feat(plugins): extend native confinement and IPC diagnostics

.github/workflows/file-observation-regression.yml

@@ -152,6 +152,38 @@ jobs:
           path: ${{ runner.temp }}/observation-membership-base.log
           if-no-files-found: error
           retention-days: 14
+      - name: Verify pending observer ownership without the fix
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 - <<'PYCONTROL'
+          import os,re,subprocess
+          from pathlib import Path
+          owner=Path('crates/cyber-tools/src/file_changes/owner.rs')
+          source=owner.read_text()
+          needle='self.sessions.is_empty() && !self.waiting_for_previous'
+          assert source.count(needle)==1
+          try:
+              owner.write_text(source.replace(needle,'self.sessions.is_empty()'))
+              name='file_changes::owner::tests::readmission_reuses_one_pending_replacement_until_previous_owner_settles'
+              result=subprocess.run(['cargo','test','--locked','-p','cyber-tools','--lib',name,'--','--exact'],capture_output=True,text=True)
+              log=result.stdout+result.stderr
+              Path(os.environ['RUNNER_TEMP'],'observation-pending-owner-base.log').write_text(log)
+              assert result.returncode!=0, log[-8000:]
+              assert re.search(r'^test '+re.escape(name)+r' \.\.\. FAILED$',log,re.M), log[-8000:]
+              assert 'readmission must not grow a task chain behind a settling owner' in log, log[-8000:]
+          finally:
+              owner.write_text(source)
+          PYCONTROL
+      - name: Preserve pending observer ownership regression evidence
+        if: always() && runner.os == 'Linux'
+        uses: actions/upload-artifact@v4
+        with:
+          name: pending-observer-owner-baseline
+          path: ${{ runner.temp }}/observation-pending-owner-base.log
+          if-no-files-found: error
+          retention-days: 14
       - name: Verify known-private retirement without the fix
         if: runner.os == 'Linux'
         shell: bash

.github/workflows/plugin-confinement-proof.yml

@@ -139,15 +139,163 @@ jobs:
         with:
           node-version: 22
       - name: Verify capability matrix and original-signature exec controls
+        id: native_setup
         shell: bash
         run: |
           set -euo pipefail
           # Acceptance requires original-image positive startup, denied self-exec,
           # matching-identity counterexamples and descriptor isolation.
           # The historical re-signing experiment remains an opt-in diagnostic;
           # its failed startup control is never counted as confinement.
-          node --experimental-strip-types scripts/probes/plugin-confinement/run.mts --runtime native --macos-signing-native --report "$RUNNER_TEMP/matrix.json" > "$RUNNER_TEMP/matrix.log" 2>&1
+          node --experimental-strip-types scripts/probes/plugin-confinement/run.mts --runtime native --macos-signing-native --macos-private-unix --report "$RUNNER_TEMP/matrix.json" > "$RUNNER_TEMP/matrix.log" 2>&1
           node --experimental-strip-types scripts/probes/plugin-confinement/macos_signing_exec.mts --report "$RUNNER_TEMP/exec.json" > "$RUNNER_TEMP/exec.log" 2>&1
+      - name: Reject missing scratch UNIX policy
+        shell: bash
+        run: |
+          set -euo pipefail
+          control="$RUNNER_TEMP/macos-private-unix-missing-grant"
+          python3 - "$control" <<'PYCONTROL'
+          from pathlib import Path
+          import shutil, sys
+          target = Path(sys.argv[1])
+          shutil.copytree('scripts/probes/plugin-confinement', target, ignore=shutil.ignore_patterns('evidence', '__pycache__'))
+          driver = target / 'macos_policy.mts'
+          text = driver.read_text()
+          before = '  if (privateUnix) {'
+          assert text.count(before) == 1
+          driver.write_text(text.replace(before, '  if (false) { // Missing scratch UNIX grant control.'))
