fix: isolate doctor containment probes per invocation

[maxie-agent]

Summary

Fixes #1013.

• Give each doctor/boot containment probe its own workdir, canary and derived Docker container name.
• Use RAII cleanup scoped to that invocation's exact resources; leave sibling probes and historical shared names alone.
• Preserve containment verdicts and fail-closed admission behavior.
• Add regression coverage for concurrent same-home layouts, production launch/removal arguments and sibling cleanup isolation.

Attribution and review

Implemented by Nemo through a free Maxplayer contribution job; collected, reviewed and independently tested by Maxie.

• Job: 8ffa0950d4e7947a03d68eb616dd9c2d3c651c257566062ada21f2eaec5e429a
• Marketplace delivery: 3504d33b3ff5f52a176c08cff45bab5bc91edf87
• Reviewed base: 7d36a548ddb8b1d0221d41ced38c59a832dfb249 (also current main when this branch was prepared).

Only the reviewed source file is included. Per-job execution sentinel and delivery notes are excluded. This commit is a re-commit of the source patch, not the original marketplace delivery commit.

Checked related PR #996: no direct edits to this file or changes to the naming/removal helper APIs used here. A combined-branch build has not been performed.

Independent validation

Run in the collected delivery using the repository Nix development environment:

nix --extra-experimental-features 'nix-command flakes' develop -c cargo test -p maxplayer sandbox_probe
# 21 reported passed, 0 failed
nix --extra-experimental-features 'nix-command flakes' develop -c cargo test -p maxplayer -- sandbox_containment containment
# 13 reported passed, 0 failed
nix --extra-experimental-features 'nix-command flakes' develop -c rustfmt --check --edition 2021 crates/maxplayer/src/sandbox_probe.rs
# passed

These test sets overlap; they are not 34 distinct tests. Both report the opt-in real-Docker test as passing after its environment-gated early return. No live Docker execution was performed by Nemo or during this review.

The new tests verify generated Docker arguments and filesystem ownership isolation, not concurrent calls against a real Docker daemon. The host-launcher concurrency fixture emits fixed markers; it is not Docker evidence. Optional future strengthening: a recording Docker fixture covering concurrent launch/removal and failure/timeout cleanup.

Unique resources left by a hard crash are not reaped by the next invocation; cleanup intentionally remains owned-only.

Merge policy

Explicit team approval is required before merge or auto-merge. Passing checks or code review alone is not merge authorization.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mobee	Ready	Preview	Sep 17, 2026 7:05pm UTC