plan-auditor 2.4.4__tar.gz → 2.4.6__tar.gz

{plan_auditor-2.4.4 → plan_auditor-2.4.6}/CHANGELOG.md

@@ -4,6 +4,31 @@ All notable changes to plan-auditor. Versions are published to PyPI and npm.
 
 ## Unreleased
 
+## 2.4.6 — Release alignment
+
+- Publishes the 2.4.5 tree to PyPI and npm. The 2.4.5 commit landed after
+  the 2.4.5 PyPI upload, so both registries were one commit behind main.
+  No behavioural change beyond 2.4.5 itself.
+
+## 2.4.5 — Opt-in Linux privilege-separated check execution
+
+### Security
+
+- Add `PLAN_AUDITOR_CHECK_ISOLATION=required` with explicit non-root
+  `PLAN_AUDITOR_CHECK_UID` / `PLAN_AUDITOR_CHECK_GID`: root-run Linux
+  supervisors execute project-controlled checks under the named UID/GID with
+  supplementary groups dropped, while the trusted process retains HMAC signing.
+- Require root-owned protected control state, trusted workspace ancestry,
+  root-owned private HMAC key material and non-writable key directories.
+  Missing/invalid isolation configuration fails closed.
+- Restrict the child environment to a small, documented allowlist, excluding
+  HMAC credentials, unrelated API tokens, `HOME`, `PYTHONPATH` and SSH sockets.
+- Require real root-run Linux CI regression tests proving a child cannot read
+  either a root-owned `0600` key file or `.plan-auditor` control state.
+- Document required host configuration. This is a Linux UID permission boundary,
+  **not** a cross-platform container/VM, network or kernel sandbox; default
+  same-user mode continues to have its documented limits.
+
 ## 2.4.4 — HMAC check subprocess boundary
 
 ### Security

{plan_auditor-2.4.4 → plan_auditor-2.4.6}/CITATION.cff

@@ -21,8 +21,8 @@ authors:
 repository-code: "https://github.com/Furox-Art/plan-auditor"
 url: "https://github.com/Furox-Art/plan-auditor"
 license: MIT
-version: 2.4.4
-date-released: "2026-10-10"
+version: 2.4.6
+date-released: "2026-10-11"
 keywords:
   - AI coding agents
   - deterministic verification

{plan_auditor-2.4.4 → plan_auditor-2.4.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: plan-auditor
-Version: 2.4.4
+Version: 2.4.6
 Summary: Deterministic verification and evidence auditing for AI coding agents: sealed plans, hash-chained evidence, and an independent completion gate
 Project-URL: Homepage, https://github.com/Furox-Art/plan-auditor
 Project-URL: Repository, https://github.com/Furox-Art/plan-auditor

{plan_auditor-2.4.4 → plan_auditor-2.4.6}/SECURITY.md

@@ -147,9 +147,16 @@ As of the 2.4.4 source hardening, behavioral-check subprocesses no longer inheri
 `PLAN_AUDITOR_HMAC_KEY` or `PLAN_AUDITOR_HMAC_KEY_FILE` from the verifier.
 This reduces inadvertent environment-based credential exposure, but **does not
 sandbox checks**. Project-controlled checks running as the supervisor's OS user
-can still read any external key file that user can read. A hostile-agent security
-boundary needs an independently sandboxed or lower-privilege check executor;
-see [deployment isolation](docs/deployment-isolation.md).
+can still read any external key file that user can read.
+
+Version 2.4.5 adds an **opt-in Linux-only privilege boundary**. A trusted root-run
+supervisor can require each behavioral check to execute as a separate, non-root
+UID/GID with no supplementary groups; the child cannot read a root-only HMAC key
+or protected control state. Unsafe or incomplete configuration refuses execution.
+This is not automatic in normal mode and is not a container, seccomp or network
+sandbox. Never grant the check user access to the supervisor's key or installed
+trusted program. Setup instructions and limitations:
+[deployment isolation](docs/deployment-isolation.md).
 
