agents-city 0.3.0-beta.21

package/bin/test-broker.py

@@ -0,0 +1,334 @@
+#!/usr/bin/env python3
+"""The broker: real git against a bare origin, a stubbed gh, a live server.
+
+Everything runs below a throwaway HOME. The happy paths use a REAL `git push`
+to a local bare remote — no network — and a `gh` stub planted on PATH that
+records its arguments. The unhappy paths are the product: work on the default
+branch refused, a missing token 401, a wrong token 403, a tampered audit line
+caught by the chain, and a stopped broker that leaves no orphan behind.
+"""
+
+import json
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+import time
+import urllib.error
+import urllib.request
+
+AQUI = os.path.dirname(os.path.abspath(__file__))
+RAIZ = os.path.dirname(AQUI)
+sys.path.insert(0, os.path.join(RAIZ, "plugin", "scripts"))
+sys.path.insert(0, AQUI)
+
+import broker  # noqa: E402
+from testlib import afirma, comprueba, detiene_proceso, resumen  # noqa: E402
+
+BROKER = os.path.join(RAIZ, "plugin", "scripts", "broker.py")
+
+
+def _git(repo, *args):
+    return subprocess.run(["git", "-C", repo, *args], capture_output=True, text=True)
+
+
+def prepara():
+    base = tempfile.mkdtemp(prefix="agents-city-broker-")
+    os.environ["AGENTS_CITY_HOME"] = os.path.join(base, "app")
+    datos = os.path.join(base, "city")
+    os.makedirs(datos)
+    origen = os.path.join(base, "origin.git")
+    subprocess.run(["git", "init", "-q", "--bare", origen], check=True)
+    repo = os.path.join(base, "repo")
+    subprocess.run(["git", "init", "-q", "-b", "main", repo], check=True)
+    _git(repo, "config", "user.email", "t@t")
+    _git(repo, "config", "user.name", "t")
+    with open(os.path.join(repo, "f.txt"), "w") as f:
+        f.write("a\n")
+    _git(repo, "add", "f.txt")
+    _git(repo, "commit", "-qm", "first")
+    _git(repo, "remote", "add", "origin", origen)
+    _git(repo, "push", "-q", "origin", "main")
+    stubs = os.path.join(base, "stubs")
+    os.makedirs(stubs)
+    with open(os.path.join(stubs, "gh"), "w") as f:
+        f.write('#!/bin/sh\necho "$@" > "$GH_STUB_LOG"\n'
+                'echo "https://github.com/x/y/pull/7"\n')
+    os.chmod(os.path.join(stubs, "gh"), 0o755)
+    return base, datos, repo, origen, stubs
+
+
+def pide(url, ruta, token, cuerpo=None):
+    peticion = urllib.request.Request(
+        url + ruta, data=json.dumps(cuerpo or {}).encode(), method="POST",
+        headers={"Authorization": f"Bearer {token}"} if token else {})
+    try:
+        with urllib.request.urlopen(peticion, timeout=10) as r:
+            return r.status, json.loads(r.read())
+    except urllib.error.HTTPError as e:
+        return e.code, json.loads(e.read() or b"{}")
+
+
+def arranca(datos, entorno):
+    proceso = subprocess.Popen([sys.executable, BROKER, "serve", "--data", datos],
+                               stdout=subprocess.PIPE, stderr=subprocess.PIPE,
+                               text=True, env=entorno)
+    limite = time.monotonic() + 10
+    while time.monotonic() < limite:
+        url = broker.url_de(datos)
+        if url:
+            return proceso, url
+        time.sleep(0.05)
+    proceso.kill()
+    # Never a blind failure: whatever the child said is the whole diagnosis,
+    # and CI is the one place nobody can re-run it by hand to find out.
