ContainNode action + resolver escalation + honest proposal surface (ADR-0040, shadow-complete)

[thejefflarson]

Summary

Closes JEF-730

Step 1b of ADR-0040 (node-scoped containment): shadow-complete, no RBAC, no chart,
no actuation path. The incident detail stops proposing a pod cut the engine's own
evidence proves can't contain a host-namespace process, and proposes the honest node
containment instead.

• ProposedAction::ContainNode (engine/src/engine/respond/mod.rs): reversible,
  deliberately not additive-live — a cordon mutates a shared field on a live Node
  object rather than adding a new engine-owned one, so it's propose-first by
  construction via the existing blast/alive-collateral gate, even once armed.
• Resolver escalation, same menu/ledger code path
  (engine/src/engine/reason/adjudicate/incident/menu.rs's new escalate helper): a
  model-named workload X resolves to ContainNode iff
  reason::proof::boundary_break(X) holds; otherwise X keeps its existing pod-scoped
  cut. No new menu line, no model-selectable mechanism — the model still only ever
  names the workload; determinism swaps the mechanism. MitigationLedger::reconcile
  needed no changes — it already consumes exactly the ChosenCut the menu resolved.
• Honest proposal surface: a fixed-string damage-limitation blast note (cordon
  stops scheduler-driven spread; co-resident denies stop lateral use; drain/reimage/
  rotate is a human act) replaces the network-cut blast-radius note for ContainNode
  lines, with a fixed-string self-severance clause appended when protector's own
  agent/control-plane component shares the node (respond::self_severance) — no
  untrusted substrings anywhere.
• Trigger (d) wired to the LIVE judge pipeline (adj_pass::model_attack_set):
  the boundary_break co-resident-dual-compromise trigger now reads the model-attack
  set from Engine::decisions (this pass's live per-entry cut-choice decisions)
  instead of a caller-supplied stand-in.
• Fingerprint + replay-lock: no wiring needed beyond the menu render already being
  part of the full-state prompt — a boundary_break flip changes the rendered menu
  line, which changes the fingerprint (ADR-0034 D4) and fails the D8 replay-lock's
  cut-signature check byte-identity (cold re-judge, never a silent repoint).
• Journal: no schema change — JournaledCut was already action-agnostic (node +
  cut_signature only, never the ProposedAction).
• One deployed-pod cut-choice bench fixture
  (scripts/judge_bakeoff_cutchoice.py): a boundary-broken downstream node → model
  names it, resolver yields ContainNode, no over-cut of neighbors. Per ADR-0033 this
  needs deployed-pod validation; not tuned to any local backend.

charts/ is untouched; no RBAC touched; respond/actuator/* is untouched (the
actuator that renders the cordon + co-resident denies lands separately, ADR-0040 §7).

Decisions made (no blocking questions)

• Escalation scope: applied only within the model-judged (breach-relevant)
  incident-menu path — build_menu's entry + downstream lines. The internal-only,
  non-model-judged MitigationLedger::reconcile branch (condition-2 quarantine
  targets) is untouched, matching ADR-0040's "off-path auto-containment: won't-build"
  and the pre-existing "outside the north star's two lanes, untouched" precedent for
  that branch.
• Self-severance detection: label-based (app.kubernetes.io/component: agent for
  the eBPF DaemonSet, app.kubernetes.io/name: protector for the engine Deployment
  under the chart's default naming) — presentation-only, never gates anything, so a
  miss under a customized Helm nameOverride only means a milder note, not a
  functional gap. Documented inline (respond::is_protector_component).
• ContainNode Link identity: keyed on the Host node (self-reference), not the
  named workload — two co-resident boundary-broken workloads collapse onto ONE
  containment proposal, matching ADR-0040 §5's "at most one node cordoned
  concurrently" rail. Unit-tested (contain_node_tests.rs).

Test plan

• cargo fmt --check, cargo clippy --tests --all-targets -- -D warnings: clean.
• cargo test (full suite, incl. file_size_guard and self_containment_guard):
  1158 passed, 0 failed, 2 pre-existing network-gated ignores.
• New/updated coverage:
  • respond::contain_node_tests — contain_node_link/self_severance pure-function
    unit tests (host-keyed signature collapse, unscheduled-workload None, agent /
    engine label detection).
  • menu::tests — escalation both directions (boundary-broken → ContainNode;
    clean → pod-scoped cut unchanged), no new selectable node/line, fixed-string
    blast note with/without self-severance, and a menu-mapping-change →
    prompt-fingerprint-change test isolating the ADR-0034 D4 claim.
  • adj_pass::tests — model_attack_set pure unit test, plus two D8 replay-lock
    tests: a ContainNode decision re-arming through the unmodified lock, and a
    boundary_break flip failing the lock closed (cold re-judge).
  • journal::tests — ContainNode cut_signature + fingerprint round-trip.
• soundcheck:pr-review: no Critical/High findings (pure internal Rust resolver logic
  • a dev-only Python bench script; all new proposal text is fixed-string, no new I/O
    or auth surface).
• /simplify: single-pass (Agent tool unavailable in this context) — deduped a
  repeated ~150-char fixed string across two ContainNode note consts into a
  base+suffix concatenation; considered and skipped hoisting the small
  ScheduledOn-edge-walk duplication with reason::proof::boundary_break's private
  internals (matches the codebase's existing per-module local-traversal convention).

🤖 Generated with Claude Code

https://claude.ai/code/session_01VtjoJttCvBY4dzCoE4f9vP