 `plan-auditor integrity init` and `plan-auditor integrity status` manage a
 keyed authentication of evidence, seals and the agent registry. Detection is only

{plan_auditor-2.4.4 → plan_auditor-2.4.6}/SKILL.md

@@ -3,7 +3,7 @@ name: plan-auditor
 description: Invoke this skill by name as `plan-auditor` for non-trivial build/implement/fix work or whenever the user wants independent proof that an AI actually completed the requested work. It converts the task into explicit requirements and machine-verifiable steps, automatically compiles those structured requirements/dataflow into a sealed LLM-free STRIPS contract, proves every step with real command evidence, and blocks completion until every active plan has an intact contract and a fresh deterministic audit.
 argument-hint: "<task description>"
 metadata:
-  version: "2.4.4"
+  version: "2.4.6"
 ---
 
 # Plan Auditor — strict plan + independent verification

{plan_auditor-2.4.4 → plan_auditor-2.4.6}/docs/deployment-isolation.md

@@ -40,11 +40,55 @@ must not be able to open it. Start the supervisor service with:
 PLAN_AUDITOR_HMAC_KEY_FILE=/var/lib/plan-auditor/keys/project.key
 ```
 
-The key file should not be inside the workspace. Use filesystem ACLs, service
-sandboxing or container mounts so neither `pa-agent` nor `pa-check` can read
-it. The stock CLI runs behavioral checks as its own subprocesses, so this
-three-principal topology requires an external isolated execution arrangement;
-it is not automatically created by `plan-auditor audit`.
+The key file must be outside the workspace and be private to the trusted
+supervisor. Since 2.4.5, the stock CLI offers an **opt-in Linux privilege drop**
+for each behavioral check (not a container sandbox). The supervisor must run as
+root; the untrusted check executes as a dedicated, unprivileged OS user.
+
+A minimal trusted-host layout is:
+
+```bash
+# Run once as a trusted administrator. The workspace and all ancestors must
+# be root-owned. A writable workspace directory must have the sticky bit.
+sudo useradd --system --no-create-home --shell /usr/sbin/nologin pa-check
+sudo install -d -o root -g root -m 1777 /srv/pa-workspace
+sudo install -d -o root -g root -m 0700 /srv/pa-workspace/.plan-auditor
+sudo install -d -o root -g root -m 0700 /var/lib/plan-auditor/keys
+# Provision a strong, random project.key through a trusted mechanism,
+# owned by root, mode 0600. Never commit or print the key.
+```
+
+The parent directories of the key file must be root-owned and not writable
+by group/other. Place the trusted Plan Auditor installation and Python entry
+point **outside the agent-writable workspace**, also owned by root. Configure
+a host-owned service or root-run invocation:
+
+```bash
+sudo env \
+  PLAN_AUDITOR_HMAC_KEY_FILE=/var/lib/plan-auditor/keys/project.key \
+  PLAN_AUDITOR_CHECK_ISOLATION=required \
+  PLAN_AUDITOR_CHECK_UID="$(id -u pa-check)" \
+  PLAN_AUDITOR_CHECK_GID="$(id -g pa-check)" \
+  /usr/local/bin/plan-auditor audit /srv/pa-workspace
+```
+
+The path `/usr/local/bin/plan-auditor` is illustrative; it must point to a
+trusted root-managed installation. The host must separately activate and seal
+its authoritative plan and retain ownership of `.plan-auditor`; the agent must
+not control the supervisor service's environment. The check identity must not
+be root and must not have access to the HMAC file or control-state directory.
+
+This mode rejects unsupported platforms, non-root supervisors, invalid IDs,
+world/group-readable key files, insecure key parents, and writable workspace
+ancestors without root ownership and sticky-bit protection. A failure stops the
+check with a nonzero result; it never silently falls back to same-user execution.
+Ordinary installations without these variables retain the documented default,
+which **does not protect against a deliberately malicious same-user process**.
+
+This is a Linux user-permissions boundary, **not** a namespace, seccomp, resource
+quota, or network sandbox. Host operators may additionally put the untrusted
+check identity in a separately restricted container/VM and must not grant it
+sensitive groups, writable privileged paths, ambient capabilities or sudo rights.
 
