Fail-closed confinement contract test across runtimes

[armstrongsamr]

What

A fail-closed contract test asserting every autonomous runtime spawns with a scrubbed env + confined cwd.

Why

Prevents capability/enforcement drift (the prior perActionApproval divergence is the cautionary tale). Must fail if a new executesUntrustedTools runtime spawns without going through the seam.

Design

• Enumerate the runtime registry dynamically (not a hardcoded list); for each executesUntrustedTools === true, stub the spawn/SDK seam and assert the captured env has zero denylisted vars and a confined cwd was used.

Affected files

• new electron/agent/runtime/__tests__/confinement-contract.test.ts; possibly a spawn/SDK stub in test-utils/runtime-stubs.ts.

Acceptance criteria

• Test enumerates runtimes dynamically (future runtime auto-covered).
• Fails when a flagged runtime spawns with an unscrubbed env or unconfined cwd.

Effort: S · Deps: #6, #7, #8

Part of #66

[KyleBoyer]

Part 1 landed on main in 05d1471: confinement-contract.test.ts enumerates the registered runtimes and locks the fail-closed contract — mastra must NOT be flagged; every runtime that IS flagged executesUntrustedTools must be in the reviewed KNOWN_AUTONOMOUS set (a new flagged runtime fails first, catching exactly the perActionApproval-style drift); the SDK runtimes are flagged; and the primitives they'll consume deliver (buildAgentChildEnv strips creds + keeps the selected key; resolveConfinedCwd refuses $HOME/unset). +5 tests.

Remaining: the end-to-end "the spawned CLI actually received childEnv/confinedCwd" assertion — that needs the #71 chokepoint wiring to exist first (it populates those StreamOptions). This test locks the contract that wiring must satisfy so it can't silently regress once it lands.

[KyleBoyer]

Shipped on main in 05d1471 fail-closed capability drift-guard + primitive contract test (+5 tests). gpt-5.5-reviewed CLEAN. Part of the #66 confinement epic — the whole functional core (#67-75 + chokepoint + per-runtime consumption) is now landed, gated behind agent.confinement.enabled (default OFF, no behavior change until opted in). Closing as implemented.