driftproof 0.8.0 → 0.8.1

package/README.md

@@ -211,6 +211,36 @@ Writing a suite that measures fairly is its own craft — see
 
 The surface and judge settings used are recorded in every receipt.
 
+### Isolation (the cli surfaces)
+
+A `SKILL.md` you did not write is instructions to an agent that has tools. On
+the two cli surfaces driftproof therefore never runs `claude` or `codex` as you.
+Every spawn goes through a hop to a dedicated unprivileged unix user, from an
+empty environment:
+
+```
+/usr/bin/sudo -n -u driftproof-eval /usr/bin/env -i HOME=<its home> PATH=<its ~/.local/bin>:/usr/bin:/bin bash -lc '<wrapper>' driftproof-eval-hop claude -p ...
+```
+
+Only `HOME` and `PATH` reach the child, both constructed from the user name, none
+copied from your shell. The working directory is a fresh temp directory made for
+that one call and removed after it, including on timeout. The CLI argv is passed
+as separate arguments, never as a shell string. What the evaluated agent cannot
+see: your environment (tokens, keys), your home directory (SSH keys, CLI session
+files), your current directory, and your CLI configuration.
+
+**Operator prerequisite, set up once** (see `RUNBOOK.md`): that user exists with a
+mode-700 home and no extra groups, has its own logged-in `claude` and `codex`
+under `~/.local/bin`, and a sudoers rule lets you run commands as it with
+`NOPASSWD`. `DRIFTPROOF_EVAL_USER` names the user (default `driftproof-eval`).
+Without the prerequisite a run fails at once, before any call, and says so.
+
+**`--trusted-skill`** runs the legacy same-user path instead: your environment,
+your cwd, your CLI login. It exists for exactly one case, a skill you authored
+yourself on a machine with no eval user. Never pass it for a skill fetched from
+anywhere else. The api surfaces are unaffected either way; they make HTTP calls
+and spawn nothing.
+
 ### Cost guard
 
 Sampling multiplies calls on two axes, and the second one is easy to miss. Each
@@ -241,7 +271,7 @@ A receipt is the unit of evidence — one JSON document conforming to
     "model_release_date": "2025-10-01",
     "provider": "anthropic",
     "surface": "claude-cli",
-    "runner_version": "0.8.0",
+    "runner_version": "0.8.1",
     "date_utc": "2026-07-27T…Z",
     "registry": "registered",
     "transcripts": "hashes-only",
@@ -315,7 +345,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: driftproofhq/driftproof@v0.8.0
+      - uses: driftproofhq/driftproof@v0.8.1
         with:
           skill-dir: skills/my-skill
           models: claude-haiku-4-5
@@ -331,7 +361,11 @@ fails the job on `REGRESSED` unless you set `fail-on-regression: 'false'`. For a
 free CI dry-run with **zero model calls**, set `DRIFTPROOF_STUB=1` in the job env —
 the runner returns canned receipts so the wiring can be tested without spend (this
 is exactly how the action's own [self-test](.github/workflows/action-selftest.yml)
-runs).
+runs). That self-test is also the proof behind the input hardening: on every
+run it passes one hostile value (a quote, a semicolon, `$(...)`, a backtick and
+a newline) through each of the action's five inputs on the real runner and
+fails unless every one is refused before anything ran, so a green check there
+is a claim you can read, not one you have to take.
 
 ### Badge
 

package/bin/driftproof

@@ -10,7 +10,7 @@ const { runSkillOnModel, summarizeReceipt, projectCalls } = require('../lib/run'
 const { SAMPLING } = require('../lib/sampling');
 const { validateReceipt, verifyReceiptHash } = require('../lib/receipt');
 const { buildDriftReport, revisionPairProblem } = require('../lib/diff');
-const { surfaceForModel, isSubscriptionSurface, resolveModel } = require('../lib/provider');
+const { surfaceForModel, isSubscriptionSurface, resolveModel, evalUser } = require('../lib/provider');
 const { estimateRunCostUSD, BudgetTracker } = require('../lib/cost');
 const { registryStatus } = require('../lib/models');
 const { verdictFromReceipt, badgeEndpoint, githubOutputLines } = require('../lib/verdict');
@@ -54,6 +54,10 @@ function loadRc(skillDir) {
   return merged;
 }
 
+// Flags that never take a value, so `--trusted-skill <skill-dir>` keeps the dir
+// positional instead of swallowing it as the flag's value.
+const BOOLEAN_FLAGS = new Set(['trusted-skill']);
+
 function parseArgs(argv) {
   const positional = [];
   const flags = {};
@@ -62,7 +66,7 @@ function parseArgs(argv) {
     if (a.startsWith('--')) {
       const key = a.slice(2);
       const next = argv[i + 1];
-      if (next === undefined || next.startsWith('--')) { flags[key] = true; }
+      if (BOOLEAN_FLAGS.has(key) || next === undefined || next.startsWith('--')) { flags[key] = true; }
       else { flags[key] = next; i++; }
     } else positional.push(a);
   }
@@ -76,7 +80,7 @@ USAGE
   ${PROJECT_NAME} init <dir>                          scaffold SKILL.md + evals/evals.json + .driftproofrc
   ${PROJECT_NAME} run <skill-dir> [--models a,b] [--samples N] [--max-cases N] [--max-calls N]
                         [--judge-model M] [--concurrency N] [--max-usd N]
-                        [--keep-transcripts] [--out DIR]
+                        [--keep-transcripts] [--out DIR] [--trusted-skill]
   ${PROJECT_NAME} diff <receiptA.json> <receiptB.json> [--out FILE] [--mode release|revision]
   ${PROJECT_NAME} validate <receipt.json>
   ${PROJECT_NAME} badge <receipt.json> [--out FILE] [--github-output]
@@ -88,6 +92,7 @@ ENV
   ANTHROPIC_API_KEY required when CLAUDE_PROVIDER=api
   DRIFTPROOF_REGISTRY  path to an alternate model registry (default: the packaged config/models.json)
   DRIFTPROOF_STUB=1    offline stub surface — canned receipts, zero model calls (for CI)
+  DRIFTPROOF_EVAL_USER the unix user the isolated hop runs the CLI as (default: driftproof-eval)
 
