[hsliuustc0106]

Fixes #221. Related to #198, #218 and #220.

Audit the pinned DSH 0.2.0-rc.2 services/providers and keep the room interface thin over existing Cordis lifecycle, room scheduling, grants, approvals and task state. Document why current one-shot ACP/Codex/Claude Code/DSH SDK providers do not directly provide a persistent room participant, and distinguish filesystem sandbox policy from network/process isolation.

Add an opt-in synthetic Docker boundary probe using a digest-pinned image, separate Writer/verifier workspaces, non-root execution, read-only root, no network, a clean process environment, selected resource limits and controlled artifact handoff. Handle cancellation/cleanup failures without reporting success. This tool does not activate or confine a real DSH/OpenCode runtime.

Validation at cf73b0dfa96cf2701e3283cf037b5cd8efadec78: full TZ=UTC DSH_HARNESS=/workspace/FlyBot/core/dev/harness npm run verify passed all 1,079 tests (core 762, social 164, tree 56, repo 60, interop 37; zero skipped). Pack, strict declaration typecheck, changelog, actionlint and source whitespace checks passed. The five probe unit tests first failed before the module existed; they now cover digest/argument validation, confinement settings and cleanup failure/cancellation. They use injected Docker calls under the normal no-network/no-process preload.

The actual opt-in probe also passed at this tip:

node dev/interop/isolation/probe.mjs --image node@sha256:a5f4366e834695d5f363b920c104953a535d3a9864d1bdf74566a0ebe01daee5

Docker 28.4.0, container Node v24.22.0; host checks used Node 24.19.0. Both sides wrote only their own mounted work area, failed peer/host-marker reads and root writes, observed ENETUNREACH for the network attempt, and received only PATH/TZ. The verifier checked the copied synthetic artifact. Container removal and temporary-file cleanup completed; no probe containers remain.

Not run: real runtime/model execution, human approval UI/acceptance, online credential/egress policy, adversarial archive/symlink/escape attacks, exhaustion or parallel stress, restart/room-close integration, independent review. Memory/CPU/PID values are inspected configuration, not stress-test evidence. Containers share a kernel and the coordinator/daemon remain trusted. The probe uses synthetic host directories, not production directory permissions. No #198 acceptance or full sandbox certification is claimed; see docs/interop/runtime-reuse-isolation.md.

Observed synthetic probe report

{
  "schemaVersion": 1,
  "purpose": "synthetic-offline-isolation-probe",
  "status": "passed",
  "started": "2026-10-17T17:08:33.585Z",
  "ended": "2026-10-17T17:08:38.154Z",
  "image": "node@sha256:a5f4366e834695d5f363b920c104953a535d3a9864d1bdf74566a0ebe01daee5",
  "imageId": "sha256:a797d6440ed0b09e51fb884f30e47ec14cbf58482c5e19db681a0cb8df45b089",
  "docker": "28.4.0",
  "artifactSha256": "29b0292d771d113cbe9c45ac57ae19deba347b959b594c7c1f898e05d6d1b60e",
  "observations": [
    {
      "role": "writer",
      "node": "v24.22.0",
      "checks": {
        "ownWrite": true,
        "peerPrivateRead": "denied",
        "hostPrivateRead": "denied",
        "rootWrite": "denied",
        "ambientEnvironment": "PATH,TZ only",
        "externalNetwork": "ENETUNREACH",
        "artifact": "produced"
      },
      "configured": {
        "user": "1000:1000",
        "readOnlyRoot": true,
        "network": "none",
        "memoryBytes": 134217728,
        "nanoCpus": 1000000000,
        "pids": 64,
        "capDrop": [
          "ALL"
        ],
        "noNewPrivileges": true
      }
    },
    {
      "role": "verifier",
      "node": "v24.22.0",
      "checks": {
        "ownWrite": true,
        "peerPrivateRead": "denied",
        "hostPrivateRead": "denied",
        "rootWrite": "denied",
        "ambientEnvironment": "PATH,TZ only",
        "externalNetwork": "ENETUNREACH",
        "artifact": "verified"
      },
      "configured": {
        "user": "1000:1000",
        "readOnlyRoot": true,
        "network": "none",
        "memoryBytes": 134217728,
        "nanoCpus": 1000000000,
        "pids": 64,
        "capDrop": [
          "ALL"
        ],
        "noNewPrivileges": true
      }
    }
  ],
  "cleanup": "completed"
}

A separate actual SIGTERM interruption check exited nonzero (ABORT_ERR; timeout wrapper exit 124) and left no flybot-probe-* containers. This checks the probe's handled interruption path, not FlyBot plugin unload or runtime cancellation.

[hsliuustc0106]

LGTM (cannot self-approve from this account). Approve with nit: careful docs + opt-in fail-closed probe; does not overclaim #198. One inline nit on the peer/host read check.

[hsliuustc0106]

Nit: /peer/private.txt and /host-private.txt are unmounted paths, so this usually asserts ENOENT rather than mount confinement (EACCES). Fine for the documented synthetic probe; a stronger check would RO-bind the peer workspace and expect denial on a real mount.