 ## Container/VM boundary
 

{plan_auditor-2.4.4 → plan_auditor-2.4.6}/docs/threat-model.md

@@ -137,7 +137,18 @@ separate container/VM, give the untrusted agent write access only to the intende
 workspace/product surface, and expose the HMAC key only to the supervisor identity.
 **Also isolate code execution:** product-controlled behavioral checks must execute
 under a separate, keyless OS/container identity, not merely as child processes of
-that privileged supervisor. The default CLI does not enforce this OS boundary.
+that privileged supervisor. On Linux, an opt-in root-run mode
+(`PLAN_AUDITOR_CHECK_ISOLATION=required` with distinct non-root
+`PLAN_AUDITOR_CHECK_UID` and `PLAN_AUDITOR_CHECK_GID`) drops the subprocess
+UID/GID and supplementary groups before running checks. The trusted supervisor
+retains the HMAC key; the check cannot read its root-only key file or root-private
+control state. The mode validates ownership and permissions and fails closed if
+it cannot establish the boundary.
+
+By default, or on Windows/macOS, the CLI still makes **no OS-isolation guarantee**.
+UID/GID separation is not a full kernel sandbox: trusted installation paths,
+host-owned configuration, capability/sudo restrictions, and optionally stronger
+container/VM/network isolation remain the deployment operator's responsibility.
 
 ## Fail-closed terminology
 

{plan_auditor-2.4.4 → plan_auditor-2.4.6}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "plan-auditor",
-  "version": "2.4.4",
+  "version": "2.4.6",
   "description": "Thin Node launcher for the plan-auditor deterministic verification CLI for AI coding agents (requires Python 3.10+ on PATH)",
   "main": "index.js",
   "bin": {

{plan_auditor-2.4.4 → plan_auditor-2.4.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plan-auditor"
-version = "2.4.4"
+version = "2.4.6"
 description = "Deterministic verification and evidence auditing for AI coding agents: sealed plans, hash-chained evidence, and an independent completion gate"
 readme = "README.md"
 license = "MIT"

{plan_auditor-2.4.4 → plan_auditor-2.4.6}/scripts/audit_check.py

@@ -30,6 +30,7 @@ from contextlib import contextmanager
 from typing import TYPE_CHECKING
 
 if TYPE_CHECKING:  # pragma: no cover - type checkers see the single package import
+    from scripts.check_isolation import check_launch_options
     from scripts.contract import PlanTrustError
     from scripts.exec_trust import require_plan_trust
 else:
@@ -37,9 +38,11 @@ else:
     # importable unprefixed. The runtime fallback is required; the TYPE_CHECKING
     # branch keeps static analysis from seeing the names bound twice.
     try:
+        from scripts.check_isolation import check_launch_options
         from scripts.contract import PlanTrustError
         from scripts.exec_trust import require_plan_trust
     except ImportError:
+        from check_isolation import check_launch_options
         from contract import PlanTrustError
         from exec_trust import require_plan_trust
 
@@ -678,25 +681,20 @@ def _kill_process_tree(proc):
 
 def _bounded_command(command, base, timeout, max_output):
     """Execute ``command`` (an argv list) with no shell and bounded resources."""
-    # Behavioral checks execute potentially untrusted project code. Do not pass
-    # the supervisor's authenticated-integrity credentials to these children.
-    # This is defense in depth, not an OS boundary: another process running as
-    # the same user may still read an externally stored key file.
-    child_env = os.environ.copy()
-    child_env.pop("PLAN_AUDITOR_HMAC_KEY", None)
-    child_env.pop("PLAN_AUDITOR_HMAC_KEY_FILE", None)
     kwargs = {
         "cwd": base,
         "stdout": subprocess.PIPE,
         "stderr": subprocess.STDOUT,
         "shell": False,
-        "env": child_env,
     }
     if os.name == "nt":
         kwargs["creationflags"] = getattr(subprocess, "CREATE_NEW_PROCESS_GROUP", 0)
     else:
         kwargs["start_new_session"] = True
     try:
+        # Optional Linux root-run UID/GID drop. Even with no isolation enabled,
+        # never forward the HMAC key or key-file locator to behavioral checks.
+        kwargs.update(check_launch_options(base))
         proc = subprocess.Popen(command, **kwargs)
