fix(sandbox): bound web E2E evidence and service logs

[seonghobae]

Outcome

Third clean layer replacing the monolithic #931; stacked on #1281 and #1280.

• continuously drains each backend/frontend combined stream into a bounded suffix
• stops a service and skips E2E when readiness evidence exceeds its declared budget
• routes E2E command output through the same bounded process-group primitive
• keeps timeout 124 and earlier nonzero failures authoritative while retaining secondary output-limit evidence
• bounds persisted log files and final tail reads, preserving visible truncation markers
• distinguishes output-limited, unsupported-platform, capture-finalization, and copied-path rejection evidence
• performs best-effort group kill, reap, and capture join when service finalization fails

This PR does not modify the pip-audit lock.

Evidence

• 98 focused orchestration tests passed; bounded_subprocess, sandboxed_verify, and sandboxed_web_e2e total 637 statements and 176 branches at 100%
• full stack suite: 1,464 passed, 1 skipped, 16 subtests passed
• full production total: 8,721 statements and 3,308 branches at 100%
• scripts/ci docstrings: 100%
• compileall and git diff --check: pass
• realistic services cover ordinary readiness/E2E, stdout/stderr floods, delayed overflow, sentinel prevention, cleanup failure, timeout precedence, partial UTF-8, and distinct result fields

Stack: #1280 -> #1281 -> this PR. Final clean replacement layer for #931.

---

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e2edb299-a23a-49f9-9fa7-0a6c7c148540

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for b03af163627bcbbad0f0a003d9d19a1e9100694e.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32663883451/job/97254165162)
• Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32663883451/job/97254165162)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file: CHANGELOG.md"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file: CHANGELOG.md"]
  R1 --> V1["required checks"]
  Evidence --> S2["Docs: sandboxed-output-resource-bounds.md"]
  S2 --> I2["operator or user guidance"]
  I2 --> R2["Review risk: Docs: sandboxed-output-resource-bounds.md"]
  R2 --> V2["docs review"]
  Evidence --> S3["CI script: sandboxed_web_e2e.py"]
  S3 --> I3["review and security gate shell path"]
  I3 --> R3["Review risk: CI script: sandboxed_web_e2e.py"]
  R3 --> V3["bash -n plus Strix self-test"]
  Evidence --> S4["Test (6 files)"]
  S4 --> I4["regression suite"]
  I4 --> R4["Review risk: Test (6 files)"]
  R4 --> V4["targeted test run"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: b03af163627bcbbad0f0a003d9d19a1e9100694e
• Workflow run: 32666215458
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for b03af163627bcbbad0f0a003d9d19a1e9100694e.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32663883451/job/97254165162)
• Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32663883451/job/97254165162)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file: CHANGELOG.md"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file: CHANGELOG.md"]
  R1 --> V1["required checks"]
  Evidence --> S2["Docs: sandboxed-output-resource-bounds.md"]
  S2 --> I2["operator or user guidance"]
  I2 --> R2["Review risk: Docs: sandboxed-output-resource-bounds.md"]
  R2 --> V2["docs review"]
  Evidence --> S3["CI script: sandboxed_web_e2e.py"]
  S3 --> I3["review and security gate shell path"]
  I3 --> R3["Review risk: CI script: sandboxed_web_e2e.py"]
  R3 --> V3["bash -n plus Strix self-test"]
  Evidence --> S4["Test (6 files)"]
  S4 --> I4["regression suite"]
  I4 --> R4["Review risk: Test (6 files)"]
  R4 --> V4["targeted test run"]

Loading