sdg: IP 0001 — foundational machine surfaces for an external spec UI

.github/scripts/run-without-network.sh

@@ -1,21 +1,76 @@
 #!/usr/bin/env bash
-# Run a command with network access disabled (TEST-SPEC E-1: the suite must
-# pass with network access disabled after setup, and product invocations run
-# with network access denied).
+# Run a command with network access disabled and as an unprivileged user
+# (TEST-SPEC E-1): the suite must pass with network access disabled after
+# setup, product invocations run with network access denied, and the Linux leg
+# runs product invocations as an unprivileged user so that the permission-based
+# stagings of environment refusals (T13.5-7, T14-9, T14-10) take effect. The
+# harness verifies each staging on itself and reports a privileged runner as a
+# harness error (H-11); this script is what makes the runner unprivileged.
 #
-# The command runs in a fresh network namespace containing only a loopback
-# interface, so the command and every subprocess it spawns (the harness's
-# product invocations included) have no route off the machine, while the
-# Actions runner agent keeps its own connectivity. Failures here are loud by
-# design: falling back to a networked run would silently drop the E-1
-# guarantee.
+# The command runs inside two nested user namespaces, entered by this script
+# re-invoking itself one stage at a time:
+#
+#   outer  `unshare --map-root-user --net`. A fresh network namespace holding
+#          only a loopback interface, so the command and every subprocess it
+#          spawns (the harness's product invocations included) have no route
+#          off the machine while the Actions runner agent keeps its own
+#          connectivity. Root inside this namespace is needed only to bring
+#          loopback up. It must not run the suite: a root-mapped namespace
+#          also carries CAP_DAC_OVERRIDE over every file the runner user owns,
+#          so permission removal is ineffective there — a process writes into
+#          a read-only directory and reads a mode-200 file — exactly the
+#          privileged runner E-1 excludes.
+#
+#   inner  `unshare --map-user --map-group` (util-linux >= 2.38; ubuntu-24.04
+#          ships 2.39). Maps the identity back to the runner's real uid and
+#          gid; executing a program as a non-zero uid inside a user namespace
+#          clears every capability. Mode bits then refuse exactly as they do
+#          for a plain unprivileged process, the network namespace is
+#          inherited, and the uid the harness, git, and the product observe is
+#          the runner's own. The command runs here, after the stage verifies
+#          both properties.
+#
+# Failures here are loud by design: falling back to a networked or privileged
+# run would silently drop the E-1 guarantee.
 set -euo pipefail
 
+me="run-without-network.sh"
+
+case "${1-}" in
+  --stage-outer)
+    # Inside the root-mapped user + network namespaces.
+    uid=$2; gid=$3; shift 3
+    ip link set lo up 2>/dev/null || true
+    exec unshare --map-user="$uid" --map-group="$gid" -- bash "$0" --stage-inner "$uid" "$@"
+    ;;
+  --stage-inner)
+    # Inside the inner user namespace: the runner's own identity, no
+    # capabilities. Verify both before running anything.
+    uid=$2; shift 2
+    if [ "$(id -u)" != "$uid" ]; then
+      echo "$me: uid $(id -u) inside the inner namespace, expected $uid" >&2
+      exit 1
+    fi
+    if ! grep -Eq '^CapEff:[[:space:]]*0+$' /proc/self/status; then
+      echo "$me: capabilities survived the inner namespace (privileged runner, E-1)" >&2
+      exit 1
+    fi
+    exec "$@"
+    ;;
+esac
+
+uid=$(id -u)
+gid=$(id -g)
+if [ "$uid" -eq 0 ]; then
+  echo "$me: refusing to run as root — E-1 requires an unprivileged runner" >&2
+  exit 1
+fi
+
 # Ubuntu 24.04 can restrict unprivileged user namespaces; lift the restriction
 # for this VM so `unshare` needs no root. A no-op where already permitted.
 sudo sysctl -qw kernel.apparmor_restrict_unprivileged_userns=0 2>/dev/null || true
 
 # --map-root-user grants CAP_NET_ADMIN inside the new namespaces (to bring up
-# loopback); the real uid outside remains the runner user.
-exec unshare --map-root-user --net -- \
-  sh -c 'ip link set lo up 2>/dev/null || true; exec "$@"' -- "$@"
+# loopback); the real uid outside remains the runner user, and the inner stage
+# maps it back.
+exec unshare --map-root-user --net -- bash "$0" --stage-outer "$uid" "$gid" "$@"