     except (OSError, ValueError) as exc:
         return None, "start", str(exc), False

plan_auditor-2.4.6/scripts/check_isolation.py

@@ -0,0 +1,116 @@
+"""Opt-in Linux privilege separation for project-controlled verification checks.
+
+This is a UID/GID security boundary, not a container, seccomp or kernel sandbox.
+A trusted root-owned supervisor and a root-owned key/control plane are required.
+"""
+from __future__ import annotations
+
+import os
+import stat
+import sys
+from pathlib import Path
+from typing import Any
+
+MODE_ENV = "PLAN_AUDITOR_CHECK_ISOLATION"
+UID_ENV = "PLAN_AUDITOR_CHECK_UID"
+GID_ENV = "PLAN_AUDITOR_CHECK_GID"
+KEY_ENV = "PLAN_AUDITOR_HMAC_KEY"
+KEY_FILE_ENV = "PLAN_AUDITOR_HMAC_KEY_FILE"
+
+# The isolated child must not inherit arbitrary supervisor secrets.
+_SAFE_ENV = ("PATH", "LANG", "LC_ALL", "LC_CTYPE", "TZ", "TERM", "PYTHONIOENCODING", "PYTHONUTF8")
+
+
+class CheckIsolationError(ValueError):
+    """Refuse execution if the requested OS boundary cannot be established."""
+
+
+def _positive_id(raw: str | None, name: str) -> int:
+    if not raw or not raw.isascii() or not raw.isdecimal():
+        raise CheckIsolationError(f"{name} must be a positive numeric Linux ID")
+    value = int(raw)
+    if not 0 < value < 2**31:
+        raise CheckIsolationError(f"{name} must be a non-root Linux ID")
+    return value
+
+
+def _root_owned_private_control(root: Path) -> None:
+    workspace = root.resolve(strict=True)
+    # The agent must not be able to rename the workspace itself through a
+    # writable ancestor: private permissions on .plan-auditor alone are not enough.
+    for current in (workspace, *workspace.parents):
+        st = current.stat()
+        if st.st_uid != 0 or not stat.S_ISDIR(st.st_mode):
+            raise CheckIsolationError("workspace and ancestors must be root-owned directories")
+        if st.st_mode & 0o022 and not st.st_mode & stat.S_ISVTX:
+            raise CheckIsolationError(
+                "writable workspace/ancestor directories require root ownership and the sticky bit"
+            )
+    control = workspace / ".plan-auditor"
+    try:
+        control_stat = control.lstat()
+    except OSError as exc:
+        raise CheckIsolationError(f"cannot inspect trusted control directory: {exc}") from exc
+    if (not stat.S_ISDIR(control_stat.st_mode)
+            or control_stat.st_uid != 0 or control_stat.st_mode & 0o077):
+        raise CheckIsolationError(
+            "isolated checks require a root-owned, private (0700) .plan-auditor directory"
+        )
+
+
+def _private_root_key_file(root: Path) -> None:
+    value = os.environ.get(KEY_FILE_ENV)
+    if not value:
+        return
+    supplied = Path(value).expanduser()
+    if supplied.is_symlink():
+        raise CheckIsolationError("isolated checks reject HMAC key symlinks")
+    try:
+        path = supplied.resolve(strict=True)
+        info = path.stat()
+    except OSError as exc:
+        raise CheckIsolationError(f"cannot inspect HMAC key: {exc}") from exc
+    if path.is_relative_to(root):
+        raise CheckIsolationError("HMAC key must be outside the workspace")
+    if not stat.S_ISREG(info.st_mode) or info.st_uid != 0 or info.st_mode & 0o077:
+        raise CheckIsolationError("isolated checks require a root-owned 0600 HMAC key file")
+    # Neither the check user nor the agent should be able to replace the key
+    # by writing to one of its parent directories.
+    for parent in path.parents:
+        parent_stat = parent.stat()
+        if parent_stat.st_uid != 0 or parent_stat.st_mode & 0o022:
+            raise CheckIsolationError("HMAC key directory chain must be root-owned and non-writable")
+
+
+def check_launch_options(base: str | os.PathLike[str]) -> dict[str, Any]:
+    """Return safe subprocess options; fail closed on partial/invalid configuration."""
+    mode = os.environ.get(MODE_ENV)
+    uid_raw = os.environ.get(UID_ENV)
+    gid_raw = os.environ.get(GID_ENV)
+    child_env = os.environ.copy()
+    child_env.pop(KEY_ENV, None)
+    child_env.pop(KEY_FILE_ENV, None)
+    if mode is None and uid_raw is None and gid_raw is None:
+        return {"env": child_env}
+    if mode != "required":