+    salida, error = proceso.communicate(timeout=5)
+    raise RuntimeError(
+        f"the broker never wrote its endpoint\n    stdout: {salida.strip()}\n"
+        f"    stderr: {error.strip()}"
+    )
+
+
+def todo():
+    base, datos, repo, origen, stubs = prepara()
+    entorno = dict(os.environ, PATH=stubs + os.pathsep + os.environ["PATH"],
+                   GH_STUB_LOG=os.path.join(base, "gh.log"))
+    proceso = None
+    try:
+        ficha = broker.acuna(datos, "web", repo, solo_fichero=True)
+        afirma("mint writes the token file with 0600",
+               oct(os.stat(ficha).st_mode & 0o777) == "0o600", ficha)
+        token = open(ficha).read().strip()
+        guardados = json.load(open(os.path.join(broker.estado_de(datos), "tokens.json")))
+        afirma("only the hash of the token is stored, never the token",
+               token not in json.dumps(guardados) and len(guardados) == 1)
+        try:
+            broker.acuna(datos, "x", os.path.join(base, "not-a-repo"))
+            afirma("minting against a non-repo is refused", False)
+        except ValueError:
+            afirma("minting against a non-repo is refused", True)
+
+        proceso, url = arranca(datos, entorno)
+
+        estado, _ = pide(url, "/v1/push", token)
+        comprueba("push on the default branch is refused with 422", estado, 422)
+        estado, _ = pide(url, "/v1/pr", token, {"title": "x"})
+        comprueba("a PR from the default branch is refused too", estado, 422)
+
+        _git(repo, "checkout", "-qb", "feature")
+        with open(os.path.join(repo, "f.txt"), "w") as f:
+            f.write("b\n")
+        _git(repo, "commit", "-qam", "change")
+
+        estado, cuerpo = pide(url, "/v1/push", token)
+        comprueba("push on a feature branch succeeds", estado, 200)
+        afirma("the bare origin actually received the branch",
+               _git(origen, "rev-parse", "feature").returncode == 0)
+        comprueba("the response names the branch it pushed", cuerpo.get("branch"), "feature")
+
+        estado, cuerpo = pide(url, "/v1/pr", token, {"title": "Add b", "body": "why"})
+        comprueba("gh runs and the PR URL comes back", estado, 200)
+        comprueba("the URL is gh's answer, verbatim",
+                  cuerpo.get("url"), "https://github.com/x/y/pull/7")
+        registrado = open(os.path.join(base, "gh.log")).read()
+        afirma("gh received the title the window asked for", "Add b" in registrado, registrado)
+
+        estado, _ = pide(url, "/v1/pr", token, {"title": ""})
+        comprueba("a PR without a title is refused", estado, 422)
+        estado, _ = pide(url, "/v1/push", "")
+        comprueba("no token at all is a 401", estado, 401)
+        estado, _ = pide(url, "/v1/push", "cb_" + "0" * 48)
+        comprueba("a wrong token is a 403", estado, 403)
+        estado, _ = pide(url, "/v1/nothing", token)
+        comprueba("an unknown verb is a 404", estado, 404)
+
+        registro = os.path.join(broker.estado_de(datos), "audit.log")
+        lineas = open(registro).read().splitlines()
+        afirma("every request, refused ones included, landed in the audit log",
+               sum(1 for l in lineas if '"/v1/' in l) >= 7, f"{len(lineas)} lines")
+        comprueba("the audit chain verifies intact", broker.verifica(broker.estado_de(datos)), 0)
+        manipuladas = list(lineas)
+        falseada = json.loads(manipuladas[2])
+        falseada["ok"] = not falseada["ok"]
+        manipuladas[2] = json.dumps(falseada, sort_keys=True)
+        with open(registro, "w") as f:
+            f.write("\n".join(manipuladas) + "\n")
+        afirma("one rewritten entry breaks the chain at the next line",
+               broker.verifica(broker.estado_de(datos)) == 4,
+               f"broken at {broker.verifica(broker.estado_de(datos))}")
+
+        afirma("stop finds the pid it published and signals it", broker.para(datos))
+        try:
+            proceso.wait(timeout=5)
+            afirma("the broker is gone, no orphan left", detiene_proceso(proceso.pid))
+        except subprocess.TimeoutExpired:
+            afirma("the broker is gone, no orphan left", False)
+        proceso = None
+        comprueba("a stopped broker publishes no url", broker.url_de(datos), "")
+    finally:
+        if proceso:
+            proceso.kill()
+        shutil.rmtree(base, ignore_errors=True)
+        os.environ.pop("AGENTS_CITY_HOME", None)
+
+
+def secretos_y_evidencia():
+    from evidencia import Evidencia
+
+    base = tempfile.mkdtemp(prefix="agents-city-broker-")
+    os.environ["AGENTS_CITY_HOME"] = os.path.join(base, "app")
+    try:
+        datos = os.path.join(base, "city")
+        os.makedirs(datos)
+        estado = broker.estado_de(datos)
+
+        # Binding rules: a host is required, and wildcards/ports are refused.