+          PYCONTROL
+          log="$RUNNER_TEMP/private-unix-missing-grant.log"
+          if node --experimental-strip-types "$control/run.mts" --runtime native --macos-signing-native --macos-private-unix --report "$control/result.json" > "$log" 2>&1; then
+            echo 'Missing private UNIX policy unexpectedly passed' >&2
+            exit 1
+          fi
+          python3 - "$log" <<'PYCONTROL'
+          from pathlib import Path
+          import sys
+          text = Path(sys.argv[1]).read_text()
+          assert 'no-capabilities: private UNIX runtime exchange failed: [false,false]' in text, text
+          PYCONTROL
+      - name: Verify owned UNIX endpoints and native peer identity
+        shell: bash
+        run: |
+          set -euo pipefail
+          node --experimental-strip-types scripts/probes/plugin-confinement/macos_private_ipc.mts --report "$RUNNER_TEMP/unix-boundary.json" > "$RUNNER_TEMP/unix-boundary.log" 2>&1
+      - name: Reject widened UNIX endpoint scope independently
+        if: always() && !cancelled() && steps.native_setup.outcome == 'success'
+        shell: bash
+        run: |
+          set -euo pipefail
+          log="$RUNNER_TEMP/unix-missing-scope.log"
+          if node --experimental-strip-types scripts/probes/plugin-confinement/macos_private_ipc.mts --missing-scope > "$log" 2>&1; then
+            echo 'Missing UNIX outbound scope unexpectedly passed' >&2
+            exit 1
+          fi
+          python3 - "$log" <<'PYCONTROL'
+          from pathlib import Path
+          import sys
+          text = Path(sys.argv[1]).read_text()
+          assert 'macOS datagram endpoint escaped scratch:' in text, text
+          import json, re
+          match = re.search(r'macOS datagram endpoint escaped scratch: (\{[^\n]+\})', text)
+          assert match, text
+          entry = json.loads(match[1])
+          race = entry['observed']['datagram_race']
+          assert race['host_control'] and race['settled'] and not race['failed'], entry
+          assert entry['datagram_receipts'] == 7 + race['host_acks'], entry
+          for token in ['"owner_received_fixture":true', '"acknowledged":true',
+                        '"owner_datagram_received_fixture":true', '"private_datagram":[true,true,true]',
+                        '"private_aliases":[true,true]', '"private_peer_matches":true']:
+              assert token in text, text
+          PYCONTROL
+      - name: Reject unknown datagram exchange failures
+        if: always() && !cancelled() && steps.native_setup.outcome == 'success'
+        shell: bash
+        run: |
+          set -euo pipefail
+          control="$RUNNER_TEMP/macos-datagram-bind-failure"
+          python3 - "$control" <<'PYCONTROL'
+          from pathlib import Path
+          import shutil, sys
+          target = Path(sys.argv[1])
+          shutil.copytree('scripts/probes/plugin-confinement', target, ignore=shutil.ignore_patterns('evidence', '__pycache__'))
+          fixture = target / 'macos_datagram_race.h'
+          source = fixture.read_text()
+          needle = 'int client = datagram_socket(client_path);'
+          assert source.count(needle) == 1
+          fixture.write_text(source.replace(needle, 'int client = datagram_socket(alias);'))
+          PYCONTROL
+          log="$RUNNER_TEMP/unix-datagram-bind-failure.log"
+          if node --experimental-strip-types "$control/macos_private_ipc.mts" > "$log" 2>&1; then
+            echo 'Occupied datagram client bind unexpectedly passed' >&2
+            exit 1
+          fi
+          python3 - "$log" <<'PYCONTROL'
+          from pathlib import Path
+          import errno, json, re, sys
+          text = Path(sys.argv[1]).read_text()
+          match = re.search(r'private datagram race control failed: (\{[^\n]+\})', text)
+          assert match, text
+          entry = json.loads(match[1])
+          race = entry['observed']['datagram_race']
+          assert entry['flags']['unrestricted'] and not race['private_control'], entry
+          assert race['failure_stage'] == 'client_bind', entry
+          assert race['failure_errno'] == errno.EADDRINUSE, entry