 NOTES
   - Default models list is 'haiku' only (cheap dev default).
@@ -112,6 +117,16 @@ NOTES
     conservative default price.
   - --concurrency runs that many (case,mode) tasks at once (default 1). Higher
     values cut wall-clock on the cli surface (cold-start dominated).
+  - ISOLATION (default). On the two cli surfaces every \`claude\` / \`codex\` spawn
+    runs as a dedicated unprivileged unix user (DRIFTPROOF_EVAL_USER) through
+    sudo, from an EMPTY environment (only HOME and PATH, constructed), in a fresh
+    temp working directory removed after the call. A third-party SKILL.md is
+    instructions to an agent with tools; this is what keeps it away from your
+    keys, tokens and files. Operator prerequisite: that user, its own logged-in
+    CLIs, and a NOPASSWD sudoers rule (see RUNBOOK.md).
+  - --trusted-skill runs the legacy same-user path instead: your environment,
+    your cwd, your CLI login. FOR SKILLS YOU AUTHORED YOURSELF ONLY. Never pass
+    it for a skill fetched from anywhere else.
   - import converts another tool's results into a valid receipt with HONEST
     epistemics: verification_level DECLARED (never TESTED), surface "external",
     source "imported/<tool>", and NO fabricated hashes. Imported receipts are
@@ -137,6 +152,10 @@ async function cmdRun(positional, flags) {
   const concurrency = flags.concurrency ? parseInt(flags.concurrency, 10) : (rc.concurrency != null ? parseInt(rc.concurrency, 10) : 1);
   const maxUsd = flags['max-usd'] ? parseFloat(flags['max-usd']) : (rc.max_usd != null ? parseFloat(rc.max_usd) : DEV_MAX_USD);
   const keepTranscripts = !!flags['keep-transcripts'];
+  // spec 022: the same-user spawn exists only behind this flag. Resolving the
+  // eval user here means a bad DRIFTPROOF_EVAL_USER is refused before the banner.
+  const trusted = !!flags['trusted-skill'];
+  const isolation = trusted ? 'same-user (--trusted-skill: self-authored skill)' : `eval-user (${evalUser()})`;
   const outDir = flags.out ? path.resolve(flags.out) : RECEIPTS_DIR;
   fs.mkdirSync(outDir, { recursive: true });
 
@@ -166,6 +185,7 @@ async function cmdRun(positional, flags) {
   console.log(`  content_hash: ${skill.contentHash.slice(0, 16)}…  suite: ${skill.suite.caseCount} cases (${skill.suite.suiteHash.slice(0, 12)}…)`);
   console.log(`  surface: ${surface}   models: ${models.join(', ')}   samples/case: ${samples}   concurrency: ${concurrency}`);
   console.log(`  registry: ${regStatuses.join('  ')}${keepTranscripts ? '   transcripts: retained-local' : ''}`);
+  if (subSurfaces.length) console.log(`  isolation: ${isolation}`);
   console.log(`  projected calls: ${perModelCalls}/model × ${models.length} model(s) = ${totalProjected}   per-model cap: ${maxCalls}`);
   console.log(`  projected cost: ~$${cost.totalUSD.toFixed(2)} (rough upper bound; budget $${maxUsd.toFixed(2)}, hard-stop $${(maxUsd * 1.25).toFixed(2)})`);
   if (subSurfaces.length) console.log(`  actual metered spend on ${subSurfaces.join(', ')}: $0.00 (subscription; the $ figure is the estimated-equivalent API cost, counted against the cap identically)`);
@@ -200,7 +220,7 @@ async function cmdRun(positional, flags) {
         skill,
         model,
         opts: {
-          maxCases, maxCalls, samples, judgeModel, concurrency, budget, keepTranscripts,
+          maxCases, maxCalls, samples, judgeModel, concurrency, budget, keepTranscripts, trusted,
           onProgress: (p) => {
             if (p.phase === 'done') console.log(`  ${p.case} / ${p.mode}: ${p.outcome} (${p.score.toFixed(2)} ± ${(p.stddev || 0).toFixed(2)})`);
           },

package/config.js

@@ -9,7 +9,7 @@ const PROJECT_NAME = 'driftproof';
 // Bumped whenever the runner's behaviour or receipt-generation semantics change
 // in a way that could affect results. Recorded into every receipt as
 // run.runner_version so a receipt is reproducible against a known engine.
-const RUNNER_VERSION = '0.8.0';
+const RUNNER_VERSION = '0.8.1';
 
