fix(sandbox): drop allowRead:["/"] so denyRead binds (F26, #55)

[mavaali]

Summary

Closes #55. allowRead: ["/"] in both srt settings builders silently defeated denyRead on macOS. Per srt's own docs, reads are allowed everywhere by default and allowRead takes precedence over denyRead — so allowRead:["/"] re-allowed every secret the denylist denied. Dropping the line makes denyRead bind while keeping reads broad (srt's default).

This is the F26 leg that #51 / v0.13.0 is held on, and it also silently no-op'd the F6 read-denylist remediation and the README's --deny-read-secrets claim on macOS.

Changes

• boundary/launcher.py — remove allowRead:["/"] from caller_srt_settings() (involuntary-containment caller jail, feat: involuntary containment — gateway HTTP transport, jailed-caller launcher, capability-tax benchmark #48).
• boundary/tools/sandbox.py — remove allowRead:["/"] from _srt_settings() (bash-tool jail behind --deny-read / --deny-read-secrets).
• Tests now assert allowRead is absent in both builders, so the denylist can't be silently defeated again (the old tests asserted denyRead was populated but never that it bound).

Verification (live srt 1.0.0, macOS)

Full F26 re-run against the fixed caller_srt_settings() — all three legs hold:

[PASS] a. workspace write denied (rc=1)
[PASS] a. control: scratch write allowed (rc=0)
[PASS] b. secret read denied (rc=1, leaked=False)
[PASS] b. control: workspace+system reads allowed
[PASS] c. egress blocked non-allowed (000)
[PASS] c. control: allowed egress ok (200)

Before the fix, leg b leaked the secret in full (rc=0) — reproduced from real $HOME and canonical /private/tmp, ruling out the /tmp symlink red herring.

Full suite: 421 passed, 3 skipped.

Notes / follow-ups (not in this PR)

• Verified on macOS Seatbelt. Linux enforces denyRead via bubblewrap tmpfs — a different code path; the CI Linux selftest should confirm broad reads still work there. srt's README documents "reads allowed by default" cross-platform, so omitting allowRead is the intended shape everywhere.
• README's --deny-read-secrets wording could add a "requires this fix" note until released.
• Does not address F14/F16 (batch 2) — 0.13.0 still gated on those.

Test plan

• pytest -q green (421 passed, 3 skipped)
• Live F26 three-leg re-run under srt passes
• CI Linux selftest confirms denyRead + broad reads on bubblewrap

🤖 Generated with Claude Code