fix(lint): see the opencode sandbox, and stop reading "names" as "writes"

[usjoh]

Closes the gap found while investigating the uncommitted MODEL-NOTES work (#35). Two independent holes, and the second is the one that actually mattered.

What happened at 02:35 this morning

ohalloran-demonstrator, site-build. Both opencode lanes failed; the codex lane passed.

worker_returncode=0
check_returncode=1
failure_class=model
missing_expect_files=["/private/tmp/.../-Users-usjoh-Projects-meridian/.../scratchpad/ohalloran-candidates/candidate-c-drawn.html"]

The workers exited cleanly. The manifest declared deliverables inside a Meridian session scratchpad, which the opencode Seatbelt profile denies writes to. The models did the work and physically could not deliver it — and claude-opus-4.8 and claude-sonnet-5 now read 0% on site-build for a manifest that was unwritable. A surface misstating what happened, same class as lou-call-transcript and the ANSI corruption in #33.

sandbox_unreachable_deliverable_findings exists precisely to catch this. It stayed silent for two reasons.

Hole 1 — the engine's boundary was called invisible

engine_confines_writes_to_taskdir keyed only on codex's workspace-write vocabulary. Its docstring:

"opencode's confinement lives inside its wrapper script, invisible from here — better to stay silent than to warn from a guess."

It never was invisible. The Seatbelt profile ships in engines/, a few hundred lines from that function, and its writable surface is exactly TASKDIR + the per-run scratch.

Now: recognise the wrappers this repo ships by bin name, and let any other wrapper declare itself with a new engine field, confines_writes_to_taskdir (true or false). An engine ringer genuinely cannot read still stays silent — that principle was right, and is now tested directly rather than being a side effect of the codex-only rule.

Hole 2 — "names the path" was read as "creates the path"

This is the one that let the run through. The check was:

python3 '/.../check-candidate.py' '/.../candidate-c-drawn.html'

The exemption tested path in task.check. That path IS in the check — as an argument to a read-only verifier. Naming a path is not writing it, and a check that reads the file the worker was supposed to produce is the failing case itself, not evidence of a deliberate export design.

The lint's own docstring already said what should happen:

"an opaque check (a bare script call) still warns, telling the author to confirm."

A bare script call carrying the path was getting exempted — the substring test contradicted the documented design. Now the exemption requires evidence of writing: a redirect onto the path, or a copy-shaped verb (cp/mv/install/tee/rsync/ln) in the same command segment.

Fixing only hole 1 would have changed nothing this morning.

Verification

Replayed the real task — recorded check verbatim, real declared deliverable, real ~/.config/ringer/config.toml:

PRE-FIX  code, identical input -> warnings: 0
POST-FIX code, identical input -> warnings: 1

Tests cover both halves, the segment boundary (a cp earlier in a check must not vouch for a path named later by a verifier), explicit declaration in both directions, the full_access exemption, and that this remains a warning that never blocks a run.

Full suite: 352 pass.

One reversed test, on purpose

test_w12_unconfined_engine_is_quiet asserted the silence this change removes. It's flipped, with a comment recording why and when. The narrower principle it was really protecting — never warn from a guess — is preserved in test_an_unknown_engine_bin_stays_silent.

🤖 Generated with Claude Code