+        raise CheckIsolationError(
+            "check identity settings require PLAN_AUDITOR_CHECK_ISOLATION=required"
+        )
+    if not sys.platform.startswith("linux") or not hasattr(os, "geteuid") or os.geteuid() != 0:
+        raise CheckIsolationError("required check isolation only supports a trusted root-run Linux verifier")
+    uid = _positive_id(uid_raw, UID_ENV)
+    gid = _positive_id(gid_raw, GID_ENV)
+    root = Path(base).resolve(strict=True)
+    _root_owned_private_control(root)
+    _private_root_key_file(root)
+    # Never pass through arbitrary environment variables such as API tokens,
+    # HOME, GITHUB_TOKEN, SSH_AUTH_SOCK or the verifier's Python import paths.
+    isolated_env = {k: os.environ[k] for k in _SAFE_ENV if k in os.environ}
+    isolated_env["HOME"] = "/nonexistent"
+    isolated_env["PYTHONDONTWRITEBYTECODE"] = "1"
+    return {
+        "env": isolated_env,
+        "user": uid,
+        "group": gid,
+        "extra_groups": [],
+    }

{plan_auditor-2.4.4 → plan_auditor-2.4.6}/supervisor/__init__.py

@@ -1,5 +1,5 @@
 """Plan Auditor — AI Agent Verification Supervisor."""
-__version__ = "2.4.4"
+__version__ = "2.4.6"
 
 from .adversarial import run_adversarial_review
 from .agents import Agent, MultiAgentRegistry

plan_auditor-2.4.6/tests/test_linux_check_os_isolation.py

@@ -0,0 +1,150 @@
+"""Checks for the opt-in Linux root-supervisor / unprivileged-check boundary."""
+from __future__ import annotations
+
+import json
+import os
+import stat
+import sys
+import tempfile
+from pathlib import Path
+
+import pytest
+
+from scripts import audit_check as core
+from scripts.check_isolation import CheckIsolationError, check_launch_options
+
+
+def _request_isolation(monkeypatch, uid="65534", gid="65534"):
+    monkeypatch.setenv("PLAN_AUDITOR_CHECK_ISOLATION", "required")
+    monkeypatch.setenv("PLAN_AUDITOR_CHECK_UID", uid)
+    monkeypatch.setenv("PLAN_AUDITOR_CHECK_GID", gid)
+
+
+def test_partial_configuration_refuses_to_run(tmp_path, monkeypatch):
+    monkeypatch.setenv("PLAN_AUDITOR_CHECK_UID", "65534")
+    rc, state, reason, _overflow = core._bounded_command(
+        [sys.executable, "-c", "print('must not execute')"], str(tmp_path), 5, 2048
+    )
+    assert rc is None and state == "start"
+    assert "require PLAN_AUDITOR_CHECK_ISOLATION=required" in reason
+
+
+@pytest.mark.parametrize("uid,gid", [("0", "65534"), ("65534", "0"), ("bad", "65534"), ("", "65534")])
+def test_invalid_identity_fails_closed(tmp_path, monkeypatch, uid, gid):
+    _request_isolation(monkeypatch, uid=uid, gid=gid)
+    # Simulate a privileged host to inspect the identity validator on all OSes.
+    monkeypatch.setattr(sys, "platform", "linux")
+    monkeypatch.setattr(os, "geteuid", lambda: 0, raising=False)
+    with pytest.raises(CheckIsolationError, match="non-root|positive"):
+        check_launch_options(tmp_path)
+
+
+def test_required_isolation_refuses_unprivileged_verifier(tmp_path, monkeypatch):
+    _request_isolation(monkeypatch)
+    monkeypatch.setattr(os, "geteuid", lambda: 1000, raising=False)
+    with pytest.raises(CheckIsolationError, match="root-run Linux"):
+        check_launch_options(tmp_path)
+
+
+@pytest.mark.skipif(not sys.platform.startswith("linux") or not hasattr(os, "geteuid") or os.geteuid() != 0,
+                    reason="real kernel UID/GID isolation needs root-run Linux")
+def test_real_unprivileged_check_cannot_read_hmac_or_control_plane(monkeypatch):
+    import pwd
+
+    check_user = pwd.getpwnam("nobody")
+    # root-owned sticky workspace allows agent-owned product files without
+    # permitting rename/replacement of root-owned .plan-auditor control state.
+    with tempfile.TemporaryDirectory(prefix="pa-os-check-", dir="/tmp") as folder, \
+            tempfile.TemporaryDirectory(prefix="pa-os-key-", dir="/root") as key_folder:
+        workspace = Path(folder)
+        workspace.chmod(0o1777)
+        control = workspace / ".plan-auditor"
+        control.mkdir(mode=0o700)
+        marker = control / "seal.json"
+        marker.write_text("trusted", encoding="utf-8")
+        key = Path(key_folder) / "secret.key"
+        key.write_text("not-a-real-credential", encoding="utf-8")
