fix(isolation)!: validate explicit fence projections

Require each compute driver to map its native evidence to individual outer-fence guarantees, and reject incomplete projections before a boundary becomes ready. Exercise the assembled remote confirmation path for invalid audit, property, generation, and digest evidence.

BREAKING CHANGE: BoundaryConfig and SandboxRuntimeDescriptor use outer_fence projections rather than the earlier driver_fence representation. State written by earlier builds cannot be decoded; operators must stop and recreate affected sandboxes after upgrading.

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

Author: drew

architecture/sandbox.md

@@ -91,6 +91,21 @@ controller loss fails closed. A digest commits those guarantees to the native
 driver evidence without teaching the shared contract about container networks,
 Kubernetes objects, VM devices, or accelerator resources.
 
+Each driver makes that projection explicitly. Non-empty native evidence alone
+does not establish a guarantee:
+
+| Driver | Native evidence | Guarantees projected by the driver |
+|---|---|---|
+| Docker | Pinned container ID, `network_mode=none`, and no unexpected network attachments | No workload route establishes default-deny, revocation, and controller-loss behavior; the attachment inspection establishes that no unmanaged route exists. |
+| Podman | Pinned container ID, `--network=none`, and no unexpected network attachments | The same container-network facts establish the same four guarantees. |
+| Kubernetes | NetworkPolicy UID and resource version, ingress and egress isolation, and zero workload egress rules | The persisted, selecting policy establishes default-deny and continued denial after revocation or controller loss; zero egress rules establish that no unmanaged route is permitted. |
+| VM | Generation and zero guest network devices | The absent NIC establishes all four guarantees; approved traffic uses the separate supervisor-owned channel. |
+
+The shared contract checks that all four guarantees are present, that the
+projection names the admitted generation, and that its evidence digest matches
+the value passed to the workload-side runtime. It does not infer guarantees or
+interpret the native fields.
+
 When the admitted main process exits, its status and retained terminal output
 remain available. The confirmed sandbox and supervisor-owned access plane continue
 to serve policy-authorized exec and loopback forwarding until explicit stop or

crates/openshell-driver-docker/src/isolation.rs

@@ -12,7 +12,7 @@ use std::net::IpAddr;
 use std::path::PathBuf;
 
 use openshell_isolation_interface::contract::{
-    BackendError, OuterFenceGuarantees, ResolvedWorkloadIdentity,
+    BackendError, OuterFenceGuarantee, OuterFenceGuarantees, ResolvedWorkloadIdentity,
 };
 use openshell_sandbox_backend::GPU_RESOURCE_CLAIM;
 use openshell_sandbox_backend::boundary_protocol::{
@@ -30,18 +30,31 @@ struct DockerOuterFenceEvidence<'a> {
 
 impl DockerOuterFenceEvidence<'_> {
     fn project(&self, generation: &str) -> Result<OuterFenceGuarantees, BackendError> {
-        if self.container_id.is_empty()
-            || self.network_mode != "none"
-            || !self.unexpected_networks.is_empty()
-        {
+        if self.container_id.is_empty() {
             return Err(BackendError::Descriptor(
                 "Docker outer fence evidence is incomplete".to_string(),
             ));
         }
+        let mut established = Vec::new();
+        if self.network_mode == "none" {
+            // With no container network namespace attachment, workload egress
+            // remains denied both after revocation and if the supervisor exits.
+            established.extend([
+                OuterFenceGuarantee::DefaultDenyEgress,
+                OuterFenceGuarantee::RevocationVerified,
+                OuterFenceGuarantee::ControllerLossFailsClosed,
+            ]);
+        }
+        if self.unexpected_networks.is_empty() {
+            established.push(OuterFenceGuarantee::NoUnmanagedEgressPath);
+        }
         let encoded = serde_json::to_vec(self).map_err(|error| {
             BackendError::Descriptor(format!("encode Docker outer fence evidence: {error}"))
         })?;
-        OuterFenceGuarantees::confirmed(generation, &encoded)
+        let projection =
+            OuterFenceGuarantees::from_driver_evidence(generation, established, &encoded)?;
+        projection.validate(generation)?;
+        Ok(projection)
     }
 }
 
