refactor(runtime): confine and reduce unsafe code

[drew]

Summary

Reduce Rust unsafe syntax sites from 503 to 344 (159 removed), and confine the remaining sites to openshell-sandbox (238), openshell-driver-vm (56), and the explicitly excluded Windows MXC driver (50). Replace ordinary descriptor, resource, identity and build configuration operations with safe APIs while retaining explicit kernel ABI, fork/pre-exec and FFI boundaries.

Related Issue

Directly requested maintainer cleanup. No matching accepted issue is currently linked. This is a draft because moving the Linux mechanism module across crate boundaries requires an accepted issue reference before the PR is ready.

Changes

• Move Linux isolation mechanisms and qualification probes from openshell-isolation-interface::linux to openshell-sandbox::linux; migrate all in-repository consumers and leave the backend interface dependency-light.
• Add forbid(unsafe_code) to the CLI, supervisor, sandbox backend and isolation interface targets, and network supervisor library.
• Replace ordinary resource limits, identity/group operations, socket options, sealed provider-file construction, PTY sizing, descriptor setup and probe I/O with safe nix/rustix/standard-library APIs. Preserve syscall selection, flags, errno, native-endian eventfd transfers and exact intercepted/denied syscall tests.
• Replace global test-environment mutations with isolated subprocess fixtures and completion markers. Keep existing lookup/precedence assertions and fixtures.
• Configure vendored protobuf compilation explicitly; handle ambient PROTOC_INCLUDE in a child process rather than mutating build-script globals.
• Use process-local SSH verbosity defaults with explicit child-environment propagation, asynchronous foreground signal handling, and a stdin-based private VM-supervisor liveness handoff. Add verbosity, foreground-signal and liveness regressions.
• Keep allocation instrumentation in the VM crate's portable, default-feature-disabled test feature; preserve allocation and query measurements.
• Document crate ownership in the relevant READMEs. The saved source catalog and detailed reviews remain in the local ignored plans/unsafe-catalog/ directory; the current crate summary is below.

Crate	Remaining Rust unsafe sites
openshell-sandbox	238 (135 non-test/probes, 103 tests)
openshell-driver-vm	56 (47 non-test, 9 test allocator sites)
openshell-driver-mxc	50 (excluded from cleanup)
All other crates	0
Total	344

Counts include unsafe blocks, functions, implementations and FFI function-pointer declarations, not individual syscalls. Relocated sites are not counted as removals. Generated Go unsafe calls are unchanged.

Compatibility details: external Rust users of openshell_isolation_interface::linux must migrate their imports. The private driver/supervisor flag is now --parent-liveness-stdin, so those binaries must be built together. Tokio foreground signal handlers remain installed for the process lifetime. The IsolationBackend contract and public wire protocol are unchanged.

Testing

• mise run pre-commit passes, including workspace and sandbox perf-harness lint checks.
• Full RUST_TEST_THREADS=4 mise run test passes after the final descriptor batch. The initial run had two supervisor-network plaintext failures; all five plaintext tests passed on a serial retry, and both failures also passed in the full-suite retry. Their initial failure cause is not proven.
• Existing tests preserved and focused regressions added: the capability review retained all 1,521 original tests in changed files, with 1,527 tests declared after additions; final descriptor cleanup retained all function/test names.
• OPENSHELL_E2E_DOCKER_TEST=transparent_tcp mise run e2e:docker passes after the final batch: six CLI conformance scenarios and native TCP policy-DNS/fail-closed coverage. The Podman-specific scenario is skipped in the Docker lane.
• Earlier full cleanup validation passed 18 Docker lifecycle scenarios, minimal VM allocation-feature compilation, explicit proxy allocation/query baseline, and protobuf builds with invalid ambient tooling settings.
• AST unsafe inventory, source locations, crate boundaries and git diff --check verified.
• Full mise run ci: attempted, but stopped at 20 Go lint errors in unchanged SDK files (5 errcheck, 12 revive, 3 staticcheck).
• Native macOS/Windows and live VM boot/vsock validation. The macOS cross-build attempt stopped in aws-lc's C build because the Linux host lacks the Apple compiler/SDK; Windows MXC was not modified.

Checklist

• Follows Conventional Commits.
• Commits are signed off (DCO).
• Crate architecture READMEs updated; agent skill references reviewed for drift.
• Accepted issue linked for the crate-boundary change.

Rebase validation

Rebased onto main at a48920ac0. Retained main's driver-independent mTLS/bearer TLS behavior, bearer-passthrough exposure assertions, 0600 provider memfd metadata and new upload/broker tests. Pre-commit and Docker transparent-TCP/conformance passed after rebase. The first full run timed out in main's new metadata-loopback broker test; that test passed alone on retry. The full RUST_TEST_THREADS=4 mise run test retry passed after the heavy Docker builds completed, including the metadata-loopback test and updated mTLS tests.

CI follow-up

Commit 06907512e fixes the macOS dead-code lint by compiling the boundary environment installer only on Linux, and fixes both Linux nextest signal-probe failures by publishing readiness from an executed Rust workload rather than checking the external sleep executable filename. The old failure was reproduced with a renamed binary; the revised fixture passes nextest with that PATH. Pre-commit and the full local test suite passed. Remote verification on commit 06907512e passed all three previously failing jobs in Branch Checks run 37051739763: macOS Rust lint and both Linux Rust test jobs. Other checks are still running; no failures are currently reported.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

Label test:e2e applied for 3cf6200. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[johntmyers]

gator-agent

PR Review Status

The independent code review found no blocking defects in the unsafe-code cleanup. Drew, I checked your CI follow-up: the macOS lint and both Linux Rust test jobs now pass on this head, and the full E2E suite is green.