 // The eval format we CONSUME (we deliberately do not invent our own).
 const SUITE_FORMAT = 'agentskills.io/evals';

package/lib/judge.js

@@ -81,9 +81,9 @@ function judgeSettings(samples, judgeModel) {
 // Grade one response once. Returns { score, reason, raw }.
 // `raw` is the judge's verbatim output text (hashed into the receipt for
 // transcript auditability, and optionally retained under --keep-transcripts).
-async function gradeOnce({ task, response, rubric, model, timeoutMs, temperature }) {
+async function gradeOnce({ task, response, rubric, model, timeoutMs, temperature, trusted = false }) {
   const prompt = buildJudgePrompt({ task, response, rubric });
-  const { text, attempts, usage } = await complete({ system: JUDGE_SYSTEM, prompt, model, maxTokens: 400, timeoutMs, temperature });
+  const { text, attempts, usage } = await complete({ system: JUDGE_SYSTEM, prompt, model, maxTokens: 400, timeoutMs, temperature, trusted });
   let parsed;
   try {
     parsed = extractJsonObject(text);
@@ -104,7 +104,9 @@ async function gradeOnce({ task, response, rubric, model, timeoutMs, temperature
 // JUDGE calls timed out on the api policy while running on a CLI surface, which
 // is the second shadowing site and the one #007's prep session had not found.
 // Passing `undefined` through lets lib/provider.js resolve the declared policy.
-async function gradeSamples({ task, response, rubric, model, samples = 5, timeoutMs }) {
+// `trusted` (spec 022) is plumbed to complete() untouched: the judge takes the
+// same spawn path as the generation it grades, so --trusted-skill is whole-run.
+async function gradeSamples({ task, response, rubric, model, samples = 5, timeoutMs, trusted = false }) {
   const settings = judgeSettings(samples, model);
   const scores = [];
   const reasons = [];
@@ -114,7 +116,7 @@ async function gradeSamples({ task, response, rubric, model, samples = 5, timeou
   for (let i = 0; i < samples; i++) {
     let r;
     try {
-      r = await gradeOnce({ task, response, rubric, model, timeoutMs, temperature: settings.temperature === null ? undefined : settings.temperature });
+      r = await gradeOnce({ task, response, rubric, model, timeoutMs, temperature: settings.temperature === null ? undefined : settings.temperature, trusted });
     } catch (e) {
       // A judge sample that persistently failed (e.g. timed out after retries):
       // tag the error so the runner can charge for the spend and mark the whole

package/lib/provider.js

@@ -4,7 +4,9 @@
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
-const { spawn } = require('child_process');
+// Called through the module object (cp.spawn), never destructured: the gate
+// records spawns by replacing that property, so nothing real runs offline.
+const cp = require('child_process');
 const { withRetry, withTimeout } = require('./json');
 const { stubComplete, stubEnabled } = require('./stub');
 const {
@@ -126,7 +128,10 @@ const CODEX_OVERHEAD_NOTE =
 //
 // `temperature` is honoured ONLY on api surfaces; cli surfaces control sampling
 // themselves, so temperature is ignored there and the receipt records that fact.
-async function complete({ system, prompt, model, maxTokens = 1024, timeoutMs = null, temperature = undefined }) {
+// `trusted` (spec 022) selects the SAME-USER legacy spawn on the two CLI lanes.
+// It is false unless a caller says otherwise; bin/driftproof exposes it as
+// --trusted-skill, for skills the operator authored. Api lanes ignore it.
+async function complete({ system, prompt, model, maxTokens = 1024, timeoutMs = null, temperature = undefined, trusted = false }) {
   const surface = surfaceForModel(model);
   const provider = providerForSurface(surface);
   // Offline stub surface: canned completion, zero model calls. The receipt still
@@ -149,9 +154,9 @@ async function complete({ system, prompt, model, maxTokens = 1024, timeoutMs = n
   const laneRunner = () => {
     switch (surface) {
       case 'api': return completeAnthropicApi({ system, prompt, model, maxTokens, temperature });
-      case 'claude-cli': return completeClaudeCli({ system, prompt, model, timeoutMs: effTimeout });
+      case 'claude-cli': return completeClaudeCli({ system, prompt, model, timeoutMs: effTimeout, trusted });
       case 'openai-api': return completeOpenaiApi({ system, prompt, model, maxTokens, temperature, timeoutMs: effTimeout });
-      case 'openai-cli': return completeCodexCli({ system, prompt, model, timeoutMs: effTimeout });
+      case 'openai-cli': return completeCodexCli({ system, prompt, model, timeoutMs: effTimeout, trusted });
       default: throw new Error(`unknown surface: ${surface}`);
     }
   };
@@ -200,47 +205,182 @@ async function completeAnthropicApi({ system, prompt, model, maxTokens, temperat
   return { text, usage: parseAnthropicApiUsage(resp.usage) };
 }
 
