Skip to content

Part VII — Ceilings & red-team (SB20–SB21)

The honest verdicts a reviewer should record:

  • Verified (ceiling #3): the launcher's Linux bwrap branch — a live-kernel deny test proves write-outside-scratch, credential/sibling read, and raw egress are all denied for a real process (incl. a real goose). Unverified: the launcher's newer macOS build_macos branch (ships mac-escape-tests.sh but not yet passed on a mac; mem UNCAPPED, no syscall filtering), the native macOS Seatbelt paths (off a mac). Verified under a precondition: claude's native Linux product arm (2026-09-30, Claude Code 2.1.251) — on Ubuntu only after installing Claude Code's documented bwrap AppArmor profile, which disables bwrap-userns-restrict host-wide. Distinct mechanisms, distinct verdicts. (The sibling security guide's earlier "verified on macOS only" wording has since been CORRECTED to match — the two guides now agree.)
  • Not closed (ceiling #4): T6 / host-as-TCB — a same-host operator shell or key-holding peer is out of scope; the sandbox boxes a mis-steered agent, not a determined local principal. seccomp/Landlock is a further layer not yet added (the launcher is filesystem + netns + NoNewPrivs, not syscall filtering).
  • The write-policy layer (SB24) doesn't move ceiling #4. Its runner and the operator's host are the TCB (a same-host key reader or signing-key holder is out of scope); its live launch by Claude Code/Goose is unverified; it covers claude and goose, codex only through its launcher + role gate, not Copilot. The hook's PR-merge rule, like the delete gate, is evaded by an obfuscated or split command.

The red-team methodology behind the "VERIFIED" claim is an escape/deny test on a live kernel — a boundary is only ever described as "engages as tested."

Detail: Reference Part VII.