exp: add sandbox isolation lifecycle prototype

[ggboyxkw666]

Summary

基于阶段三 PR #15 的威胁模型，新增不接入线上评测链路的最小隔离生命周期原型和回归验证。本 PR 只新增 experiments/sandbox_isolation/，不修改生产配置、业务入口、线上队列或密钥。

This branch is based on PR #15 head (8f37f14). Until PR #15 is merged, the comparison with main includes the earlier threat-model document commits; the new implementation scope is limited to experiments/sandbox_isolation/.

Target platform and prerequisites

• Target platform: Windows 11 development workstation.
• Runtime validated with bundled Python 3.12.14.
• Prerequisite: Python 3.10+ standard library only.
• No pytest, g++, database, network service, application startup, or production credentials are required.

Experiment scope

• RecordingIsolationBackend models the required lifecycle: prepare boundary -> create suspended -> enroll -> launch -> cleanup -> verify empty.
• Enrollment or boundary setup failure is fail-closed: launch is never called and cleanup is attempted.
• Deterministic descendant records verify inherited-boundary and whole-unit cleanup on normal parent exit.
• Bounded stdout/stderr capture stops at the configured limit; retained output handles produce a bounded non-pass result instead of waiting forever.
• Rollback routing selects only an available worker with verified isolation; if none exists, evaluation is paused rather than routed to an unisolated worker.

Reproducible validation

Commands run from the repository root:

• python -m unittest discover -s experiments -t . -p "test_*.py" -v -> 9 tests passed.
• python -m experiments.sandbox_isolation.test_prototype -> 9 tests passed.
• python -m compileall -q experiments/sandbox_isolation -> exit code 0.
• git diff --cached --check -> passed before commit.

The tests cover pre-launch enrollment, enrollment failure, normal parent exit with a surviving descendant, stdout/stderr handle retention, bounded output overflow, safe rollback, and fail-closed rollback pause.

Boundary record and evidence

• PID/process boundary: modeled parent/descendant membership and verify-empty cleanup events; no real OS PID membership is claimed.
• Resources: policy records PID and output limits; CPU, memory, disk and concurrency limits are not enforced by this prototype.
• Network: deny-all is recorded as policy; no socket or external service is opened.
• Filesystem: private-workdir-only is recorded as policy; tests create no persistent files.
• Permissions: low-privilege/no-secrets is recorded as policy; no credentials or permission changes are used.
• Output: default 4096-byte cap; retained stdout/stderr handles make the result non-pass while cleanup remains verified.
• Rollback: an unverified preferred worker plus an unverified fallback yields paused_no_safe_rollback; a verified fallback is selected.

Explicit non-goals and approval gate

• This prototype does not create or kill real processes and does not prove OS containment.
• It does not call Windows Job Object APIs, Linux cgroup/namespace/seccomp APIs, firewall APIs, or permission-changing system calls.
• It is not imported by utils.sandbox_runner or any application route.
• A native Job Object/cgroup adapter, main-business integration, production deployment, or high-risk system call must be proposed in a separate PR and remain unmerged until the responsible owner approves it.

Unverified risks

• Real Windows CREATE_SUSPENDED/AssignProcessToJobObject sequencing and real Linux cgroup v2 membership/migration permissions remain unverified.
• Real descendant cleanup, native pipe handles held by descendants, resource quotas, network denial, filesystem ACLs, and rollback queue routing require target-platform integration tests.
• The current evidence demonstrates the contract and failure modes only; it is not evidence that the production evaluator is isolated.

Scope checklist

• Experiment-only directory
• No online evaluation integration
• No production configuration or secrets
• No high-risk OS system calls
• Responsible-owner approval retained as a merge gate for future native isolation

[XiaoCow666]

已完成当前提交的静态复审。

本次改动是隔离生命周期的内存模型和 9 个标准库回归测试：模拟建立边界、挂起创建、加入校验、启动、清理，以及不安全回退时暂停。没有接入生产评测，也没有调用真实 Job Object/cgroup、权限或网络 API。

结论：它证明的是生命周期契约，不是已经完成的 OS 沙箱。未来真实隔离实现必须另开 PR，并补齐 Windows/Linux 平台验证和安全评审。当前实验范围未发现需要阻止继续评估的问题，是否合并由负责人决定。