exp: add sandbox isolation lifecycle prototype

[ggboyxkw666]

Summary

基于阶段三 PR #15 的威胁模型，新增不接入线上评测链路的最小隔离生命周期原型和回归验证。本 PR 只新增 experiments/sandbox_isolation/，不修改生产配置、业务入口、线上队列或密钥。

This branch is based on PR #15 head (8f37f14). Until PR #15 is merged, the comparison with main includes the earlier threat-model document commits; the new implementation scope is limited to experiments/sandbox_isolation/.

Target platform and prerequisites

• Target platform: Windows 11 development workstation.
• Runtime validated with bundled Python 3.12.14.
• Prerequisite: Python 3.10+ standard library only.
• No pytest, g++, database, network service, application startup, or production credentials are required.

Experiment scope

• RecordingIsolationBackend models the required lifecycle: prepare boundary -> create suspended -> enroll -> launch -> cleanup -> verify empty.
• Enrollment or boundary setup failure is fail-closed: launch is never called and cleanup is attempted.
• Deterministic descendant records verify inherited-boundary and whole-unit cleanup on normal parent exit.
• Bounded stdout/stderr capture stops at the configured limit; retained output handles produce a bounded non-pass result instead of waiting forever.
• Rollback routing selects only an available worker with verified isolation; if none exists, evaluation is paused rather than routed to an unisolated worker.

Reproducible validation

Commands run from the repository root:

• python -m unittest discover -s experiments -t . -p "test_*.py" -v -> 9 tests passed.
• python -m experiments.sandbox_isolation.test_prototype -> 9 tests passed.
• python -m compileall -q experiments/sandbox_isolation -> exit code 0.
• git diff --cached --check -> passed before commit.

The tests cover pre-launch enrollment, enrollment failure, normal parent exit with a surviving descendant, stdout/stderr handle retention, bounded output overflow, safe rollback, and fail-closed rollback pause.

Boundary record and evidence

• PID/process boundary: modeled parent/descendant membership and verify-empty cleanup events; no real OS PID membership is claimed.
• Resources: policy records PID and output limits; CPU, memory, disk and concurrency limits are not enforced by this prototype.
• Network: deny-all is recorded as policy; no socket or external service is opened.
• Filesystem: private-workdir-only is recorded as policy; tests create no persistent files.
• Permissions: low-privilege/no-secrets is recorded as policy; no credentials or permission changes are used.
• Output: default 4096-byte cap; retained stdout/stderr handles make the result non-pass while cleanup remains verified.
• Rollback: an unverified preferred worker plus an unverified fallback yields paused_no_safe_rollback; a verified fallback is selected.

Explicit non-goals and approval gate

• This prototype does not create or kill real processes and does not prove OS containment.
• It does not call Windows Job Object APIs, Linux cgroup/namespace/seccomp APIs, firewall APIs, or permission-changing system calls.
• It is not imported by utils.sandbox_runner or any application route.
• A native Job Object/cgroup adapter, main-business integration, production deployment, or high-risk system call must be proposed in a separate PR and remain unmerged until the responsible owner approves it.

Unverified risks

• Real Windows CREATE_SUSPENDED/AssignProcessToJobObject sequencing and real Linux cgroup v2 membership/migration permissions remain unverified.
• Real descendant cleanup, native pipe handles held by descendants, resource quotas, network denial, filesystem ACLs, and rollback queue routing require target-platform integration tests.
• The current evidence demonstrates the contract and failure modes only; it is not evidence that the production evaluator is isolated.

Scope checklist

• Experiment-only directory
• No online evaluation integration
• No production configuration or secrets
• No high-risk OS system calls
• Responsible-owner approval retained as a merge gate for future native isolation

[XiaoCow666]

已完成当前提交的静态复审。

本次改动是隔离生命周期的内存模型和 9 个标准库回归测试：模拟建立边界、挂起创建、加入校验、启动、清理，以及不安全回退时暂停。没有接入生产评测，也没有调用真实 Job Object/cgroup、权限或网络 API。

结论：它证明的是生命周期契约，不是已经完成的 OS 沙箱。未来真实隔离实现必须另开 PR，并补齐 Windows/Linux 平台验证和安全评审。当前实验范围未发现需要阻止继续评估的问题，是否合并由负责人决定。

[XiaoCow666]

仅依据提供的 diff 静态审查，未执行代码。

1. [P2] 清理失败后仍可直接复用同一 backend 启动新任务
   位置：experiments/sandbox_isolation/prototype.py，LifecycleRunner.execute() / RecordingIsolationBackend.prepare()。
   问题：使用 fail_stage="cleanup" 执行一次后，进程记录和边界仍然存在；随后将 fail_stage 恢复为 None 再次执行，会直接创建并启动新任务。入口没有检查上一轮是否清理完成，也没有标记 backend 不可复用。
   影响：原型允许新任务与上一轮残留任务共享边界，违反文档中“清理失败阻断复用”的生命周期契约。
   建议：在启动前拒绝非空或清理失败的 backend，只有独立恢复清理且验证为空后才能重新使用。增加连续两次执行的回归，断言恢复验证前第二次执行不会产生新的 resume 事件。

2. [P2] 正常父进程退出场景没有实际建模退出状态
   位置：experiments/sandbox_isolation/prototype.py，LifecycleRunner.execute()；test_prototype.py，test_descendant_is_cleaned_after_normal_parent_exit()。
   问题：Scenario.exit_code 仅参与结果分类，父进程的 alive 始终为 True，直到 cleanup() 与后代一起终止。因此该测试实际覆盖的是父子都存活时整体清理，没有覆盖其名称和 README 声称的“父进程已正常退出、后代仍存活”。
   影响：这项核心回归无法验证父进程退出后仍必须清理隔离单元的契约。
   建议：增加明确的父进程退出状态转换，并在清理前断言父进程已退出、后代仍存活；保留持有和关闭输出句柄两类场景，再验证整体清理成功。

[XiaoCow666]

按“必要项门禁”复审：当前提交只新增实验性隔离生命周期原型，没有接入生产评测、权限、网络或部署配置。

已验证：

• py -3.12 -m unittest discover -s experiments -t . -p "test_*.py" -v：9 passed
• py -3.12 -m experiments.sandbox_isolation.test_prototype：9 passed
• py -3.12 -m compileall -q experiments/sandbox_isolation：通过

清理失败后的 backend 复用属于后续原型完善建议，不影响当前实验代码纳入；未来接入真实 OS 隔离前必须补充生命周期失效保护和平台级验证。