-// ── anthropic/cli (claude -p) ──────────────────────────────────────────────────
-function completeClaudeCli({ system, prompt, model, timeoutMs }) {
-  return new Promise((resolve, reject) => {
-    // Strip ANTHROPIC_API_KEY so the CLI uses the subscription session, not the
-    // metered API key. Everything else in the env is preserved.
+// ── isolation: the eval-user hop (spec 022) ───────────────────────────────────
+//
+// Every local-CLI spawn runs as a DEDICATED UNPRIVILEGED UNIX USER by default.
+// The third-party SKILL.md a run evaluates is instructions to an agent with
+// tools, and until spec 022 that agent ran as the operator: same uid, whole
+// environment block, operator's cwd, operator's CLI configuration. The
+// 2026-09-03 security audit (findings A2, N5) confirmed a live API token in the
+// inherited environment and this host's SSH keys and CLI session tokens
+// readable by the same uid; this was then reproduced by execution.
+//
+// The boundary is a uid change reached through sudo from an EMPTY environment:
+//
+//   /usr/bin/sudo -n -u <eval-user> /usr/bin/env -i HOME=/home/<eval-user>
+//     PATH=/home/<eval-user>/.local/bin:/usr/bin:/bin bash -lc '<wrapper>'
+//     driftproof-eval-hop <cli> <cli-args...>
+//
+// Operator prerequisite, NOT created here (RUNBOOK.md): the user exists with a
+// mode-700 home and no extra groups, has its own logged-in `claude` and `codex`
+// under ~/.local/bin, and a sudoers rule grants the operator NOPASSWD as that
+// user. The runner refuses loudly when any of that is missing; it never creates
+// a user, edits sudoers, or logs a CLI in.
+//
+// The same-user (legacy) spawn survives ONLY behind `trusted: true`, exposed by
+// bin/driftproof as --trusted-skill, for skills the operator authored.
+const SUDO_BIN = '/usr/bin/sudo';
+const ENV_BIN = '/usr/bin/env';
+const EVAL_USER_DEFAULT = 'driftproof-eval';
+// A user name that can safely follow `sudo -u`: no leading dash, no shell
+// metacharacter, no path separator. Anything else is refused before any spawn.
+const EVAL_USER_RE = /^[a-z_][a-z0-9_-]{0,31}$/;
+// The ONLY names the child environment carries, each CONSTRUCTED from the eval
+// user's name in isolatedEnv() and never copied from process.env. Verified
+// 2026-09-03: both CLIs run through the hop with these two alone; the login
+// shell supplies LANG and TERM itself. Data, frozen, asserted by the gate.
+const ISOLATED_ENV_ALLOWLIST = Object.freeze(['HOME', 'PATH']);
+// $0 of the wrapper, so `ps` shows what the bash process is.
+const HOP_LABEL = 'driftproof-eval-hop';
+// The wrapper runs INSIDE the hop, as the eval user. It takes the CLI as
+// positional parameters ("$@"), so no SKILL.md text is ever shell-interpreted.
+//   - the cwd is a fresh per-call directory under the system tmp, created by
+//     the eval user (one the parent creates is mode 700 to it);
+//   - the CLI runs under setsid in its own process group, stdin preserved
+//     (`<&0` defeats the /dev/null a non-interactive bash gives a background job);
+//   - TERM/INT/HUP, which sudo relays from the parent on timeout, kill that
+//     whole group, remove the directory and exit 143;
+//   - a normal exit removes the directory and returns the CLI's status.
+const ISOLATED_WRAPPER = [
+  'd=$(mktemp -d -t driftproof-eval.XXXXXXXX) || exit 97',
+  'cd "$d" || exit 97',
+  'setsid -w "$@" <&0 & pid=$!',
+  'trap \'kill -TERM -- "-$pid" 2>/dev/null; sleep 1; kill -KILL -- "-$pid" 2>/dev/null; cd /; rm -rf "$d"; exit 143\' TERM INT HUP',
+  'wait "$pid"; r=$?',
+  'cd /; rm -rf "$d"; exit $r',
+].join('; ');
+
+// DRIFTPROOF_EVAL_USER selects WHICH user isolates, never WHETHER isolation
+// happens (that is the trusted flag, an argv decision). Empty means default.
+function evalUser() {
+  const raw = process.env.DRIFTPROOF_EVAL_USER;
+  const u = raw === undefined || raw === '' ? EVAL_USER_DEFAULT : raw;
+  if (!EVAL_USER_RE.test(u)) throw new Error(`DRIFTPROOF_EVAL_USER is not a plausible unix user name: ${JSON.stringify(u)}`);
+  return u;
+}
+
+// The child environment: constructed, not copied. Keys are exactly the allowlist.
+function isolatedEnv(user) {
+  const home = `/home/${user}`;
+  return { HOME: home, PATH: `${home}/.local/bin:/usr/bin:/bin` };
+}
+
+// The spawn plan for one CLI call: { mode, user, file, args, env }. Pure, so the
+// gate can inspect what WOULD be spawned. Untrusted → the hop; trusted → the
+// legacy same-user spawn exactly as it was (env inherited; the claude lane still
+// strips ANTHROPIC_API_KEY so the CLI uses the subscription, not the metered key).
+function buildSpawnPlan({ bin, args, trusted = false }) {
+  if (trusted) {
     const env = { ...process.env };
-    delete env.ANTHROPIC_API_KEY;
-
-    // v0.4: `--output-format json` returns ONE JSON object carrying both the
-    // final text (`result`) and the token usage (`usage`) — the default text
-    // output carries no usage at all, which is why usage was previously null on
-    // this lane. The text is read from the parsed object; if the CLI ever emits
-    // something unparseable we fall back to the raw stdout so a run degrades to
-    // the old behaviour (text, no usage) rather than failing.
-    const args = ['-p', '--output-format', 'json', '--model', resolveModel(model)];
-    if (system) args.push('--append-system-prompt', system);
-
-    const child = spawn('claude', args, { env, stdio: ['pipe', 'pipe', 'pipe'] });
-    let out = '';
-    let err = '';
-    const killer = setTimeout(() => { child.kill('SIGKILL'); }, timeoutMs + 5000);
-    child.stdout.on('data', (d) => { out += d; });
-    child.stderr.on('data', (d) => { err += d; });
-    child.on('error', (e) => {
-      clearTimeout(killer);
-      if (e.code === 'ENOENT') reject(new Error("the anthropic/cli surface requires the `claude` CLI on PATH. Install it or set CLAUDE_PROVIDER=api."));
-      else reject(e);
-    });
-    child.on('close', (code) => {
-      clearTimeout(killer);
-      if (code !== 0) return reject(new Error(`claude CLI exited ${code}: ${err.slice(0, 400)}`));
-      const parsed = parseClaudeCliJson(out);
-      if (!parsed) return resolve({ text: out.trim(), usage: null });
-      if (parsed.isError) return reject(new Error(`claude CLI reported is_error: ${String(parsed.text || '').slice(0, 300)}`));
-      resolve({ text: String(parsed.text || '').trim(), usage: parsed.usage });
-    });
-    child.stdin.write(prompt);
+    if (bin === 'claude') delete env.ANTHROPIC_API_KEY;
+    return { mode: 'same-user', user: null, file: bin, args: [...args], env };
+  }
+  const user = evalUser();
+  const childEnv = isolatedEnv(user);
+  return {
+    mode: 'isolated',
+    user,
+    file: SUDO_BIN,
+    args: ['-n', '-u', user, ENV_BIN, '-i', ...ISOLATED_ENV_ALLOWLIST.map((k) => `${k}=${childEnv[k]}`), 'bash', '-lc', ISOLATED_WRAPPER, HOP_LABEL, bin, ...args],
+    // The sudo front process gets NOTHING from this process. sudo resolves
+    // /usr/bin/env itself; env -i then starts the child from empty.
+    env: {},
+  };
+}
+
+// Run a plan: `input` to stdin, stdout/stderr collected, settled on close.
+// The timeout signal differs by mode. The legacy child gets SIGKILL as it
+// always did. The hop gets SIGTERM: it is the signal the operator's uid can
+// deliver to a root-owned sudo, and the one sudo relays to the wrapper's trap.
+// SIGKILL would neither be permitted nor relayed, and a wrapper without the
+// trap left the CLI orphaned with the stdout pipe open, so close never fired.
+function runPlan(plan, { input = null, timeoutMs = 300000, graceMs = 5000 } = {}) {
+  return new Promise((resolve, reject) => {
+    let child;
+    try { child = cp.spawn(plan.file, plan.args, { env: plan.env, stdio: ['pipe', 'pipe', 'pipe'] }); }
+    catch (e) { return reject(e); }
+    let stdout = '';
+    let stderr = '';
+    let timedOut = false;
+    const killer = setTimeout(() => {
+      timedOut = true;
+      child.kill(plan.mode === 'isolated' ? 'SIGTERM' : 'SIGKILL');
+    }, timeoutMs + graceMs);
+    child.stdout.on('data', (d) => { stdout += d; });
+    child.stderr.on('data', (d) => { stderr += d; });
+    child.on('error', (e) => { clearTimeout(killer); reject(e); });
+    child.on('close', (code, signal) => { clearTimeout(killer); resolve({ code, signal, stdout, stderr, timedOut }); });
+    child.stdin.on('error', () => { /* EPIPE if the CLI exits before reading all of stdin */ });
+    if (input != null) child.stdin.write(input);
     child.stdin.end();
   });
 }
 
