fix(sandbox): bound verification evidence and copied links

[seonghobae]

Outcome

Second clean layer replacing the monolithic #931; stacked on #1280.

• routes sandboxed verification through the reusable bounded subprocess primitive
• gives stdout and stderr explicit byte budgets and distinct limit/unsupported evidence
• rejects absolute and escaping copied-tree symlinks before untrusted commands run
• retains safe internal relative symlinks and the existing copy ignore policy
• reports invalid roots and boundary rejection without host-path or traceback disclosure
• preserves timeout exit 124 and adds stable path-boundary exit 122

This layer does not modify sandboxed_web_e2e or the pip-audit lock.

Evidence

• 58 focused tests passed across the core and verifier; 390 statements and 102 branches at 100%
• full stack suite: 1,438 passed, 1 skipped, 16 subtests passed
• full production total: 8,628 statements and 3,278 branches at 100%
• scripts/ci docstrings: 100%
• compileall and git diff --check: pass
• APA 7th doctoring cites Python 3.14.6 copytree behavior and records internal-cycle and post-copy mutation limitations

Stack: #1280 -> this PR. Part 2 of the clean replacement for #931.

---

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a79a7889-b99e-4336-9197-c0601f65a8cd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 2 new potential issues.

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for 1d744878ea9768b2be59cb05360a4bd4eea2da17.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32663487251/job/97253150477)
• Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32663487251/job/97253150477)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file: CHANGELOG.md"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file: CHANGELOG.md"]
  R1 --> V1["required checks"]
  Evidence --> S2["Docs (2 files)"]
  S2 --> I2["operator or user guidance"]
  I2 --> R2["Review risk: Docs (2 files)"]
  R2 --> V2["docs review"]
  Evidence --> S3["CI script: sandboxed_verify.py"]
  S3 --> I3["review and security gate shell path"]
  I3 --> R3["Review risk: CI script: sandboxed_verify.py"]
  R3 --> V3["bash -n plus Strix self-test"]
  Evidence --> S4["Test (4 files)"]
  S4 --> I4["regression suite"]
  I4 --> R4["Review risk: Test (4 files)"]
  R4 --> V4["targeted test run"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 1d744878ea9768b2be59cb05360a4bd4eea2da17
• Workflow run: 32664884722
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for 1d744878ea9768b2be59cb05360a4bd4eea2da17.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32663487251/job/97253150477)
• Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32663487251/job/97253150477)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file: CHANGELOG.md"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file: CHANGELOG.md"]
  R1 --> V1["required checks"]
  Evidence --> S2["Docs (2 files)"]
  S2 --> I2["operator or user guidance"]
  I2 --> R2["Review risk: Docs (2 files)"]
  R2 --> V2["docs review"]
  Evidence --> S3["CI script: sandboxed_verify.py"]
  S3 --> I3["review and security gate shell path"]
  I3 --> R3["Review risk: CI script: sandboxed_verify.py"]
  R3 --> V3["bash -n plus Strix self-test"]
  Evidence --> S4["Test (4 files)"]
  S4 --> I4["regression suite"]
  I4 --> R4["Review risk: Test (4 files)"]
  R4 --> V4["targeted test run"]

Loading