+        for malo in ("*.example.com", "api.example.com:443", "a/b"):
+            try:
+                broker.guarda_secreto(datos, "K", "v", [malo])
+                afirma(f"host '{malo}' is refused", False)
+            except ValueError:
+                afirma(f"host '{malo}' is refused", True)
+        try:
+            broker.guarda_secreto(datos, "K", "v", [])
+            afirma("a secret with no host is refused", False)
+        except ValueError:
+            afirma("a secret with no host is refused", True)
+
+        broker.guarda_secreto(datos, "OPENAI", "sk-REAL-SECRET", ["api.openai.com"])
+        valor, motivo = broker._host_permitido(estado, "OPENAI", "api.openai.com")
+        comprueba("a bound host resolves the value", valor, "sk-REAL-SECRET")
+        _, motivo = broker._host_permitido(estado, "OPENAI", "evil.example.com")
+        afirma("an unbound host is refused with a reason", motivo is not None)
+        _, motivo = broker._host_permitido(estado, "NOPE", "api.openai.com")
+        afirma("an unknown secret name is refused", motivo is not None)
+
+        quien = {"actor": "web", "repo": base}
+        code, resp = broker.accion_fetch(quien, {"secret": "OPENAI"}, estado)
+        comprueba("fetch without a host is 422", code, 422)
+        code, resp = broker.accion_fetch(
+            quien, {"secret": "OPENAI", "host": "evil.example.com", "path": "/v1/x"}, estado)
+        comprueba("fetch to an unbound host is 403", code, 403)
+        afirma("the 403 never echoes the secret value", "sk-REAL-SECRET" not in str(resp))
+        code, resp = broker.accion_fetch(
+            quien, {"secret": "OPENAI", "host": "api.openai.com", "method": "DELETE"}, estado)
+        comprueba("an unsupported method is 422", code, 422)
+
+        # The success path: capture the request without a socket, prove the
+        # secret is injected into the declared header only for the bound host.
+        capturado = {}
+
+        class _Resp:
+            status = 200
+
+            def __enter__(self):
+                return self
+
+            def __exit__(self, *a):
+                return False
+
+            def read(self, *_):
+                return b'{"ok":true}'
+
+        def _fake_open(req, timeout=0):
+            capturado["url"] = req.full_url
+            capturado["auth"] = req.headers.get("X-api-key") or req.headers.get("Authorization")
+            return _Resp()
+
+        # Patch the no-redirect opener the action actually uses.
+        original = broker._SIN_REDIRECCIONES.open
+        broker._SIN_REDIRECCIONES.open = _fake_open
+        try:
+            code, resp = broker.accion_fetch(
+                quien,
+                {"secret": "OPENAI", "host": "api.openai.com", "path": "/v1/models",
+                 "header": "X-Api-Key", "template": "{secret}"},
+                estado)
+            # Control characters in a window-controlled field are refused as 422,
+            # not left to raise deep inside urllib as a 500.
+            code_ctl, _ = broker.accion_fetch(
+                quien,
+                {"secret": "OPENAI", "host": "api.openai.com", "path": "/x",
+                 "header": "X-Api-Key", "template": "{secret}\r\nX-Injected: 1"},
+                estado)
+        finally:
+            broker._SIN_REDIRECCIONES.open = original
+        comprueba("a bound fetch returns 200", code, 200)
+        comprueba("it hit the exact bound host over https",
+                  capturado["url"], "https://api.openai.com/v1/models")
+        comprueba("the secret was injected into the declared header",
+                  capturado["auth"], "sk-REAL-SECRET")
+        afirma("and the broker's own response never carries the secret",
+               "sk-REAL-SECRET" not in str(resp))
+        comprueba("a CRLF-injected header is refused with 422", code_ctl, 422)
+        afirma("the redirect handler refuses to follow any 3xx (secret stays on host)",
+               broker._NoSigue().redirect_request(None, None, None, None, None) is None)
+
+        # Every audit line carries an evidence state, and the chain holds.