+// The hop with an arbitrary command in place of the CLI, for the gate: the same
+// plan builder and the same runner, never trusted. No provider is reached.
+function runIsolated(cmdArgv, opts = {}) {
+  const [bin, ...args] = cmdArgv;
+  return runPlan(buildSpawnPlan({ bin, args, trusted: false }), { graceMs: 0, ...opts });
+}
+
+// A hop failure, said in terms of what to fix. Returns null when the failure is
+// the CLI's own (exit status from inside the hop), which the lane reports as before.
+function hopFailure(bin, r) {
+  const err = String(r.stderr || '').trim();
+  if (r.code === 127) {
+    return `the \`${bin}\` CLI is not on the eval user's PATH inside the isolated hop (${err.slice(0, 200)}). `
+      + 'Install and log it in as that user (RUNBOOK.md), or pass --trusted-skill for a skill you authored.';
+  }
+  const sudoLine = err.split('\n').find((l) => /^sudo:/.test(l));
+  if (sudoLine) {
+    return `the isolated eval-user hop failed before reaching \`${bin}\`: ${sudoLine}. The eval user and its NOPASSWD sudoers `
+      + 'rule are an operator prerequisite (RUNBOOK.md); pass --trusted-skill only for a skill you authored.';
+  }
+  return null;
+}
+
+// ── anthropic/cli (claude -p) ──────────────────────────────────────────────────
+async function completeClaudeCli({ system, prompt, model, timeoutMs, trusted = false }) {
+  // v0.4: `--output-format json` returns ONE JSON object carrying both the
+  // final text (`result`) and the token usage (`usage`) — the default text
+  // output carries no usage at all, which is why usage was previously null on
+  // this lane. The text is read from the parsed object; if the CLI ever emits
+  // something unparseable we fall back to the raw stdout so a run degrades to
+  // the old behaviour (text, no usage) rather than failing.
+  const args = ['-p', '--output-format', 'json', '--model', resolveModel(model)];
+  if (system) args.push('--append-system-prompt', system);
+  const plan = buildSpawnPlan({ bin: 'claude', args, trusted });
+  let r;
+  try {
+    r = await runPlan(plan, { input: prompt, timeoutMs });
+  } catch (e) {
+    if (e.code === 'ENOENT') {
+      throw new Error(plan.mode === 'isolated'
+        ? `the isolated hop requires ${SUDO_BIN}`
+        : "the anthropic/cli surface requires the `claude` CLI on PATH. Install it or set CLAUDE_PROVIDER=api.");
+    }
+    throw e;
+  }
+  if (r.code !== 0) {
+    const hop = plan.mode === 'isolated' ? hopFailure('claude', r) : null;
+    throw new Error(hop || `claude CLI exited ${r.code}: ${r.stderr.slice(0, 400)}`);
+  }
+  const parsed = parseClaudeCliJson(r.stdout);
+  if (!parsed) return { text: r.stdout.trim(), usage: null };
+  if (parsed.isError) throw new Error(`claude CLI reported is_error: ${String(parsed.text || '').slice(0, 300)}`);
+  return { text: String(parsed.text || '').trim(), usage: parsed.usage };
+}
+
 // ── openai/api (Chat Completions-compatible) ───────────────────────────────────
 // Generic OpenAI-compatible client using global fetch (Node ≥ 18). The base_url
 // is configurable — env OPENAI_BASE_URL wins, else the registry's provider
@@ -294,7 +434,7 @@ function openaiProviderConfig() {
 
