feat(code): confine code-evolution test execution, and record the posture

[jramos]

The asymmetry

evolution/validation/claude_runner.py states our doctrine plainly: when no OS sandbox is available it refuses to run rather than execute an unconfined agent. WorktreeEnv.run_test did not hold to it — it executes pytest against an LLM-modified worktree through a bare subprocess.run.

Reach is wider than the asymmetry suggested: eleven run_test call sites, and three entry points drive the LLM loop — the single-tool evolver, the campaign, and the gaming audit, whose proposer is deliberately built to game the gate.

What this does

• New shared evolution/core/sandbox.py (profile builder, availability, wrap_argv, fail-fast policy check). claude_runner now calls it instead of hand-rolling the same three-way branch; its 13 tests pass unmodified.
• WorktreeEnv gains a require_sandbox policy, a sandboxed posture resolved once at create time, and a single confine() seam every in-worktree execution goes through.
• --require-sandbox on all three LLM-loop entry points, each checking the policy once at startup — a demand that cannot be met is a startup error, not a per-item outcome.
• Posture recorded in repair_trace.json, campaign_report.json, and the human-review PR body.
• The bug harvester is deliberately excluded from the flag: no LLM-authored code executes there.

A containment failure can no longer be certified as a pass

sandbox-exec exits 65 without running the child when a profile fails to compile. gate.py special-cases only pytest's exit 5, and _parse_pytest_failures returns an empty set on unrecognized output — so a run where zero tests executed read as "no failures", and run_code_oracle_gate could report CORRECT.

A confined run returning a positive non-pytest code now raises ContainmentError. The type is distinct so campaign's except WorktreeError -> Skip("worktree_failed") cannot absorb a systemic failure as a fleet of skipped organisms; a negative control asserts ordinary worktree failures still skip.

Negative exit codes are excluded deliberately. Signal deaths (OOM kill, SIGSEGV) pass through sandbox-exec unchanged and are real test outcomes — calling them containment failures would misdiagnose them and drop those organisms from the denominator on macOS only.

What the posture actually claims

The boundary is non-temp writes denied; reads, process-exec and network unrestricted — it prevents corrupting your checkout or home directory, and it is not isolation. LLM-modified test code retains write access to sibling run roots under the temp tree. The containment proof therefore targets $HOME: inside the temp roots the write would have succeeded and the test would have passed while proving nothing. A companion assertion pins that temp-root writes are allowed, so the wording stays honest if the profile ever changes.

Two profile-construction bugs are fixed: write roots are resolved before interpolation (the kernel matches canonical paths, while mkdtemp returns /var/folders/..., so the named root was granting nothing), and paths containing quote/paren/backslash are rejected rather than interpolated, since SBPL cannot escape them and a crafted root could append allow rules of its own.

Adjacent pre-existing bug, fixed here

The human-review PR body read guards["floor"]["passed"] — a key that does not exist — so every body claimed the regression floor FAILED, including runs that deployed because it was green, and raised AttributeError on oracle decisions where floor is None. It now judges by new_failures. Called out separately because it is not part of the containment change; it was found while wiring the posture into the same function, which had been accepting trace and ignoring it entirely.

Verification

• 31 tests, including a real denied-write proof on macOS (skipped elsewhere), the exit-65 inversion, the signal-death negative control, SBPL injection rejection, canonicalisation, and a behavioral test that the flag's value reaches create() — the earlier structural check passed even with the value hardcoded inert, so it was replaced.
• Full non-slow suite: 1794 passed (1763 baseline + 31), ruff clean.
• Docs: containment field in the repair-trace schema, the flag and confinement behavior in the CLI reference, one clause in the README (the capability change is confinement-by-default, not the flags).

Deliberate non-goals

• Linux confinement (bubblewrap). Deferred; the recorded posture makes its absence visible rather than assumed.
• Confining the venv build. Verified unnecessary: the venv is built from the pristine base ref before any candidate is written.

Stacking

Based on the triage-doc branch so the action-item row it flips exists in the same diff. GitHub will retarget this to main when that PR merges.

Rebuilt natively from an idea in NousResearch/hermes-agent-self-evolution#162; no upstream diff applied.