+        lineas = open(os.path.join(estado, "audit.log")).read().splitlines()
+        estados = {json.loads(x).get("evidence") for x in lineas}
+        afirma("audit lines carry evidence states",
+               str(Evidencia.IMPUESTO) in estados)
+        afirma("no audit line ever claims 'unknown means ok'",
+               all(not (json.loads(x).get("ok") and json.loads(x).get("evidence") ==
+                        str(Evidencia.DESCONOCIDO)) for x in lineas))
+        comprueba("the chain verifies intact after secret ops",
+                  broker.verifica(estado), 0)
+    finally:
+        shutil.rmtree(base, ignore_errors=True)
+        os.environ.pop("AGENTS_CITY_HOME", None)
+
+
+def arranca_sin_dns_inversa():
+    """A loopback broker must start without waiting on the network.
+
+    The stdlib's HTTPServer.server_bind calls socket.getfqdn() for a cosmetic
+    name — a reverse DNS lookup. On a resolver that never answers (a CI macOS
+    runner, an airplane, a locked-down office LAN) it blocks for tens of
+    seconds, and the broker's endpoint appears only after it returns. This is
+    that hang's tombstone: getfqdn is sabotaged to take forever, and the
+    broker must still be serving.
+    """
+    import socket
+    import threading
+
+    base = tempfile.mkdtemp(prefix="agents-city-broker-dns-")
+    os.environ["AGENTS_CITY_HOME"] = os.path.join(base, "app")
+    datos = os.path.join(base, "city")
+    os.makedirs(datos)
+    original = socket.getfqdn
+    socket.getfqdn = lambda *a: time.sleep(60) or "nunca"
+    servidor = None
+    try:
+        arrancado = threading.Event()
+
+        def sirve_en_hilo():
+            nonlocal servidor
+            servidor = broker.Servidor(("127.0.0.1", 0), broker.Manejador)
+            arrancado.set()
+            servidor.serve_forever()
+
+        broker.Manejador.estado = broker.estado_de(datos)
+        hilo = threading.Thread(target=sirve_en_hilo, daemon=True)
+        comienzo = time.monotonic()
+        hilo.start()
+        listo = arrancado.wait(timeout=5)
+        afirma(
+            "the broker binds without waiting on reverse DNS",
+            listo and time.monotonic() - comienzo < 5,
+            f"{round(time.monotonic() - comienzo, 2)}s",
+        )
+    finally:
+        socket.getfqdn = original
+        if servidor is not None:
+            servidor.shutdown()
+            servidor.server_close()
+        shutil.rmtree(base, ignore_errors=True)
+        os.environ.pop("AGENTS_CITY_HOME", None)
+
+
+todo()
+secretos_y_evidencia()
+arranca_sin_dns_inversa()
+sys.exit(resumen("broker"))

package/bin/test-cage.py

@@ -0,0 +1,206 @@
+#!/usr/bin/env python3
+"""The cage: profile text everywhere, the real kernel where there is one.
+
+The profile checks are pure and run on every platform, CI's Linux included.
+The live checks exec `sandbox-exec` against a throwaway HOME with planted
+fake secrets — they prove the four properties everything else relies on:
+secrets unreadable, foreign writes refused, repo writes intact, grandchildren
+still caged. On a machine without seatbelt they skip, loudly.
+"""
+
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+
+AQUI = os.path.dirname(os.path.abspath(__file__))
+RAIZ = os.path.dirname(AQUI)
+sys.path.insert(0, os.path.join(RAIZ, "plugin", "scripts"))
+sys.path.insert(0, AQUI)
+
+import cage  # noqa: E402
+from testlib import afirma, comprueba, resumen  # noqa: E402
+
+
+def entorno_falso():
+    base = tempfile.mkdtemp(prefix="agents-city-cage-")
+    casa = os.path.join(base, "home")
+    repo = os.path.join(base, "repo")
+    os.makedirs(os.path.join(casa, ".ssh"))
+    os.makedirs(repo)
+    with open(os.path.join(casa, ".ssh", "id_ed25519"), "w") as f:
+        f.write("FAKE-PRIVATE-KEY\n")
+    with open(os.path.join(casa, ".git-credentials"), "w") as f:
+        f.write("https://user:FAKE-TOKEN@github.com\n")
+    return base, casa, repo
+
+
+def texto_del_perfil():
+    base, casa, repo = entorno_falso()
+    try:
+        p = cage.perfil(repo, casa=casa)
+        afirma("the profile starts with the SBPL version header",
+               p.startswith("(version 1)"), p.splitlines()[0])
+        afirma("the profile allows by default and denies writes globally",
+               "(allow default)" in p and "(deny file-write*)" in p)
+        for secreto in (".ssh", ".aws", ".config/gcloud", ".config/gh"):