@@ -130,6 +143,30 @@ impl DockerBoundarySpec {
 mod tests {
     use super::*;
 
+    #[test]
+    fn outer_fence_projection_rejects_each_missing_native_fact() {
+        let unexpected_networks = vec!["bridge".to_string()];
+        for evidence in [
+            DockerOuterFenceEvidence {
+                container_id: "",
+                network_mode: "none",
+                unexpected_networks: &[],
+            },
+            DockerOuterFenceEvidence {
+                container_id: "container",
+                network_mode: "bridge",
+                unexpected_networks: &[],
+            },
+            DockerOuterFenceEvidence {
+                container_id: "container",
+                network_mode: "none",
+                unexpected_networks: &unexpected_networks,
+            },
+        ] {
+            assert!(evidence.project("generation-1").is_err());
+        }
+    }
+
     #[test]
     fn provisioning_binds_container_and_image_claims() {
         let session_id = openshell_core::SandboxSessionId::new();

crates/openshell-driver-kubernetes/src/isolation.rs

@@ -21,7 +21,7 @@ use k8s_openapi::apimachinery::pkg::apis::meta::v1::LabelSelector;
 use k8s_openapi::apimachinery::pkg::util::intstr::IntOrString;
 use kube::core::ObjectMeta;
 use openshell_isolation_interface::contract::{
-    BackendError, OuterFenceGuarantees, ResolvedWorkloadIdentity,
+    BackendError, OuterFenceGuarantee, OuterFenceGuarantees, ResolvedWorkloadIdentity,
 };
 use openshell_sandbox_backend::boundary_protocol::{
     BoundaryConfig, BoundaryListener, GatewayVerificationKey, SandboxRuntimeDescriptor,
@@ -40,20 +40,31 @@ struct KubernetesOuterFenceEvidence<'a> {
 
 impl KubernetesOuterFenceEvidence<'_> {
     fn project(&self, generation: &str) -> Result<OuterFenceGuarantees, BackendError> {
-        if self.network_policy_uid.is_empty()
-            || self.network_policy_resource_version.is_empty()
-            || !self.ingress_isolated
-            || !self.egress_isolated
-            || self.egress_rule_count != 0
-        {
+        if self.network_policy_uid.is_empty() || self.network_policy_resource_version.is_empty() {
             return Err(BackendError::Descriptor(
                 "Kubernetes outer fence evidence is incomplete".to_string(),
             ));
         }
+        let mut established = Vec::new();
+        if self.ingress_isolated && self.egress_isolated && self.egress_rule_count == 0 {
+            // A persisted policy selecting both directions with no egress rule
+            // continues to deny direct egress after revocation or controller loss.
+            established.extend([
+                OuterFenceGuarantee::DefaultDenyEgress,
+                OuterFenceGuarantee::RevocationVerified,
+                OuterFenceGuarantee::ControllerLossFailsClosed,
+            ]);
+        }
+        if self.egress_isolated && self.egress_rule_count == 0 {
+            established.push(OuterFenceGuarantee::NoUnmanagedEgressPath);
+        }
         let encoded = serde_json::to_vec(self).map_err(|error| {
             BackendError::Descriptor(format!("encode Kubernetes outer fence evidence: {error}"))
         })?;
-        OuterFenceGuarantees::confirmed(generation, &encoded)
+        let projection =
+            OuterFenceGuarantees::from_driver_evidence(generation, established, &encoded)?;
+        projection.validate(generation)?;
+        Ok(projection)
     }
 }
 
@@ -289,6 +300,49 @@ impl KubernetesSandboxRuntimeBoundarySpec {
 mod tests {
     use super::*;
 