+          assert race['refused'] == 0 and race['attempts'] == 0, entry
+          diagnostic = entry['kernel_diagnostic']
+          assert diagnostic['pid'] == entry['observed']['pid'] > 0, entry
+          assert len(diagnostic['output']) <= 16384 and len(diagnostic['stderr']) <= 2048, entry
+          PYCONTROL
+      - name: Reject missing private descriptor reception
+        if: always() && !cancelled() && steps.native_setup.outcome == 'success'
+        shell: bash
+        run: |
+          set -euo pipefail
+          log="$RUNNER_TEMP/unix-dropped-rights.log"
+          if node --experimental-strip-types scripts/probes/plugin-confinement/macos_private_ipc.mts --drop-rights > "$log" 2>&1; then
+            echo 'Missing SCM_RIGHTS reception unexpectedly passed' >&2
+            exit 1
+          fi
+          python3 - "$log" <<'PYCONTROL'
+          from pathlib import Path
+          import sys
+          text = Path(sys.argv[1]).read_text()
+          assert 'private SCM_RIGHTS exchange failed:' in text, text
+          for token in ['"original_closed":true', '"sent":true', '"token":true',
+                        '"received":false', '"rights_payload":"A"', '"private_aliases":[true,true]']:
+              assert token in text, text
+          PYCONTROL
+      - name: Reject owner payload path re-resolution
+        if: always() && !cancelled() && steps.native_setup.outcome == 'success'
+        shell: bash
+        run: |
+          set -euo pipefail
+          control="$RUNNER_TEMP/macos-rights-path-reader"
+          python3 - "$control" <<'PYCONTROL'
+          from pathlib import Path
+          import shutil, sys
+          target = Path(sys.argv[1])
+          shutil.copytree('scripts/probes/plugin-confinement', target, ignore=shutil.ignore_patterns('evidence', '__pycache__'))
+          driver = target / 'macos_private_ipc.mts'
+          text = driver.read_text()
+          before = '    const rights_payload = contents.subarray(0, count).toString();'
+          assert text.count(before) == 1
+          driver.write_text(text.replace(before, '    const rights_payload = readFileSync(join(paths.scratch, "rights.bin"), "utf8");'))
+          PYCONTROL
+          log="$RUNNER_TEMP/unix-rights-path-reader.log"
+          if node --experimental-strip-types "$control/macos_private_ipc.mts" > "$log" 2>&1; then
+            echo 'Owner path re-resolution unexpectedly passed' >&2
+            exit 1
+          fi
+          python3 - "$log" <<'PYCONTROL'
+          from pathlib import Path
+          import sys
+          text = Path(sys.argv[1]).read_text()
+          assert 'received descriptor file effect:' in text, text
+          for token in ['"rights_path_replaced":true', '"rights_link_count":0',
+                        '"rights_payload":"XX"', '"written":true', '"original_closed":true']:
+              assert token in text, text
+          PYCONTROL
       - name: Retain signing-identity candidate evidence
         if: always()
         uses: actions/upload-artifact@v4
@@ -156,6 +304,13 @@ jobs:
           path: |
             ${{ runner.temp }}/matrix.json
             ${{ runner.temp }}/matrix.log
+            ${{ runner.temp }}/private-unix-missing-grant.log
+            ${{ runner.temp }}/unix-boundary.json
+            ${{ runner.temp }}/unix-boundary.log
+            ${{ runner.temp }}/unix-missing-scope.log
+            ${{ runner.temp }}/unix-datagram-bind-failure.log
+            ${{ runner.temp }}/unix-dropped-rights.log
+            ${{ runner.temp }}/unix-rights-path-reader.log
             ${{ runner.temp }}/exec.json
             ${{ runner.temp }}/exec.log
           if-no-files-found: error
@@ -197,7 +352,7 @@ jobs:
           if [[ "$runtime" == python-system ]]; then
             runtime=python
           fi
-          args=(--runtime "$runtime" --macos-signing-runtime --report "$RUNNER_TEMP/proof.json")
+          args=(--runtime "$runtime" --macos-signing-runtime --macos-private-unix --report "$RUNNER_TEMP/proof.json")
           if [[ "$PROOF_RUNTIME" == python ]]; then
             args+=(--python "$(command -v python3)")
           elif [[ "$PROOF_RUNTIME" == python-system ]]; then