+            afirma(f"the profile seals {secreto} for reads and writes",
+                   os.path.join(casa, *secreto.split("/")) in p, secreto)
+        afirma("the profile seals ~/.git-credentials",
+               os.path.join(casa, ".git-credentials") in p)
+        afirma("the repo itself is writable",
+               f'(subpath "{os.path.realpath(repo)}")' in p)
+        afirma("remote road .env files are sealed even inside ~/.claude",
+               "channels" in p and "\\.env" in p)
+        afirma("the broker state dir is sealed",
+               os.path.join(casa, ".agents-city", ".runtime", "broker") in p)
+        afirma("~/.npmrc stays readable on purpose (a broken npm protects nobody)",
+               os.path.join(casa, ".npmrc") not in p)
+    finally:
+        shutil.rmtree(base, ignore_errors=True)
+
+
+def excepciones_y_errores():
+    base, casa, repo = entorno_falso()
+    try:
+        ficha = os.path.join(base, "win.token")
+        with open(ficha, "w") as f:
+            f.write("cb_x\n")
+        p = cage.perfil(repo, casa=casa, fichero_token=ficha)
+        afirma("the window's own broker token file is re-allowed read-only",
+               f'(allow file-read* (literal "{os.path.realpath(ficha)}"))' in p)
+        try:
+            cage.perfil(os.path.join(base, "no-such-dir"), casa=casa)
+            afirma("a nonexistent repo is refused", False)
+        except ValueError:
+            afirma("a nonexistent repo is refused", True)
+        previo = os.environ.get("CITY_CAGE")
+        os.environ["CITY_CAGE"] = "0"
+        comprueba("CITY_CAGE=0 launches uncaged, exactly the old behaviour",
+                  cage.linea(repo, "w", casa=casa), "")
+        if previo is None:
+            os.environ.pop("CITY_CAGE")
+        else:
+            os.environ["CITY_CAGE"] = previo
+        os.environ["CITY_CAGE_DENY"] = os.path.join(casa, ".npmrc")
+        try:
+            afirma("CITY_CAGE_DENY adds an owner-chosen path to the seal",
+                   os.path.join(casa, ".npmrc") in cage.perfil(repo, casa=casa))
+        finally:
+            os.environ.pop("CITY_CAGE_DENY")
+        # A repo that IS a sealed root (or covers one) is refused outright:
+        # there is no safe cage for a window rooted on the credential store.
+        try:
+            cage.perfil(os.path.join(casa, ".ssh"), casa=casa)
+            afirma("a repo path that is a sealed root is refused", False)
+        except ValueError as e:
+            afirma("a repo path that is a sealed root is refused", "unsafe" in str(e))
+        # An owner CITY_CAGE_ALLOW_WRITE that lands inside a sealed root is
+        # dropped (dead under the final deny) rather than emitted.
+        os.environ["CITY_CAGE_ALLOW_WRITE"] = os.path.join(casa, ".ssh", "sub")
+        try:
+            afirma("a write-allow inside a sealed root is not emitted",
+                   os.path.join(casa, ".ssh", "sub") not in cage.perfil(repo, casa=casa))
+        finally:
+            os.environ.pop("CITY_CAGE_ALLOW_WRITE")
+        # A broad system root that merely COVERS a sealed root stays allowed:
+        # the final deny re-seals the secret, so writability is not sacrificed.
+        afirma("a covering system root is still allowed (ordering re-seals)",
+               '(subpath "/private/tmp")' in cage.perfil(repo, casa=casa))
+        # A relocated AGENTS_CITY_HOME must move the broker seal with it — the
+        # broker writes tokens there, so the cage must seal the same root.
+        relocado = os.path.join(base, "elsewhere-home")
+        os.makedirs(relocado)
+        previo_ac = os.environ.get("AGENTS_CITY_HOME")
+        os.environ["AGENTS_CITY_HOME"] = relocado
+        try:
+            p = cage.perfil(repo, casa=casa)
+            afirma("the broker seal follows a relocated AGENTS_CITY_HOME",
+                   os.path.join(os.path.realpath(relocado), ".runtime", "broker") in p)
+            afirma("and the relocated home stays writable",
+                   f'(subpath "{os.path.realpath(relocado)}")' in p)
+        finally:
+            if previo_ac is None:
+                os.environ.pop("AGENTS_CITY_HOME")
+            else:
+                os.environ["AGENTS_CITY_HOME"] = previo_ac
+    finally:
+        shutil.rmtree(base, ignore_errors=True)
+
+
+def mounts_agente_primero():
+    # Agent-first: a workspace with a mount to a document folder outside it.
