docs: threat model for sandbox descendant cleanup and OS isolation

[ggboyxkw666]

Summary

Documentation-only follow-up to merged PR #9. This PR records the threat model and staged validation plan for descendant-process cleanup and OS-level isolation; it does not implement high-risk OS system calls.

Changes since review

• Section 4.2.1 now requires the isolation boundary to exist and be verified before untrusted code executes. Linux uses a worker-owned cgroup v2 with no task-controlled migration; Windows uses suspended creation, Job Object assignment, verification, and resume. Any setup or grouping failure fails closed without executing untrusted code.
• Sections 6.2-6.3 now cover immediate descendant creation, attempted boundary escape, normal parent output of 42 with exit code 0 while a descendant remains alive, inherited stdout/stderr handles, and next-task reuse. All terminal paths must clean the whole isolation unit before release or reuse.
• Section 9 now forbids rollback to an unisolated worker. Rollback is allowed only to a verified version meeting the same isolation requirements; otherwise evaluation pauses or remains queued, and the isolation-unavailable path is explicitly tested.

Design position

PR #9 bounds stdout/stderr during execution, but process.kill() only guarantees termination of the direct child. The document treats submitted C++ code as untrusted and keeps process lifetime, CPU, memory, PID, disk, filesystem, network, environment, and worker boundaries explicit.

The recommended next step is a dedicated worker boundary: Linux should prefer a non-root worker/container with default-deny networking and cgroup v2 limits; Windows should prefer a low-privilege worker with Job Object lifecycle/resource limits and ACL/network controls. These remain design recommendations only in this PR.

AI/tool record

• AI tool: Codex (GPT-5-based coding agent), used for repository inspection, review-gap analysis, threat-model synthesis, document drafting, and validation orchestration.
• Git and GitHub browser UI were used to inspect PR fix: bound C++ sandbox stdout and stderr #9/docs: threat model for sandbox descendant cleanup and OS isolation #15, push the fork branch, and update this PR.
• No external AI service was called by the project or by the validation tests.

Validation

• git diff --check - passed for the follow-up documentation changes.
• The follow-up commit range changes only docs/sandbox-threat-model.md; no business code, production configuration, or secrets were changed.
• Existing PR docs: threat model for sandbox descendant cleanup and OS isolation #15 baseline record: Python compile check and five focused sandbox regression functions passed; full pytest was unavailable because pytest was not installed, and g++ was unavailable in the Windows environment.
• No OS-level isolation, descendant cleanup, rollback, or escape-prevention implementation was executed; this PR only documents the design and acceptance plan.

Unverified / follow-up

• Job Object, cgroup v2, namespace, seccomp, container networking, Windows ACL, and production service-account behavior remain unimplemented and unverified.
• Pre-execution grouping, grouping failure, boundary escape, normal-exit descendant cleanup, inherited output-handle, and unsafe-rollback tests still require target Windows/Linux environments.
• The descendant-process reproduction has not been run against a production kernel, host, or network policy.
• Production target OS and concrete per-task CPU, memory, PID, disk, network, and concurrency limits still need owner decisions.
• Full OS-level isolation requires a separate implementation PR, platform tests, security review, and rollback drill.

Scope check

• Documentation only
• No business logic changes
• No production config or secrets
• No high-risk system calls
• PR fix: bound C++ sandbox stdout and stderr #9 output/timeout behavior retained as the regression baseline

Head commits: 0d0ef6a, 8f37f14.

[XiaoCow666]

仅依据提供的 diff 审查；未执行工具或验证代码。以下问题针对设计与验收要求，不要求本 PR 实现隔离。

1. [P2] 明确进程必须在执行不可信代码前纳入隔离边界（docs/sandbox-threat-model.md，§4.2）

   • 问题：Windows 路线仅要求“将编译器及被测程序加入 Job Object”，没有规定启动与加入的顺序；Linux 路线也未规定进入 cgroup 的时机及禁止任务自行迁出的权限要求。
   • 影响：若先启动再归组，程序可在归组前创建后代，导致作业或控制组清理后仍有进程残留。
   • 建议：明确先建立隔离边界，再允许编译器或被测程序执行；Windows 可采用挂起创建、加入 Job、成功后恢复的流程。归组失败必须拒绝执行，并补充立即创建后代及尝试脱离边界的验收场景。

2. [P2] 补充父进程正常退出后的后代清理验收（docs/sandbox-threat-model.md，§6.2–6.3）

   • 问题：后代清理矩阵覆盖超时和非零退出，但没有覆盖父进程输出正确答案、返回 0、留下后代的情况；明确的“无残留”验收也仅针对超时。
   • 影响：实现可能只在失败路径终止整个作业，正常评测仍留下后台进程；继承 stdout/stderr 的后代还可能阻止管道结束，影响结果收集和后续任务。
   • 建议：要求所有结束路径都完成整个隔离单元的清理，并在释放或复用执行环境前验证无残留。增加“父进程输出 42 并返回 0，后代持续存活”的用例，分别覆盖后代保留和关闭标准输出句柄，断言结果收集有界、后代被清理、下一任务不受影响。

[ggboyxkw666]

已根据审阅意见补充进程隔离边界的时序要求：必须先建立 Job Object/cgroup，再允许不可信代码执行；归组失败必须拒绝执行。同时补充父进程正常返回 0 但留下后代进程的清理验收，要求所有结束路径统一清理整个隔离单元，并在环境释放或复用前确认无残留。当前 PR 仍只更新威胁模型和验收标准，不实现高风险 OS 系统调用。

[XiaoCow666]

• P2｜第 9 节：回滚允许恢复已知缺少隔离的旧 worker。 文档明确当前 worker 没有 OS 隔离，却建议保留旧 worker 并在隔离异常时切回；“内部/低风险用户”也不能保证提交的代码可信。这会使回滚绕过第 4.2.1 节规定的失败关闭边界，重新暴露宿主文件、网络及资源。建议明确：只能回滚到满足相同隔离要求且已验证的版本；若没有此类版本，则暂停评测或保留队列，禁止将任务路由到未隔离 worker。回滚验收应验证隔离不可用时任务不会进入旧执行路径。

审查仅基于所提供的元数据和 diff，未执行代码或验证仓库实现。

[XiaoCow666]

仅基于提供的元数据和 diff 审查，未调用工具或执行验证。

问题：未发现阻塞合并的问题。文档明确区分现有能力与未实现控制，并覆盖启动前归组、失败关闭、正常退出后的后代清理及安全回滚。

影响：本次仅新增设计文档，不改变运行时行为；现有隔离缺口仍然存在，本文不能作为隔离已生效的证明。

修复建议：本 PR 无需阻塞性修改。后续实现应按第 6 节矩阵提供目标平台验证证据，并明确生产平台和各项资源配额。

[XiaoCow666]

复审当前 head 8f37f14：纯新增威胁模型文档，已补齐执行前归组/失败关闭、正常退出后的后代清理、输出句柄和安全回滚约束；明确未实现、未验证范围，不改变业务代码、配置或生产行为。低风险文档变更，批准合并。