tooling: define hermetic exact-tree validation / compiler sandbox boundary

[qnbs]

Context

This issue captures the findings from PR #503 ("S3b Part 2b — isolated-worktree exact-tree typecheck verification"), which was closed unmerged as STOP_AND_SPLIT / DEFERRED_BY_ARCHITECTURE.

That PR set out to build a small, opt-in, non-blocking local diagnostic answering: "does the exact committed tree I'm about to push typecheck independently of my current, possibly-dirty working tree?" Required GitHub CI was always the actual merge-safety authority; this was meant to be local-DX only.

Across several review epochs, review kept finding one more way a maliciously-crafted checked ref could make the trusted compiler read or write outside the isolated worktree, or execute code beyond the intended "just type-check" boundary. Each was fixed and adversarially tested, but the pattern itself became the finding: an isolated git worktree solves working-tree contamination, but it is not an OS-level filesystem/process sandbox. Closing every instance of "the target ref's own configuration/content directs a trusted tool outside its intended boundary" is not achievable with Git-level and CLI-flag-level hardening alone — it requires either genuine hermetic execution (OS sandbox / namespace / container / microVM) or a deliberately narrower, honestly-documented non-hermetic contract.

This is a non-blocking, explicitly deferred architecture question. It does not block #477 or any other current roadmap item.

Scope

Git materialization trust

• repository-local checkout filters (.git/config filter.*, e.g. git lfs install --local)
• system/global/local Git config interaction and precedence
• GIT_NO_REPLACE_OBJECTS=1 and other refs/replace/* considerations
• hooks (core.hooksPath and beyond)
• smudge/clean/process filters
• gitlinks/submodules
• tracked symlinks (POSIX and Windows: backslash-relative, drive-letter absolute, UNC)
• Windows path semantics generally
• checkout/materialization without executable transformations of any kind

Compiler read confinement

• absolute include
• absolute/cascading extends
• absolute imports inside source content
• project references
• path mappings resolving externally
• symlink chains
• Node/module resolution escaping the project root
• any other compiler-controlled filesystem read

Compiler write confinement

• tsBuildInfoFile (even under --noEmit, once incremental is set)
• incremental metadata / caches
• diagnostics/artifacts
• any target-controlled output path
• overwrite risk against the live checkout or other developer-writable paths

Compiler semantics

• noCheck and any other option that can weaken the intended verification contract
• trusted-compiler identity/version compatibility
• target-controlled executable resolution generally

Process and package-manager confinement

• Corepack/pnpm network policy
• package lifecycle hooks
• .pnpmfile.cjs
• package-manager output directories
• environment isolation
• signals/interrupts
• deterministic cleanup

Required architecture decision (for whoever picks this up)

Future work here must explicitly choose between:

Option A — true hermetic runtime sandbox. OS sandbox / namespace / container / microVM / restricted execution service, with an explicit read allowlist, write allowlist, denied network, bounded process tree, trusted toolchain, exact source materialization, and a cross-platform strategy (this repo targets Linux/macOS/Windows).

Option B — deliberately narrower non-hermetic local diagnostic. If the actual product need is only "detached-worktree typecheck for trusted, developer-authored refs," name that honestly and document it as such. Do not call that result a hermetic exact-tree PASS.

Option C — no local exact-tree compiler execution at all. Rely on the existing #501 working-tree-divergence diagnostic, the existing #502 dependency-compatibility diagnostic, and required cloud CI, until a proper hermetic execution layer exists elsewhere in the stack.

Non-goal

This issue is explicitly non-blocking for #477 (Qt/PWA architecture roadmap), the Qt migration, PWA planning, R-15, S4 workflow-policy work, or any other current reconstruction item. Do not let it become a blocker for those.

Reference

• PR: feat(signing): add opt-in isolated-worktree exact-tree typecheck verification (S3b Part 2b) #503 (closed unmerged, preserved as evidence — real adversarial regression tests for every finding above live on that branch)
• Terminal disposition comment: see the PR's final comment for the full delivered-value / rationale writeup.