Disciplines · Audits

Eve SOTA execution isolation — eve.execution-isolation.v1

All eight controls task 2.6 names are separate, independently reachable refusals over one observation set, every one of them fail-closed: a control that could not observe its subject refuses, and refuses differently from one whose subject

6sections4 minread
Markdown source
On this page
  • Task: 2.6
  • Evaluated: 2026-09-05
  • Decision: execution-isolation-enforced
  • ADR gate: execution-isolation (docs/adr/ADR-0076-eve-governed-delivery-lifecycle.md)
  • Record digest: d46371c0f9efa4d86a2695b382456309df500b52f5953ac124405337cbf48176

The rule#

All eight controls task 2.6 names are separate, independently reachable refusals over one observation set, every one of them fail-closed: a control that could not observe its subject refuses, and refuses differently from one whose subject was observed and was wrong. The drain calls every one of them, records the decision on the run whether it passed or not, and hands a spawned agent only the environment the credential control produced.

Each control names a decision this generator finds exported, the refusal codes it finds inside that function’s own body, a spec title it finds in the spec sources, and a call site it finds in the drain. A declared code no control produces fails generation.

The eight controls#

Control Decision Refuses with Proved by
branch/worktree isolation admitCheckout, admitItemBranch workspace_branch_protected, workspace_branch_unexpected, workspace_shared, workspace_unknown "an agent is refused the primary checkout and every protected branch"
dirty-tree protection admitTreeState tree_dirty, tree_unknown, tree_untracked_residue "tracked changes and untracked residue refuse separately"
remote-divergence handling admitRemoteState remote_behind, remote_unknown "behind refuses, ahead does not, and unknown refuses differently"
scoped credentials scopeChildEnvironment credential_absent, credential_overscoped "the child inherits only what was named, and secrets are counted as withheld"
allowed command roots admitCommandRoot command_root_escape, command_root_undeclared "a sibling directory sharing a prefix is not inside the root"
network/secret policy admitEgress, findSecretLeak egress_host_not_allowed, egress_scheme_not_allowed, secret_would_leak "the workbench loopback is reachable while the internet is not"
artifact ceilings admitArtifacts artifact_bytes_exceeded, artifact_count_exceeded, artifact_path_escape "artifact ceilings bound count, total bytes, and single-file bytes"
separate implementer/verifier identity admitIdentitySeparation identity_not_separated "an implementer can never wear the verifier prefix, and the two must differ"

All 8 controls are called by the drain, and all 20 declared refusal codes are produced by one of them — a code no control produces fails generation rather than sitting in the vocabulary as decoration.

Wiring#

  • A spawned agent never inherits this process's environment: true
  • The spawn takes a scoped environment, and scopes one itself if a caller forgets: true
  • The gate refuses the run: true
  • The decision is recorded on the run whether it passed or not: true
  • Isolation has its own stop reason, distinct from the preflight's: true
  • The branch an item runs on is derived from that item: true
  • The command root is bound to the repository under drain: true

Identity#

  • The store still enforces the artifact-verifier: prefix this control separates on: true
  • The agent contract forbids claiming shipped or verified: true

Secrecy#

  • The scanner reports names and offsets, never values: true
  • Values too short to be secrets are not scanned: true

Honest limits#

  • This record closes task 2.6 only. It adds no provider-free orchestrator model or parity proof (2.7) and no live drain or soak result (2.8).
  • Isolation is enforced at the boundary the drain controls: which environment the child receives, which root it is spawned in, which branch and tree state it starts from, and which identity it carries. It is not a kernel sandbox — a child that chooses to write outside its root is caught by the artifact control after the fact, not prevented by the operating system.
  • The egress control decides which destinations the drain itself will admit and makes "no network" statable. It does not install a firewall: an agent process that opens its own socket is outside what a decision function can prevent, and the Codex sandbox flag remains the mechanism that actually withholds the network.
  • The artifact ceilings are checked against a file list a caller supplies. Nothing here walks a filesystem, so a run that never reports its outputs is not measured — the ceilings bound what is observed, not what exists.
  • The implementer/verifier control enforces the half the drain owns: the identity it hands an implementing agent can never be verifier-shaped. The other half — that only an unforgeable capability grants verified — is the BFF’s, and this record checks that the prefix it binds to is the one the store still enforces rather than re-implementing it.
  • The branch derived for an item is checked immediately before the spawn. A branch changed by something else DURING the run is not re-checked, so this is an admission control rather than a continuous one.
  • Secret scanning compares against values a caller passes in. A secret this drain never learned the value of cannot be found in text, so the control bounds disclosure of known credentials rather than proving no secret of any kind appears.