 // ── openai/cli (codex exec — ChatGPT subscription) ─────────────────────────────
 // Invocation template (from the verified recon, reference_codex_cli):
-//   codex exec --json -s read-only --skip-git-repo-check --ephemeral -o <tmp> [-m <model>] "PROMPT"
+//   codex exec --json -s read-only --skip-git-repo-check --ephemeral [-m <model>] -
 // Honoured facts:
 //   - `-a/--ask-for-approval` is INVALID on `codex exec` — it is NEVER passed;
 //     exec already defaults to approval_policy "never".
@@ -305,6 +445,12 @@ function openaiProviderConfig() {
 //   - `codex exec` has no system-prompt flag, so a system prompt (the SKILL.md in
 //     with_skill mode) is folded into the prompt text.
 //   - stderr emits a harmless "Reading additional input from stdin…" notice.
+//   - `-o/--output-last-message` is NEVER passed (spec 022 AC-9, approval F-1).
+//     The final message is taken from the `--json` stream on the stdout pipe
+//     this process owns. A `-o` path is a file the child writes and the parent
+//     reads back; isolated, the child is the eval user running third-party
+//     instructions, and a symlink planted at that path would have made this
+//     process read an operator-owned file into the generation.
 const CODEX_EXEC_ARGS = ['exec', '--json', '-s', 'read-only', '--skip-git-repo-check', '--ephemeral'];
 
 function codexAuthPresent(homeDir) {
@@ -315,9 +461,9 @@ function codexAuthPresent(homeDir) {
 }
 
 // Build the exact argv for a codex exec call. Exposed for the gate to assert the
-// template (and that `-a` never appears). `outFile` receives the final message.
-function buildCodexArgs({ model, outFile }) {
-  const args = [...CODEX_EXEC_ARGS, '-o', outFile];
+// template (that `-a` never appears, and neither does `-o`).
+function buildCodexArgs({ model } = {}) {
+  const args = [...CODEX_EXEC_ARGS];
   if (model) args.push('-m', resolveModel(model));
   return args;
 }
@@ -326,66 +472,58 @@ function buildCodexArgs({ model, outFile }) {
 // means "read the prompt from stdin". The prompt is NEVER a positional argv —
 // real SKILL.md files start with `---` (YAML frontmatter) and codex rejects a
 // positional beginning with `--`. Exposed so the gate can lock this in.
-function codexFinalArgs({ model, outFile }) {
-  return [...buildCodexArgs({ model, outFile }), '-'];
+function codexFinalArgs({ model } = {}) {
+  return [...buildCodexArgs({ model }), '-'];
 }
 