.github/workflows/ci.yml

@@ -10,9 +10,14 @@
 #
 #   suite-linux    Linux. The full suite — sections 1–17, certification
 #                  included (E-1) — run with network access disabled after
-#                  dependency installation, so product invocations run with
-#                  network denied. Expected red until the product conforms to
-#                  SPEC.md; green is required from then on.
+#                  dependency installation and as an unprivileged identity
+#                  (.github/scripts/run-without-network.sh), so product
+#                  invocations run with network denied and the permission-
+#                  based stagings of environment refusals (T13.5-7, T14-9,
+#                  T14-10) take effect; the harness verifies each staging on
+#                  itself and reports a privileged runner as a harness error.
+#                  Expected red until the product conforms to SPEC.md; green
+#                  is required from then on.
 #
 #   suite-windows  Windows. The E-6 platform-sensitive subset. The E-6
 #                  byte-identity comparison reads the Linux leg's
@@ -27,8 +32,16 @@ name: CI
 
 on:
   pull_request:
+  # GitHub creates no pull_request-event runs while a PR is unmergeable.
+  # PR #7 (patch 0001, branch claude/xspec-ui-apis-4df8fa, standing in for
+  # patch/external-ui-apis) is conflicted with main (specs/PHILOSOPHY.md), so
+  # its CI signal comes from push-event runs on the branch head instead —
+  # same workflow, same tree; checks attach to the head commit and surface on
+  # the PR. Drop that branch from this list once its PR is mergeable again or
+  # the patch completes. (Same channel sdg/initial-build used, kept for
+  # history.)
   push:
-    branches: [main, sdg/initial-build]
+    branches: [main, sdg/initial-build, claude/xspec-ui-apis-4df8fa]
   workflow_dispatch:
 
 concurrency:
@@ -51,7 +64,7 @@ jobs:
         run: npm run typecheck
       - name: Build the product
         run: npm run build
-      - name: Run harness self-tests and certification (network disabled)
+      - name: Run harness self-tests and certification (network disabled, unprivileged)
         run: bash .github/scripts/run-without-network.sh npm run test:self
 
   suite-linux:
@@ -67,17 +80,28 @@ jobs:
       - run: npm ci
       - name: Build the product
         run: npm run build
-      - name: Run the full suite (network disabled after setup, E-1)
+      - name: Run the full suite (network disabled after setup, unprivileged, E-1)
         run: bash .github/scripts/run-without-network.sh npm test
         env:
           XSPEC_E6_EXCHANGE_DIR: ${{ github.workspace }}/.e6-exchange
       - name: Upload E-6 exchange outputs for the Windows leg
-        # No files exist until the harness writes the representative fixture's
-        # outputs into XSPEC_E6_EXCHANGE_DIR on this leg. The exchange lives
-        # in a dot-directory, which upload-artifact v4 excludes by default
-        # (include-hidden-files: false since v4.4) — without the override the
-        # written exchange uploads as nothing and the Windows comparison
-        # fails loudly on a missing manifest (E-6, H-9).
+        # Runs regardless of the suite step's verdict (a step without `if:` is
+        # skipped once an earlier step fails), so an exchange written by the
+        # passing E-6 writer test (test/suite/e6-exchange-writer.test.ts)
+        # always reaches the Windows leg even while unrelated Linux product
+        # tests are red — the Phase 9 red-green period included. `!cancelled()`
+        # rather than `always()`: a cancelled job uploads nothing. The Windows
+        # byte-identity test still fails loudly (H-9) exactly when no exchange
+        # was written — never because some other Linux test failed. No files
+        # exist until the harness writes the representative fixture's outputs
+        # into XSPEC_E6_EXCHANGE_DIR on this leg; `if-no-files-found: ignore`
+        # keeps this step harmless when the suite step never ran or the writer
+        # test wrote nothing. The exchange lives in a dot-directory, which
+        # upload-artifact v4 excludes by default (include-hidden-files: false
+        # since v4.4) — without the override the written exchange uploads as
+        # nothing and the Windows comparison fails loudly on a missing
+        # manifest (E-6, H-9).
+        if: ${{ !cancelled() }}
         uses: actions/upload-artifact@v4
         with:
           name: e6-linux-outputs
@@ -103,9 +127,12 @@ jobs:
       - name: Build the product
         run: npm run build
       - name: Download E-6 exchange outputs from the Linux leg
-        # The artifact does not exist until the Linux leg produces outputs; the
-        # harness's E-6 comparison must itself fail loudly when the exchange
-        # directory is missing while the product exists.
+        # The artifact is absent only when the Linux job produced no exchange
+        # (it died before its suite step, or the E-6 writer test itself did not
+        # complete) — its upload step runs whenever that job is not cancelled,
+        # red product tests notwithstanding. The harness's E-6 comparison must
+        # itself fail loudly when the exchange directory is missing while the
+        # product exists.
         continue-on-error: true
         uses: actions/download-artifact@v4
         with: