Add external container-escape prevention and containment-integrity detection

[justsml]

This was generated by AI during triage.

Goal

Prevent and independently detect container-escape precursors and containment violations for agent workloads.

Scope

• Require MicroVM isolation for designated high-risk workload classes and fail closed when unavailable.
• Add external runtime-observation adapters for namespace, mount, privilege, container-runtime socket, firewall, device, and unexpected listener activity.
• Persist containment events as Artifacts and add deterministic containment-integrity block gates.
• Ensure in-container telemetry is never the sole source of a safety verdict.

Acceptance criteria

• High-risk execution cannot silently fall back from MicroVM to a plain container.
• Verified violations halt the run and preserve forensic evidence.
• Synthetic tests cover both detected violations and normal allowed operation.

[justsml]

This was generated by AI during triage.

Progress pushed in 49c6ec68e on PR #137.

This completes the high-risk MicroVM admission slice: untrusted-code and malware-analysis workload classes persist microvm, reject an explicit container downgrade, restart an already-running lab when reclassified, carry workload/isolation Docker labels for external inspection, and reuse the existing fail-closed Kata runtime preflight. Direct runtime callers are covered too, so omitting isolation cannot bypass the MicroVM check. Focused integration coverage is green (54 tests across project lab lifecycle and runtime; 56 including the adjacent network-evidence suite).

I am leaving #39 open. External runtime-observation adapters, deterministic containment-integrity violation gates, run halting, and violation Artifact persistence remain to satisfy the rest of the issue.

[justsml]

This was generated by AI during triage.

Progress on #39 is pushed to PR #154 as commit 6221a447f.

The new bounded slice externally attests every MicroVM start from the Docker daemon, recreates stale plain containers before high-risk execution, closes the name-conflict recovery bypass, rejects dry-run plans as running, removes mismatched workloads, independently verifies cleanup, and preserves the cleanup target when removal cannot be confirmed.

Verification: 3 focused integration files / 61 tests passed, full typecheck passed, diff checks passed, and parallel security/spec/diff reviews found no remaining P1 blocker.

The issue remains open for continuous containment observers, deterministic run-halting gates, and canonical containment-event Artifacts.

[justsml]

This was generated by AI during triage.

Progress on #39 is pushed to PR #154 in commit dad17f039.

Failed external MicroVM start attestations and unresolved cleanup now create redacted canonical exploit-hunter.lab-containment-event.v1 Artifacts containing deterministic event class, requested and daemon-observed isolation facts, cleanup target/outcomes, and trusted project/thread/research-run correlation. Verified starts create no violation Artifact. Artifact storage failure remains visible but cannot replace or weaken the original fail-closed containment result.

Verification: 3 focused integration files / 64 tests passed, full typecheck passed, and diff checks passed.

The issue remains open for continuous external containment observers and deterministic run-halting gates.

[justsml]

This was generated by AI during triage.

Weekly review: PR #154 remains open. High-risk MicroVM admission, daemon attestation, stale-container replacement, cleanup verification, and canonical failure Artifacts are implemented on that branch. Continuous external containment observers and deterministic run-halting gates are still missing.

The existing enhancement / ready-for-agent classification is correct. The issue remains open because the final two acceptance slices are not yet present on main or proven by the required synthetic controls.