# Eve SOTA execution isolation — `eve.execution-isolation.v1`

- **Task:** 2.6
- **Evaluated:** 2026-09-05
- **Decision:** execution-isolation-enforced
- **ADR gate:** `execution-isolation`
  (docs/adr/ADR-0076-eve-governed-delivery-lifecycle.md)
- **Record digest:**
  `d46371c0f9efa4d86a2695b382456309df500b52f5953ac124405337cbf48176`

## The rule

All eight controls task 2.6 names are separate, independently reachable refusals
over one observation set, every one of them fail-closed: a control that could
not observe its subject refuses, and refuses differently from one whose subject
was observed and was wrong. The drain calls every one of them, records the
decision on the run whether it passed or not, and hands a spawned agent only the
environment the credential control produced.

Each control names a decision this generator finds exported, the refusal codes
it finds inside that function’s own body, a spec title it finds in the spec
sources, and a call site it finds in the drain. A declared code no control
produces fails generation.

## The eight controls

| Control                                | Decision                           | Refuses with                                                                                         | Proved by                                                                     |
| -------------------------------------- | ---------------------------------- | ---------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- |
| branch/worktree isolation              | `admitCheckout`, `admitItemBranch` | `workspace_branch_protected`, `workspace_branch_unexpected`, `workspace_shared`, `workspace_unknown` | "an agent is refused the primary checkout and every protected branch"         |
| dirty-tree protection                  | `admitTreeState`                   | `tree_dirty`, `tree_unknown`, `tree_untracked_residue`                                               | "tracked changes and untracked residue refuse separately"                     |
| remote-divergence handling             | `admitRemoteState`                 | `remote_behind`, `remote_unknown`                                                                    | "behind refuses, ahead does not, and unknown refuses differently"             |
| scoped credentials                     | `scopeChildEnvironment`            | `credential_absent`, `credential_overscoped`                                                         | "the child inherits only what was named, and secrets are counted as withheld" |
| allowed command roots                  | `admitCommandRoot`                 | `command_root_escape`, `command_root_undeclared`                                                     | "a sibling directory sharing a prefix is not inside the root"                 |
| network/secret policy                  | `admitEgress`, `findSecretLeak`    | `egress_host_not_allowed`, `egress_scheme_not_allowed`, `secret_would_leak`                          | "the workbench loopback is reachable while the internet is not"               |
| artifact ceilings                      | `admitArtifacts`                   | `artifact_bytes_exceeded`, `artifact_count_exceeded`, `artifact_path_escape`                         | "artifact ceilings bound count, total bytes, and single-file bytes"           |
| separate implementer/verifier identity | `admitIdentitySeparation`          | `identity_not_separated`                                                                             | "an implementer can never wear the verifier prefix, and the two must differ"  |

All 8 controls are called by the drain, and all 20 declared refusal codes are
produced by one of them — a code no control produces fails generation rather
than sitting in the vocabulary as decoration.

## Wiring

- A spawned agent never inherits this process's environment: true
- The spawn takes a scoped environment, and scopes one itself if a caller
  forgets: true
- The gate refuses the run: true
- The decision is recorded on the run whether it passed or not: true
- Isolation has its own stop reason, distinct from the preflight's: true
- The branch an item runs on is derived from that item: true
- The command root is bound to the repository under drain: true

## Identity

- The store still enforces the `artifact-verifier:` prefix this control
  separates on: true
- The agent contract forbids claiming shipped or verified: true

## Secrecy

- The scanner reports names and offsets, never values: true
- Values too short to be secrets are not scanned: true

## Honest limits

- This record closes task 2.6 only. It adds no provider-free orchestrator model
  or parity proof (2.7) and no live drain or soak result (2.8).
- Isolation is enforced at the boundary the drain controls: which environment
  the child receives, which root it is spawned in, which branch and tree state
  it starts from, and which identity it carries. It is not a kernel sandbox — a
  child that chooses to write outside its root is caught by the artifact control
  after the fact, not prevented by the operating system.
- The egress control decides which destinations the drain itself will admit and
  makes "no network" statable. It does not install a firewall: an agent process
  that opens its own socket is outside what a decision function can prevent, and
  the Codex sandbox flag remains the mechanism that actually withholds the
  network.
- The artifact ceilings are checked against a file list a caller supplies.
  Nothing here walks a filesystem, so a run that never reports its outputs is
  not measured — the ceilings bound what is observed, not what exists.
- The implementer/verifier control enforces the half the drain owns: the
  identity it hands an implementing agent can never be verifier-shaped. The
  other half — that only an unforgeable capability grants verified — is the
  BFF’s, and this record checks that the prefix it binds to is the one the store
  still enforces rather than re-implementing it.
- The branch derived for an item is checked immediately before the spawn. A
  branch changed by something else DURING the run is not re-checked, so this is
  an admission control rather than a continuous one.
- Secret scanning compares against values a caller passes in. A secret this
  drain never learned the value of cannot be found in text, so the control
  bounds disclosure of known credentials rather than proving no secret of any
  kind appears.