Govern the example's LLM-output-to-execution flow

[b-macker]

Summary

living-script_extended takes LLM output, writes it to pipeline.py, and executes it via codegen. That is the most dangerous flow in the example and it was ungoverned — no taint_tracking section, so the default enabled: false applied. agent.send() already marks its return tainted (agent_impl.cpp:4560): the source was wired, the config was off.

This adds taint_tracking (advisory) with a sanitize_llm_code() trust boundary, integrity.blocked_flags as a deliberate negative-control probe, and Levels 25/26 that assert both actually fired.

What the live keyed run established

The sanitizer boundary works. All 16 build-path extraction sites produced zero violations. L25-01/02 and L26-01/02/03 passed, no build-path regressions, all 22 L4 phase markers passed.

L25-03 failed — correctly — and the assertion was wrong, not the code. It asserted a total under soft_after (8); the run produced 18. 17 of those come from four non-build-path sites that write agent-derived data without passing through extraction:

site	n	assessment
validate_python_tool()	6	Writes unvalidated model code to _tool_check.py, then AST-parses it. The write precedes validation, so calling it sanitized would be false. True positive.
operator config writes	6	LLM JSON parsed and field-validated before re-serialising. A validate_-RHS binding would be honest and would lower the baseline — left for its own change.
memory persistence	2	Aggregate tracking data, transitively tainted.
unlocated (line 0)	4	Dynamic/codegen writes with no source location.

The fix, and what it can honestly claim

The assertion I wanted — "no violation targets pipeline.py/models.py/test_pipeline.py" — is not expressible. The violation message (governance_taint.cpp:270) names the sink type and the source file:line, never the write target; RuleViolation records carry the source location too. Attribution is possible only by source line, and line numbers move on any edit.

So L25-03 now detects growth against a documented baseline. The build path contributes zero; a leak there adds violations, raises the total, and fails. Each known site is enumerated in the code with why it is expected, and raising the number is a reviewed decision rather than a routine edit.

Two corrections to earlier claims in this PR

• The escalation I predicted never fired. The run recorded zero ESCALATED lines with the occurrence counter peaking at 5/8, because epoch boundaries reset advisory history. My earlier rationale — that an unsanitized build path "would harden into a SOFT block and the build would stop producing" — was not borne out at 18 violations. soft_after is demoted to a printed note rather than the pass condition, and the comments are corrected. The sanitizer boundary stays because it is the honest model of where model output becomes a checked artifact, not because it averts breakage.
• validate_python_tool firing 6 times is correct behaviour, not a naming miss. checkRhsSanitized() clears taint on the assignment RHS; being inside a function whose name matches a sanitizer prefix does nothing for values it writes internally. Now recorded in the code, since it is a natural mistake to make.

temporal_coupling deliberately NOT added

It detects inter-agent timing correlation, but this config pins max_concurrent: 1 / pool_size: 1 and sets delay_between_calls_ms: 1000 on all 7 agents. Calls are correlated by configuration, so the signal would measure the dispatch settings rather than agent behaviour — a misleading signal in an artifact whose purpose is to be believable evidence.

Changes

• src/govern.json — taint_tracking (advisory, with sanitizers) and integrity.blocked_flags. 12 added lines, no reformatting.
• src/living-script.naab — sanitize_llm_code() boundary with the RHS mechanic and known-site inventory documented, 16 extraction sites routed through it, new TAINT_AUDIT and INTEGRITY_PROBE phases.
• run.sh — Levels 25 and 26, baseline-based L25-03, phases wired into the tracking loop.

Test Plan

• bash run-all-tests.sh — 441 tests, 0 unexpected failures
• Stub-verified without live keys: unsanitized control write → 1 taint_tracking.sink_violation, build path → 0; blocked flag → exit 3 not executed, control run → exit 0 executed
• Live keyed run: L25-01/02 and L26-01/02/03 pass; sanitizer boundary confirmed at zero across all 16 build-path sites; L25-03 surfaced the four uncovered sites
• L25-03 replayed against the observed numbers: 18 passes, 19 and 25 fail, stub's 1 still passes — the level accepts the known state and rejects growth
• parse clean; check diagnostics unchanged at 35; run.sh passes bash -n; govern.json valid

Known, out of scope

• L24-06-telemetry failed in the same run: "RunEnd declares 717 chained events but 770 observed" — 53 chained events written without incrementing chained_events_this_run_. That is Attribute attestation signatures, and prove the evidence layer fires #106's verifier catching a real evidence-integrity bug. Different subsystem; it gets its own traced investigation rather than riding along here.
• RUN-02 (feature 2 incomplete, pytest kept failing) — runtime quality of the generated code, unrelated to this PR.
• Routing the operator-config and memory writes through validate_-RHS bindings, which would lower the baseline.

[github-actions]

NAAb Governance Report

Metric	Count
Files checked	16
Passed	16
Failed	0

All governance checks passed!

_{Generated by NAAb Governance Engine v4.0}