-function completeCodexCli({ system, prompt, model, timeoutMs }) {
-  return new Promise((resolve, reject) => {
-    if (!codexAuthPresent()) {
-      return reject(new Error('the openai/cli surface requires codex auth (~/.codex/auth.json). Run `codex login` (or `codex login --device-auth` on a headless box).'));
+async function completeCodexCli({ system, prompt, model, timeoutMs, trusted = false }) {
+  // The auth presence check is a PARENT-side read of ~/.codex/auth.json, which
+  // only means something on the same-user path; the eval user's home is not
+  // readable from here, and a missing login there surfaces as codex's own error.
+  if (trusted && !codexAuthPresent()) {
+    throw new Error('the openai/cli surface requires codex auth (~/.codex/auth.json). Run `codex login` (or `codex login --device-auth` on a headless box).');
+  }
+  // codex exec has no system-prompt flag → fold the system prompt into the
+  // prompt text (this is how the SKILL.md reaches the model in with_skill mode).
+  const fullPrompt = system ? `${system}\n\n---\n\n${prompt}` : prompt;
+  // The prompt is delivered on STDIN, not as a positional argv: real SKILL.md
+  // files begin with `---` (YAML frontmatter), and a positional argument that
+  // starts with `--` is rejected by codex's arg parser ("unexpected argument
+  // '---'"). `-` as the positional tells `codex exec` to read instructions from
+  // stdin (per its --help), which is content-agnostic.
+  const plan = buildSpawnPlan({ bin: 'codex', args: codexFinalArgs({ model }), trusted });
+  // stdout is CAPTURED. `--json` streams JSONL events there: the last
+  // `item.completed`/`agent_message` carries the final text and the terminal
+  // `turn.completed` event carries this call's token usage — the only place
+  // codex reports it. Nothing is read from the filesystem after the call, on
+  // either mode: the stdout pipe is the one channel only the child we spawned
+  // can write to, and the eval user cannot make this process read a file
+  // through it (spec 022 AC-9).
+  let r;
+  try {
+    r = await runPlan(plan, { input: fullPrompt, timeoutMs });
+  } catch (e) {
+    if (e.code === 'ENOENT') {
+      throw new Error(plan.mode === 'isolated'
+        ? `the isolated hop requires ${SUDO_BIN}`
+        : 'the openai/cli surface requires the `codex` CLI on PATH (npm i -g @openai/codex).');
     }
-    // codex exec has no system-prompt flag → fold the system prompt into the
-    // prompt text (this is how the SKILL.md reaches the model in with_skill mode).
-    const fullPrompt = system ? `${system}\n\n---\n\n${prompt}` : prompt;
-    const outFile = path.join(os.tmpdir(), `driftproof-codex-${process.pid}-${Date.now()}-${Math.floor(codexCounter())}.txt`);
-    // The prompt is delivered on STDIN, not as a positional argv: real SKILL.md
-    // files begin with `---` (YAML frontmatter), and a positional argument that
-    // starts with `--` is rejected by codex's arg parser ("unexpected argument
-    // '---'"). `-` as the positional tells `codex exec` to read instructions from
-    // stdin (per its --help), which is content-agnostic.
-    const args = codexFinalArgs({ model, outFile });
-
-    // v0.4: stdout is CAPTURED (it was 'ignore'). `--json` streams JSONL events
-    // there, and the terminal `turn.completed` event carries this call's token
-    // usage — the only place codex reports it. The final message still comes from
-    // the -o file (cleaner than scraping the stream); the JSONL is read for usage.
-    const child = spawn('codex', args, { env: { ...process.env }, stdio: ['pipe', 'pipe', 'pipe'] });
-    let err = '';
-    let jsonl = '';
-    const killer = setTimeout(() => { child.kill('SIGKILL'); }, timeoutMs + 5000);
-    child.stdout.on('data', (d) => { jsonl += d; });
-    child.stderr.on('data', (d) => { err += d; });
-    child.on('error', (e) => {
-      clearTimeout(killer);
-      if (e.code === 'ENOENT') reject(new Error('the openai/cli surface requires the `codex` CLI on PATH (npm i -g @openai/codex).'));
-      else reject(e);
-    });
-    child.on('close', (code) => {
-      clearTimeout(killer);
-      let text = '';
-      try { text = fs.readFileSync(outFile, 'utf8'); } catch (_e) { /* fall through */ }
-      try { fs.unlinkSync(outFile); } catch (_e) { /* best effort */ }
-      if (code !== 0) return reject(new Error(`codex exec exited ${code}: ${String(err).slice(0, 400)}`));
-      const ev = parseCodexJsonl(jsonl);
-      // Prefer the -o file; fall back to the stream's agent_message if it is empty.
-      const finalText = String(text || ev.text || '').trim();
-      resolve({ text: finalText, usage: ev.usage });
-    });
-    child.stdin.on('error', () => { /* ignore EPIPE if codex exits before reading all input */ });
-    child.stdin.write(fullPrompt);
-    child.stdin.end();
-  });
+    throw e;
+  }
+  if (r.code !== 0) {
+    const hop = plan.mode === 'isolated' ? hopFailure('codex', r) : null;
+    throw new Error(hop || `codex exec exited ${r.code}: ${String(r.stderr).slice(0, 400)}`);
+  }
+  const ev = parseCodexJsonl(r.stdout);
+  return { text: String(ev.text || '').trim(), usage: ev.usage };
 }
 
-// A monotonically-increasing counter for temp-file uniqueness that does not use
-// Math.random (kept deterministic-friendly for any harness that forbids it).
-let _codexCounter = 0;
-function codexCounter() { _codexCounter += 1; return _codexCounter; }
-
 module.exports = {
   complete, resolveModel, surfaceLabel, providerName, MODEL_ALIASES,
   inferProvider, surfaceForModel, providerForSurface,
   isMeteredSurface, isSubscriptionSurface, retryPolicyForSurface,
   CODEX_OVERHEAD_NOTE, CODEX_EXEC_ARGS, buildCodexArgs, codexFinalArgs, codexAuthPresent,
+  // spec 022 — the eval-user hop
+  SUDO_BIN, EVAL_USER_DEFAULT, ISOLATED_ENV_ALLOWLIST, ISOLATED_WRAPPER, HOP_LABEL,
+  evalUser, isolatedEnv, buildSpawnPlan, runIsolated,
 };

package/lib/run.js

@@ -51,7 +51,7 @@ function projectCalls(caseCount, samples, draws = 1) {
 // Ask the target model to perform one eval case. `withSkill` decides whether the
 // SKILL.md is prepended as a system prompt (the whole point: measure the skill's
 // marginal effect vs a bare baseline).
-async function runCase({ skillMd, caseObj, model, withSkill, timeoutMs }) {
+async function runCase({ skillMd, caseObj, model, withSkill, timeoutMs, trusted = false }) {
   // Test seam (gate only): force a persistent timeout for a named case id so the
   // failed_timeout path is exercised deterministically without any live call.
   if (process.env.DRIFTPROOF_TEST_TIMEOUT_CASEID && process.env.DRIFTPROOF_TEST_TIMEOUT_CASEID === caseObj.id) {
@@ -60,7 +60,7 @@ async function runCase({ skillMd, caseObj, model, withSkill, timeoutMs }) {
     throw e;
   }
   const system = withSkill ? skillMd : undefined;
-  const { text, usage, wall_ms, attempts } = await complete({ system, prompt: caseObj.prompt, model, maxTokens: 1024, timeoutMs });
+  const { text, usage, wall_ms, attempts } = await complete({ system, prompt: caseObj.prompt, model, maxTokens: 1024, timeoutMs, trusted });
   return { text, usage, wall_ms, attempts };
 }
 