+    #[test]
+    fn outer_fence_projection_rejects_each_missing_native_fact() {
+        for evidence in [
+            KubernetesOuterFenceEvidence {
+                network_policy_uid: "",
+                network_policy_resource_version: "1",
+                ingress_isolated: true,
+                egress_isolated: true,
+                egress_rule_count: 0,
+            },
+            KubernetesOuterFenceEvidence {
+                network_policy_uid: "uid",
+                network_policy_resource_version: "",
+                ingress_isolated: true,
+                egress_isolated: true,
+                egress_rule_count: 0,
+            },
+            KubernetesOuterFenceEvidence {
+                network_policy_uid: "uid",
+                network_policy_resource_version: "1",
+                ingress_isolated: false,
+                egress_isolated: true,
+                egress_rule_count: 0,
+            },
+            KubernetesOuterFenceEvidence {
+                network_policy_uid: "uid",
+                network_policy_resource_version: "1",
+                ingress_isolated: true,
+                egress_isolated: false,
+                egress_rule_count: 0,
+            },
+            KubernetesOuterFenceEvidence {
+                network_policy_uid: "uid",
+                network_policy_resource_version: "1",
+                ingress_isolated: true,
+                egress_isolated: true,
+                egress_rule_count: 1,
+            },
+        ] {
+            assert!(evidence.project("generation-1").is_err());
+        }
+    }
+
     fn spec() -> KubernetesSandboxRuntimeBoundarySpec {
         KubernetesSandboxRuntimeBoundarySpec {
             boundary_id: "sandbox-1".to_string(),

crates/openshell-driver-podman/src/isolation.rs

@@ -10,7 +10,9 @@ use std::path::PathBuf;
 
 use openshell_core::ComputeDriverError;
 use openshell_core::proto::compute::v1::DriverSandbox;
-use openshell_isolation_interface::contract::{OuterFenceGuarantees, ResolvedWorkloadIdentity};
+use openshell_isolation_interface::contract::{
+    OuterFenceGuarantee, OuterFenceGuarantees, ResolvedWorkloadIdentity,
+};
 use openshell_sandbox_backend::boundary_protocol::{
     BoundaryConfig, BoundaryListener, GatewayVerificationKey, SandboxRuntimeDescriptor,
     SandboxTlsClientConfig, SandboxTlsServerConfig, SandboxTransport,
@@ -36,14 +38,28 @@ struct PodmanOuterFenceEvidence<'a> {
 
 impl PodmanOuterFenceEvidence<'_> {
     fn project(&self, generation: &str) -> Result<OuterFenceGuarantees, ComputeDriverError> {
-        if self.container_id.is_empty()
-            || self.network_mode != "none"
-            || !self.unexpected_networks.is_empty()
-        {
+        if self.container_id.is_empty() {
             return Err(invalid("Podman outer fence evidence is incomplete"));
         }
+        let mut established = Vec::new();
+        if self.network_mode == "none" {
+            // With no container network namespace attachment, workload egress
+            // remains denied both after revocation and if the supervisor exits.
+            established.extend([
+                OuterFenceGuarantee::DefaultDenyEgress,
+                OuterFenceGuarantee::RevocationVerified,
+                OuterFenceGuarantee::ControllerLossFailsClosed,
+            ]);
+        }
+        if self.unexpected_networks.is_empty() {
+            established.push(OuterFenceGuarantee::NoUnmanagedEgressPath);
+        }
         let encoded = serde_json::to_vec(self).map_err(invalid)?;
-        OuterFenceGuarantees::confirmed(generation, &encoded).map_err(invalid)
+        let projection =
+            OuterFenceGuarantees::from_driver_evidence(generation, established, &encoded)
+                .map_err(invalid)?;
+        projection.validate(generation).map_err(invalid)?;
+        Ok(projection)
     }
 }
 
@@ -349,6 +365,30 @@ mod tests {
         SupervisorAuthBundle,
     };
 
+    #[test]
+    fn outer_fence_projection_rejects_each_missing_native_fact() {
+        let unexpected_networks = vec!["podman".to_string()];
+        for evidence in [
+            PodmanOuterFenceEvidence {
+                container_id: "",
+                network_mode: "none",
+                unexpected_networks: &[],
+            },
+            PodmanOuterFenceEvidence {
+                container_id: "container",
+                network_mode: "bridge",
+                unexpected_networks: &[],
+            },
+            PodmanOuterFenceEvidence {
+                container_id: "container",
+                network_mode: "none",
+                unexpected_networks: &unexpected_networks,
+            },
+        ] {
+            assert!(evidence.project("generation-1").is_err());
+        }
+    }
+
     fn authentication() -> SandboxLaunchAuthentication {
         SandboxLaunchAuthentication {
             supervisor: SupervisorAuthBundle {

crates/openshell-driver-vm/src/isolation/mod.rs

@@ -9,7 +9,7 @@
 //! the common control and boundary behavior.
 
