort_keys=True, separators=(",", ":")) + "\n")
+    handle.flush()
+    os.fsync(handle.fileno())
+PY
+}
 
 while [[ "$#" -gt 0 ]]; do
   case "$1" in
@@ -54,12 +85,35 @@ if [[ "$#" -eq 0 ]]; then
   exit 64
 fi
 
-# C6 production form: CASAN_SANDBOX_MODE=container runs under TRUE kernel
+# C6 production form: CASAN_SANDBOX_MODE=container runs under kernel-backed
 # isolation (sandbox-container.sh: --network=none --read-only --pids-limit …).
-# Default stays the static-policy + ulimit scaffold so existing behaviour is
-# unchanged. Falls back to the scaffold if Docker is unavailable.
-if [[ "${CASAN_SANDBOX_MODE:-static}" == "container" ]] && command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1; then
-  exec "$SCRIPT_DIR/sandbox-container.sh" --workspace "$WORKSPACE" --timeout "$TIMEOUT" -- "$@"
+# A requested/required container backend never silently falls back.
+if [[ "$SANDBOX_MODE" == "container" ]]; then
+  if [[ "${CASAN_SANDBOX_TEST_FORCE_UNAVAILABLE:-0}" != "1" ]] \
+     && command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1; then
+    record_sandbox "allow" "sandbox_container_selected" "docker" '{"network_disabled":true,"read_only_root":true,"workspace_write_restricted":true,"environment_filtered":true,"non_root":true,"resource_limits":true}'
+    exec "$SCRIPT_DIR/sandbox-container.sh" --workspace "$WORKSPACE" --timeout "$TIMEOUT" -- "$@"
+  fi
+  if [[ "$STRICT_SANDBOX" == "1" ]]; then
+    record_sandbox "deny" "sandbox_isolation_backend_unavailable" "none" '{"timeout_only":false}'
+    echo "SANDBOX_ISOLATION_REQUIRED backend=container reason=unavailable" >&2
+    exit 2
+  fi
+  if [[ "${CASAN_SANDBOX_ALLOW_STATIC_FALLBACK:-0}" != "1" ]]; then
+    record_sandbox "deny" "sandbox_fallback_not_approved" "none" '{}'
+    echo "SANDBOX_FALLBACK_REQUIRES_EXPLICIT_DEVELOPMENT_APPROVAL" >&2
+    exit 2
+  fi
+  record_sandbox "observe_only" "sandbox_static_fallback_development_only" "static_rlimit" '{"network_disabled":false,"read_only_root":false,"workspace_write_restricted":false,"environment_filtered":false,"non_root":false,"resource_limits":true}'
+  echo "HIGH: container sandbox unavailable; explicit development static fallback is not production isolation" >&2
+elif [[ "$SANDBOX_MODE" != "static" ]]; then
+  record_sandbox "deny" "sandbox_backend_unknown" "$SANDBOX_MODE" '{}'
+  echo "SANDBOX_BACKEND_UNKNOWN mode=$SANDBOX_MODE" >&2
+  exit 2
+elif [[ "$STRICT_SANDBOX" == "1" ]]; then
+  record_sandbox "deny" "sandbox_static_forbidden_in_enforce_mode" "static_rlimit" '{"network_disabled":false,"read_only_root":false}'
+  echo "SANDBOX_STATIC_FORBIDDEN_IN_ENFORCE_MODE" >&2
+  exit 2
 fi
 
 CMD_STR="$*"
@@ -96,6 +150,7 @@ done < <(printf '%s\n' "$CMD_STR" | grep -oE '>>?[[:space:]]*[^[:space:];|&]+' |
 
 # ── 2. Runtime rlimits + wall-clock timeout ─────────────────────────────────
 casan_log debug sandbox "SANDBOX_RUN workspace=$WS_ABS file_kb=$MAX_FILE_KB cpu=$CPU_SECONDS procs=$MAX_PROCS timeout=$TIMEOUT"
+record_sandbox "allow" "sandbox_static_policy_selected" "static_rlimit" '{"network_disabled":false,"read_only_root":false,"workspace_write_restricted":false,"environment_filtered":false,"non_root":false,"resource_limits":true}'
 (
   ulimit -f "$((MAX_FILE_KB * 2))" 2>/dev/null || true   # ulimit -f is in 512-byte blocks
   ulimit -t "$CPU_SECONDS" 2>/dev/null || true