I applied test:windows because the shared protobuf build setup and supervisor's non-Unix path changed, then queued the current-head Windows MSVC workflow rerun. Gator will check its x64 and ARM64 results before handing off for maintainer approval.

Blocking findings: None.

Carried findings: None.

Gator metadata

• Validation: Maintainer-authored runtime safety refactor; author verified as repository admin.
• Docs: Public CLI, configuration and wire behavior preserved; crate READMEs and the maintainer's PR description explain the external Rust import migration and paired private liveness flag change. No published user workflow change identified.
• Checks: Current-head Branch Checks, Helm Lint, Trivy Changes and DCO pass. Windows MSVC rerun queued; both x64 and ARM64 lint/test jobs must pass.
• E2E: test:e2e applied; current-head Branch E2E Checks run 37051741133 passed, including Docker, Podman, VM and Kubernetes coverage.
• Windows: test:windows applied; current-head run 37051739780 rerun queued.
• Head SHA: 06907512e990533d1de19bda9177dbc7e4e4e2e0
• Base SHA: a48920ac042554ae7cb17f56146e5c1e7881ccae
• Merge base SHA: a48920ac042554ae7cb17f56146e5c1e7881ccae
• Patch ID: 3aa2e97e56b4c3977b8883cab4e238c49563306c
• Gator payload: 10
• Review mode: initial
• Previous reviewed SHA: none
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:watch-pipeline

[johntmyers]

gator-agent

PR Review Status

Drew, I checked your latest platform-specific SSH lint fix against the four errors from the earlier Windows run. The independent follow-up review of that change and the author-only rebase adaptations found no blocking defects; the prior review remains satisfied.

Branch Checks, Helm Lint, Trivy Changes and DCO pass on this head. E2E is running. I restored test:windows because the PR changes Windows-supported code, but the current Windows run skipped both architectures. The sandbox denied its rerun; a narrowly scoped policy proposal was approved but has not been reloaded.

Action required: The sandbox operator must activate the approved policy proposal 6e11bab2-c1e7-45ba-9838-c0560d6dab7f so Gator can rerun Windows MSVC run 37328055811. Alternatively, a maintainer can select Re-run all jobs on that run. Both x64 and ARM64 lint/test jobs must execute and pass.

Blocking findings: None.

Carried findings: None.

Gator metadata

• Validation: Maintainer-authored runtime safety refactor; Drew verified as repository admin.
• Docs: Existing crate READMEs and maintainer PR description document ownership and compatibility changes. The author-only follow-up preserves runtime behavior and introduces no new published user workflow.
• Checks: Current-head Branch Checks, Helm Lint, Trivy Changes and DCO pass; E2E remains in progress.
• E2E: test:e2e applied; current-head Branch E2E Checks run 37328057236 is running.
• Windows: test:windows restored; current-head run 37328055811 attempt 1 skipped required x64 and ARM64 jobs. Rerun rejected by sandbox policy; approved proposal awaits reload.
• Head SHA: 34d4bab13efe2e9548ca8b47d3045d27f4fdaa79
• Base SHA: 07a05f856a0998e1468c71aa7550b7434b2b6832
• Merge base SHA: 07a05f856a0998e1468c71aa7550b7434b2b6832
• Patch ID: e81ce97da13c4768e3e79e851179b3d9c36bb9c4
• Gator payload: 10
• Review mode: follow_up
• Previous reviewed SHA: 06907512e990533d1de19bda9177dbc7e4e4e2e0
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:blocked
• Blocked reason: test_dispatch_required

[johntmyers]

gator-agent

Blocker Follow-Up Nudge

This PR still needs follow-up more than 48 business hours after the last Gator handoff.

Next action: @drew, please resolve the merge conflicts and work with maintainers to restore the required Windows and E2E gates. The Windows failure is in unchanged MXC code, so please coordinate its upstream fix; the E2E failures still need diagnosis.

[johntmyers]

gator-agent

PR Review Status

Drew, I checked the latest rebase adaptations against the previously reviewed patch series. The independent follow-up review found no blocking defects, and the earlier review remains satisfied. The merge conflicts and E2E failures noted in the previous nudge are cleared on this head.

Branch Checks, Helm Lint, Trivy Changes, DCO and E2E pass, and maintainer approval is present. I restored test:windows because the shared protobuf build setup and Windows-supported paths changed. The current-head Windows workflow had skipped both architectures; after a narrowly scoped sandbox policy update, its rerun was accepted and queued. Gator will check the x64 and ARM64 lint/test results before handing off for a merge or close decision.

Blocking findings: None.

Carried findings: None.

Gator metadata

• Validation: Maintainer-authored runtime safety refactor; Drew verified as repository admin.
• Docs: Crate READMEs and the maintainer's PR description explain ownership and private compatibility changes; no new published user workflow identified in the author-only delta.
• Checks: Current-head Branch Checks, Helm Lint, Trivy Changes and DCO pass. Windows MSVC run 37991327531 rerun queued; x64 and ARM64 lint/test must pass.
• E2E: test:e2e applied; current-head Branch E2E Checks run 37991328538 passed.
• Windows: test:windows restored; required current-head rerun accepted after policy approval and reload.
• Approval: Repository admin johntmyers approved the current head; Gator did not submit approval.
• Head SHA: d5c466d0724a1ae7b165f8e093a96b84f90960c4
• Base SHA: d789ec613b829044e4580f6cda7f5d4648a31285
• Merge base SHA: 61d42102c1186a323e6f1dbff76d8ef67da6d91a
• Patch ID: 0d30344d3c87c96de26c619a0e86c81f4ef88355
• Gator payload: 12
• Review mode: follow_up
• Previous reviewed SHA: 34d4bab13efe2e9548ca8b47d3045d27f4fdaa79
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:watch-pipeline