 use openshell_isolation_interface::contract::{
-    BackendError, OuterFenceGuarantees, ResolvedWorkloadIdentity,
+    BackendError, OuterFenceGuarantee, OuterFenceGuarantees, ResolvedWorkloadIdentity,
 };
 use openshell_sandbox_backend::boundary_protocol::{
     BoundaryConfig, BoundaryListener, GatewayVerificationKey, SandboxRuntimeDescriptor,
@@ -26,15 +26,30 @@ struct VmOuterFenceEvidence<'a> {
 
 impl VmOuterFenceEvidence<'_> {
     fn project(&self) -> Result<OuterFenceGuarantees, BackendError> {
-        if self.generation.is_empty() || self.network_device_count != 0 {
+        if self.generation.is_empty() {
             return Err(BackendError::Descriptor(
                 "VM outer fence evidence is incomplete".to_string(),
             ));
         }
+        let established = (self.network_device_count == 0).then_some([
+            // A guest with no NIC has no kernel network path. Closing the
+            // supervisor-owned channel revokes access, and controller loss
+            // cannot introduce a device.
+            OuterFenceGuarantee::DefaultDenyEgress,
+            OuterFenceGuarantee::NoUnmanagedEgressPath,
+            OuterFenceGuarantee::RevocationVerified,
+            OuterFenceGuarantee::ControllerLossFailsClosed,
+        ]);
         let encoded = serde_json::to_vec(self).map_err(|error| {
             BackendError::Descriptor(format!("encode VM outer fence evidence: {error}"))
         })?;
-        OuterFenceGuarantees::confirmed(self.generation, &encoded)
+        let projection = OuterFenceGuarantees::from_driver_evidence(
+            self.generation,
+            established.into_iter().flatten(),
+            &encoded,
+        )?;
+        projection.validate(self.generation)?;
+        Ok(projection)
     }
 }
 
@@ -128,6 +143,26 @@ mod tests {
         generate_sandbox_tls_material,
     };
 
+    #[test]
+    fn outer_fence_projection_rejects_each_missing_native_fact() {
+        assert!(
+            VmOuterFenceEvidence {
+                generation: "",
+                network_device_count: 0,
+            }
+            .project()
+            .is_err()
+        );
+        assert!(
+            VmOuterFenceEvidence {
+                generation: "generation-1",
+                network_device_count: 1,
+            }
+            .project()
+            .is_err()
+        );
+    }
+
     #[test]
     fn provisioning_binds_identical_resource_claims() {
         let session_id = openshell_core::SandboxSessionId::new();

crates/openshell-isolation-interface/src/contract.rs

@@ -417,9 +417,14 @@ pub struct OuterFenceGuarantees {
 }
 
 impl OuterFenceGuarantees {
-    /// Construct guarantees after the driver has validated its native evidence.
-    pub fn confirmed(
+    /// Bind the guarantees explicitly established by driver-owned evidence.
+    ///
+    /// This constructor deliberately does not infer guarantees from the mere
+    /// presence of evidence. The driver must inspect its native state and
+    /// project each established guarantee before calling this function.
+    pub fn from_driver_evidence(
         generation: impl Into<String>,
+        established: impl IntoIterator<Item = OuterFenceGuarantee>,
         native_evidence: &[u8],
     ) -> Result<Self, BackendError> {
         let generation = generation.into();
@@ -434,12 +439,7 @@ impl OuterFenceGuarantees {
         binding.extend_from_slice(native_evidence);
         Ok(Self {
             generation,
-            established: BTreeSet::from([
-                OuterFenceGuarantee::DefaultDenyEgress,
-                OuterFenceGuarantee::NoUnmanagedEgressPath,
-                OuterFenceGuarantee::RevocationVerified,
-                OuterFenceGuarantee::ControllerLossFailsClosed,
-            ]),
+            established: established.into_iter().collect(),
             evidence_digest: Sha256Digest::compute(&binding),
         })
     }