@@ -78,8 +78,8 @@ function outcomeFor(mean, stddev, threshold) {
 // `generationHash` binds the graded case to the exact generation text (v0.3).
 // Returns { caseResult, sampleTexts } — sampleTexts is transient (retained only
 // under --keep-transcripts; never part of the receipt).
-async function judgeCase({ caseObj, response, generationHash, judgeModel, mode, timeoutMs, samples }) {
-  const g = await gradeSamples({ task: caseObj.prompt, response, rubric: caseObj.rubric, model: judgeModel, samples, timeoutMs });
+async function judgeCase({ caseObj, response, generationHash, judgeModel, mode, timeoutMs, samples, trusted = false }) {
+  const g = await gradeSamples({ task: caseObj.prompt, response, rubric: caseObj.rubric, model: judgeModel, samples, timeoutMs, trusted });
   const outcome = outcomeFor(g.mean, g.stddev, caseObj.pass_threshold);
   const caseResult = {
     id: caseObj.id,
@@ -127,7 +127,7 @@ async function mapPool(items, concurrency, fn) {
 // a sealed receipt. Enforces a hard call cap; every model+judge call counts.
 //
 // opts: { maxCases, maxCalls, samples, judgeModel, timeoutMs, concurrency,
-//         onProgress, budget, keepTranscripts, nowIso }
+//         onProgress, budget, keepTranscripts, nowIso, trusted }
 //   budget          — optional BudgetTracker; accumulates estimated per-call
 //                     USD as the run proceeds and hard-stops at 1.25× the cap.
 //   keepTranscripts — when true, the run records transcripts:"retained-local"
@@ -177,6 +177,10 @@ async function runSkillOnModel({ skill, model, opts = {} }) {
   const onProgress = opts.onProgress || (() => {});
   const budget = opts.budget || null;
   const keepTranscripts = !!opts.keepTranscripts;
+  // spec 022: the SAME-USER legacy spawn is reachable only when a caller says
+  // `trusted: true` (bin/driftproof --trusted-skill). Every other caller of this
+  // function, the report scripts and the release watcher included, isolates.
+  const trusted = !!opts.trusted;
 
   let cases = skill.suite.cases;
   if (opts.maxCases && cases.length > opts.maxCases) cases = cases.slice(0, opts.maxCases);
@@ -222,12 +226,12 @@ async function runSkillOnModel({ skill, model, opts = {} }) {
       const drawIndex = draws.length;
       try {
         onProgress({ case: c.id, mode, phase: 'generate', draw: drawIndex });
-        const gen = await runCase({ skillMd: skill.skillMd, caseObj: c, model: modelId, withSkill, timeoutMs: ctGen });
+        const gen = await runCase({ skillMd: skill.skillMd, caseObj: c, model: modelId, withSkill, timeoutMs: ctGen, trusted });
         calls += 1;
         if (budget) budget.add((gen.attempts || 1) * perCallCostUSD(modelId, genKind(withSkill)));
         const generationHash = sha256(String(gen.text || ''));
         onProgress({ case: c.id, mode, phase: 'judge', samples, draw: drawIndex });
-        const jr = await judgeCase({ caseObj: c, response: gen.text, generationHash, judgeModel, mode, timeoutMs: ctJudge, samples });
+        const jr = await judgeCase({ caseObj: c, response: gen.text, generationHash, judgeModel, mode, timeoutMs: ctJudge, samples, trusted });
         calls += samples;
         if (budget) budget.add((jr.attempts || samples) * perCallCostUSD(judgeModel, 'judge'));
         const draw = {

package/lib/verdict.js

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 'use strict';
 
+const crypto = require('crypto');
 const { EFFECT_FLOOR } = require('../config');
 
 // Single-receipt verdict + shields.io badge.
@@ -72,14 +73,39 @@ function badgeEndpoint(receipt, { label = 'driftproof' } = {}) {
 }
 
 // Lines suitable for appending to a GitHub Actions $GITHUB_OUTPUT file.
+//
+// Spec 023 (audit A6). Each entry is written in GitHub's multiline form,
+//
+//   name<<ghadelim_<32 hex>
+//   value
+//   ghadelim_<32 hex>
+//
+// with a delimiter drawn fresh from crypto.randomBytes for EVERY entry, so no
+// value can close a block early; and any value carrying \r or \n is refused
+// with a throw before anything is written. The bare `name=value` form this used
+// to emit let a model_id with a newline in it (any string a receipt carries; a
+// .driftproofrc in a skill directory sets it) append a second, attacker-chosen
+// entry, and that entry was then interpolated into the enforce step's shell.
+// Refusing is the honest writer: a line break in a model id is not a value
+// anybody meant to publish. Entries are joined by '\n' with no trailing newline
+// so the caller's console.log stays the one that terminates the text.
+function githubOutputEntry(name, value) {
+  const val = String(value);
+  if (/[\r\n]/.test(val)) {
+    throw new Error(`refusing to write $GITHUB_OUTPUT: the value of "${name}" contains a line break (${JSON.stringify(val)})`);
+  }
+  const delim = `ghadelim_${crypto.randomBytes(16).toString('hex')}`;
+  return `${name}<<${delim}\n${val}\n${delim}`;
+}
+
 function githubOutputLines(receipt) {
   const v = verdictFromReceipt(receipt);
   return [
-    `verdict=${v.verdict}`,
-    `delta=${v.delta}`,
-    `message=${v.message}`,
-    `color=${v.color}`,
-  ].join('\n');
+    ['verdict', v.verdict],
+    ['delta', v.delta],
+    ['message', v.message],
+    ['color', v.color],
+  ].map(([k, val]) => githubOutputEntry(k, val)).join('\n');
 }
 
-module.exports = { verdictFromReceipt, badgeEndpoint, githubOutputLines, shortModel, VERDICTS };
+module.exports = { verdictFromReceipt, badgeEndpoint, githubOutputLines, githubOutputEntry, shortModel, VERDICTS };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "driftproof",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "A dated proof that this skill, this hash, this model, still helps: run a skill's eval suite with and without the skill across model versions, emit hash-verified dated receipts, and diff receipts into drift reports.",
   "license": "Apache-2.0",
   "keywords": [