+        key.chmod(0o600)
+
+        _request_isolation(monkeypatch, str(check_user.pw_uid), str(check_user.pw_gid))
+        monkeypatch.setenv("PLAN_AUDITOR_HMAC_KEY_FILE", str(key))
+        monkeypatch.setenv("GITHUB_TOKEN", "do-not-inherit-test-token")
+        script = (
+            "import json,os,pathlib,sys;"
+            "key=pathlib.Path(sys.argv[1]);control=pathlib.Path(sys.argv[2]);"
+            "definitely_no_key=os.getenv('PLAN_AUDITOR_HMAC_KEY_FILE') is None;"
+            "denied=[];"
+            "\nfor p in (key,control):"
+            "\n try: p.read_bytes();denied.append(False)"
+            "\n except PermissionError: denied.append(True)"
+            "\nprint(json.dumps({'uid':os.geteuid(),'gid':os.getegid(),"
+            "'denied':denied,'key_hidden':definitely_no_key,"
+            "'other_secret_hidden':os.getenv('GITHUB_TOKEN') is None}))"
+        )
+        passed, detail, output = core.run_check(
+            {"type": "run", "argv": [sys.executable, "-c", script, str(key), str(marker)],
+             "expect_exit": 0, "output_regex": "key_hidden"},
+            str(workspace),
+        )
+        assert passed, (detail, output)
+        rc, state, raw, overflow = core._bounded_command(
+            [sys.executable, "-c", script, str(key), str(marker)], str(workspace), 15, 8192
+        )
+        assert (rc, state, overflow) == (0, "ok", False), raw
+        result = json.loads(raw.strip())
+        assert result == {
+            "uid": check_user.pw_uid, "gid": check_user.pw_gid,
+            "denied": [True, True], "key_hidden": True, "other_secret_hidden": True,
+        }
+        assert marker.read_text(encoding="utf-8") == "trusted"
+        assert stat.S_IMODE(key.stat().st_mode) == 0o600
+
+
+@pytest.mark.skipif(not sys.platform.startswith("linux") or not hasattr(os, "geteuid") or os.geteuid() != 0,
+                    reason="real kernel filesystem policy needs root-run Linux")
+def test_insecure_external_key_file_is_rejected(monkeypatch):
+    import pwd
+
+    user = pwd.getpwnam("nobody")
+    with tempfile.TemporaryDirectory(prefix="pa-os-check-", dir="/tmp") as folder, \
+            tempfile.TemporaryDirectory(prefix="pa-os-key-", dir="/root") as key_folder:
+        root = Path(folder)
+        root.chmod(0o1777)
+        (root / ".plan-auditor").mkdir(mode=0o700)
+        key = Path(key_folder) / "secret.key"
+        key.write_text("test-only-key", encoding="utf-8")
+        key.chmod(0o644)
+        _request_isolation(monkeypatch, str(user.pw_uid), str(user.pw_gid))
+        monkeypatch.setenv("PLAN_AUDITOR_HMAC_KEY_FILE", str(key))
+        with pytest.raises(CheckIsolationError, match="0600"):
+            check_launch_options(root)
+
+
+@pytest.mark.skipif(not sys.platform.startswith("linux") or not hasattr(os, "geteuid") or os.geteuid() != 0,
+                    reason="real Linux ownership checks need root")
+def test_insecure_workspace_can_not_replace_trusted_control_state(monkeypatch):
+    import pwd
+
+    check_user = pwd.getpwnam("nobody")
+    with tempfile.TemporaryDirectory(prefix="pa-os-check-", dir="/tmp") as folder:
+        workspace = Path(folder)
+        workspace.chmod(0o777)  # world writable without sticky bit
+        (workspace / ".plan-auditor").mkdir(mode=0o700)
+        _request_isolation(monkeypatch, str(check_user.pw_uid), str(check_user.pw_gid))
+        with pytest.raises(CheckIsolationError, match="sticky bit"):
+            check_launch_options(workspace)
+
+
+@pytest.mark.skipif(not sys.platform.startswith("linux") or not hasattr(os, "geteuid") or os.geteuid() != 0,
+                    reason="real Linux ownership checks need root")
+def test_insecure_control_directory_is_rejected(monkeypatch):
+    import pwd
+
+    check_user = pwd.getpwnam("nobody")
+    with tempfile.TemporaryDirectory(prefix="pa-os-check-", dir="/tmp") as folder:
+        workspace = Path(folder)
+        workspace.chmod(0o1777)
+        (workspace / ".plan-auditor").mkdir(mode=0o755)
+        _request_isolation(monkeypatch, str(check_user.pw_uid), str(check_user.pw_gid))
+        with pytest.raises(CheckIsolationError, match="private"):
+            check_launch_options(workspace)