sandbox: contain the interface the packets actually leave by, and put it in the launch path

crates/maxplayer-core/src/delivery_orchestrator.rs

@@ -583,7 +583,10 @@ fn drive_acp_agent(
                 &inputs.prompt,
                 workdir,
                 &identity,
-                AgentRunTimeout::JobDeadline(timeout),
+                AgentRunTimeout::JobDeadline {
+                    remaining: timeout,
+                    deadline_unix: inputs.deadline_unix,
+                },
                 Some(env.clone()),
                 // Servers only: the HOST mounted this container, so there is nothing to mount here.
                 JobAttachments { mcp_servers: inputs.mcp_servers.clone(), extra_mounts: Vec::new() },

crates/maxplayer-core/src/held_tool.rs

@@ -1701,7 +1701,7 @@ mod live_tests {
         let McpServer::Stdio(entry) = &attachments.mcp_servers[drive] else { panic!("stdio entries") };
         let mut command = vec![entry.command.clone()];
         command.extend(entry.args.iter().cloned());
-        let prepared = prepare_launch(&command, &policy, &workdir, &identity, Duration::from_secs(120))
+        let prepared = prepare_launch(&command, &policy, &workdir, &identity, Duration::from_secs(120), None)
             .await
             .expect("prepare the launch");
         let mut servers = prepared.mcp_servers.clone();
@@ -1970,7 +1970,16 @@ mod live_tests {
                 prompt,
                 &workdir,
                 &identity,
-                crate::seller_exec::AgentRunTimeout::JobDeadline(Duration::from_secs(420)),
+                crate::seller_exec::AgentRunTimeout::JobDeadline {
+                    remaining: Duration::from_secs(420),
+                    // The absolute second this window ends at, taken HERE at construction — the
+                    // one instant at which `now + remaining` IS the deadline rather than a guess.
+                    deadline_unix: std::time::SystemTime::now()
+                        .duration_since(std::time::UNIX_EPOCH)
+                        .expect("a clock")
+                        .as_secs()
+                        + 420,
+                },
                 None,
                 attachments,
             )

crates/maxplayer-core/src/lib.rs

@@ -106,6 +106,23 @@ mod sandbox_dns_live;
 /// against its base to tell a regression from a preexisting condition. HARNESS ONLY.
 #[cfg(all(test, feature = "acp", feature = "wallet"))]
 mod sandbox_egress_live;
+/// Offline validation of a *saved* live containment matrix: the record a live run writes down, and
+/// the checks that say whether it actually covers every required case.
+///
+/// The live gates in `tests/sandbox_netns_live.rs` are `#[ignore]`d, so an ordinary `cargo test`
+/// reports them as ignored and proves nothing about containment. This module is what the offline
+/// acceptance entrypoint runs instead: it fails on a missing, duplicated, unknown or unscored case,
+/// and on a record that does not name the commit, artifact and host it came from. Ungated for the
+/// same reason as the policy modules below — a gate that can be compiled out is not a gate.
+pub mod sandbox_evidence;
+/// The same policy, on the interface the packets actually leave by.
+///
+/// `sandbox_net`'s rules live on the host kernel's `OUTPUT` chain, which a gVisor payload never
+/// traverses: it runs its own netstack and hands finished packets to the namespace's veth. This
+/// module translates the very same rendered policy into `tc`/`flower` filters on that veth, so the
+/// containment stops depending on which runtime the job was launched under. Ungated for the same
+/// reason as the renderer it derives from.
+pub mod sandbox_iface;
 /// Host-side network containment for a docker job (#797): which destinations a job may reach, and
 /// the `iptables` rules that enforce it on the two chains container traffic actually splits across.
 ///

crates/maxplayer-core/src/sandbox_dns_live.rs

@@ -414,6 +414,8 @@ async fn contained_delivery(
         workdir.path(),
         &identity(),
         Duration::from_secs(900),
+        // A live DNS probe, not a job — see the egress probe: no job deadline exists to carry.
+        None,
     )
     .await
     .expect("containment must be established");
@@ -819,6 +821,8 @@ async fn gate_a_scenario(tag: &str) -> GateA {
         workdir.path(),
         &identity(),
         Duration::from_secs(300),
+        // A live DNS probe, not a job: no job deadline exists to carry.
+        None,
     )
     .await
     .expect("containment must be established");
@@ -922,6 +926,8 @@ async fn diagnose_v6_resolver_reachability_inside_containment() {
         workdir.path(),
         &identity(),
         Duration::from_secs(300),
+        // A live DNS probe, not a job: no job deadline exists to carry.
+        None,
     )
     .await
     .expect("containment must be established");
@@ -990,6 +996,8 @@ async fn diagnose_v6_resolver_outside_the_denied_ranges() {
         workdir.path(),
         &identity(),
         Duration::from_secs(300),
+        // A live DNS probe, not a job: no job deadline exists to carry.
+        None,
     )
     .await
     .expect("containment must be established");
@@ -1037,6 +1045,8 @@ async fn a_truncated_udp_answer_falls_back_to_tcp_53_inside_containment() {
         workdir.path(),
         &identity(),
         Duration::from_secs(300),
+        // A live DNS probe, not a job: no job deadline exists to carry.
+        None,
     )
     .await
     .expect("containment must be established");
@@ -1094,6 +1104,8 @@ async fn host_stub_discovery_hands_the_job_a_canonical_upstream_not_the_stub() {
         workdir.path(),
         &identity(),
         Duration::from_secs(300),
+        // A live DNS probe, not a job: no job deadline exists to carry.
+        None,
     )
     .await
     .expect("containment must be established from discovered resolvers");
@@ -1139,6 +1151,8 @@ async fn no_usable_resolver_refuses_before_a_holder_or_a_payload_exists() {
             workdir.path(),
             &identity(),
             Duration::from_secs(300),
+            // A live DNS probe, not a job: no job deadline exists to carry.
+            None,
         )
         .await
         .err()
@@ -1184,6 +1198,7 @@ async fn a_failed_installer_destroys_the_holder_and_leaves_nothing_to_launch_int
         None,
         true,
         vec![RESOLVER_V4.to_owned()],
+        2_000_000_000,
     )
     .await;
     let error = result.err().expect("an installer that cannot apply must fail the launch");

crates/maxplayer-core/src/sandbox_egress_live.rs

@@ -267,6 +267,9 @@ async fn contained_run(tag: &str, runtime: &str) -> (String, String, String) {
         workdir.path(),
         &identity(),
         Duration::from_secs(300),
+        // A live egress probe, not a job: there is no job deadline to carry, so the stamp falls
+        // back to this probe's own lifetime rather than inventing an absolute one.
+        None,
     )
     .await
     .expect("containment must establish");