+    # The mount's resolved target must be writable, and secrets still sealed.
+    base, casa, _repo = entorno_falso()
+    try:
+        ws = os.path.join(base, "workspace")
+        docs = os.path.join(base, "elsewhere-docs")
+        os.makedirs(ws)
+        os.makedirs(docs)
+        p = cage.perfil(ws, casa=casa, extra_escritura=[docs])
+        afirma("a mount target is added as a writable root",
+               f'(subpath "{os.path.realpath(docs)}")' in p)
+        afirma("the workspace itself is writable",
+               f'(subpath "{os.path.realpath(ws)}")' in p)
+        # A mount that resolves inside a sealed root is refused, not honoured.
+        p2 = cage.perfil(ws, casa=casa, extra_escritura=[os.path.join(casa, ".ssh")])
+        afirma("a mount inside a sealed root is not made writable",
+               f'(subpath "{os.path.join(os.path.realpath(casa), ".ssh")}")'
+               not in p2.split("(deny file-read")[0])
+    finally:
+        shutil.rmtree(base, ignore_errors=True)
+
+
+def _enjaulado(perfil_ruta, *orden):
+    return subprocess.run(["sandbox-exec", "-f", perfil_ruta, *orden],
+                          capture_output=True, text=True)
+
+
+def jaula_viva():
+    if sys.platform != "darwin" or not shutil.which("sandbox-exec"):
+        print("  (live seatbelt checks skipped: no sandbox-exec on this machine)")
+        return
+    base, casa, repo = entorno_falso()
+    try:
+        ruta = os.path.join(base, "cage.sb")
+        with open(ruta, "w") as f:
+            f.write(cage.perfil(repo, casa=casa))
+        r = _enjaulado(ruta, "/bin/cat", os.path.join(casa, ".ssh", "id_ed25519"))
+        afirma("live: the planted SSH key is unreadable inside the cage",
+               r.returncode != 0 and "FAKE-PRIVATE-KEY" not in r.stdout, r.stdout or r.stderr)
+        r = _enjaulado(ruta, "/bin/cat", os.path.join(casa, ".git-credentials"))
+        afirma("live: the planted git credentials are unreadable inside the cage",
+               r.returncode != 0 and "FAKE-TOKEN" not in r.stdout)
+        r = _enjaulado(ruta, "/bin/zsh", "-c",
+                       f"echo ok > {repo}/build.txt && cat {repo}/build.txt")
+        afirma("live: the window still writes freely in its own repo",
+               r.returncode == 0 and r.stdout.strip() == "ok", r.stderr)
+        # The throwaway HOME sits under the system TMPDIR, which the cage keeps
+        # writable on purpose — so the write-refusal proof targets a sealed dir.
+        r = _enjaulado(ruta, "/bin/zsh", "-c", f"echo leak > {casa}/.ssh/stolen.txt")
+        afirma("live: a write into a sealed directory is refused by the kernel",
+               r.returncode != 0
+               and not os.path.exists(os.path.join(casa, ".ssh", "stolen.txt")))
+        r = _enjaulado(ruta, "/bin/zsh", "-c",
+                       f"/bin/zsh -c 'cat {casa}/.ssh/id_ed25519'")
+        afirma("live: a grandchild process inherits the cage",
+               r.returncode != 0 and "FAKE-PRIVATE-KEY" not in r.stdout)
+        linea = cage.linea(repo, "win one", casa=casa)
+        afirma("live: linea() hands back a sandbox-exec prefix",
+               linea.startswith("sandbox-exec -f "), linea)
+        perfil_generado = linea.split(" -f ", 1)[1].strip()
+        esperado = os.path.join(os.path.realpath(casa), ".agents-city", ".runtime", "cage")
+        afirma("live: the generated profile lands under the runtime cage dir with 0600",
+               perfil_generado.startswith(esperado)
+               and oct(os.stat(perfil_generado).st_mode & 0o777) == "0o600",
+               perfil_generado)
+    finally:
+        shutil.rmtree(base, ignore_errors=True)
+
+
+texto_del_perfil()
+excepciones_y_errores()
+mounts_agente_primero()
+jaula_viva()
+sys.exit(resumen("cage"))