security: confine session workers and add standalone proxy

.github/workflows/ci.yaml

@@ -126,6 +126,12 @@ jobs:
         timeout-minutes: 45
         run: just test-linux-rust
 
+      # These integration targets execute the real self-confined worker
+      # binaries. The unit coverage command uses --lib/--bins and therefore
+      # cannot prove Landlock/seccomp took effect before readiness.
+      - name: Confined worker subprocess tests
+        run: cargo test --locked -p capsem-ledger -p capsem-proxy --test subprocess
+
       # cargo check still runs BLAKE3's native SIMD build. Both guest targets
       # belong on their native Linux C toolchain, already provisioned above.
       # Build and link the production feature set, not a pure-Rust substitute.
@@ -281,8 +287,13 @@ jobs:
       - name: Unit tests with coverage
         run: |
           set -o pipefail
-          cargo llvm-cov nextest --no-cfg-coverage --lib --bins --profile ci-unit --codecov --output-path cache/target/coverage/rust/unit.json -p capsem-api -p capsem-sdk -p capsem-archive -p capsem-telemetry -p capsem-assets -p capsem-config -p capsem-credentials -p capsem-foundation -p capsem-core -p capsem-admin -p capsem-agent -p capsem-logger -p capsem-proto -p capsem-guard -p capsem-gateway -p capsem-service -p capsem -p capsem-tui -p capsem-router -p capsem-network -p capsem-mcp-aggregator -p capsem-mcp-builtin -p capsem-tray -p capsem-app -p capsem-process -p capsem-bench -p capsem-mock-server
-          cargo llvm-cov report --summary-only -p capsem-api -p capsem-sdk -p capsem-archive -p capsem-telemetry -p capsem-assets -p capsem-config -p capsem-credentials -p capsem-foundation -p capsem-core -p capsem-admin -p capsem-agent -p capsem-logger -p capsem-proto -p capsem-guard -p capsem-gateway -p capsem-service -p capsem -p capsem-tui -p capsem-router -p capsem-network -p capsem-mcp-aggregator -p capsem-mcp-builtin -p capsem-tray -p capsem-app -p capsem-process -p capsem-bench -p capsem-mock-server 2>&1 | tee cache/target/coverage/rust/summary.txt
+          cargo llvm-cov nextest --no-cfg-coverage --lib --bins --profile ci-unit --codecov --output-path cache/target/coverage/rust/unit.json -p capsem-api -p capsem-sdk -p capsem-archive -p capsem-telemetry -p capsem-assets -p capsem-config -p capsem-credentials -p capsem-foundation -p capsem-core -p capsem-admin -p capsem-agent -p capsem-logger -p capsem-proto -p capsem-guard -p capsem-gateway -p capsem-service -p capsem -p capsem-tui -p capsem-router -p capsem-ledger -p capsem-proxy -p capsem-network -p capsem-mcp-aggregator -p capsem-mcp-builtin -p capsem-tray -p capsem-app -p capsem-process -p capsem-bench -p capsem-mock-server
+          cargo llvm-cov report --summary-only -p capsem-api -p capsem-sdk -p capsem-archive -p capsem-telemetry -p capsem-assets -p capsem-config -p capsem-credentials -p capsem-foundation -p capsem-core -p capsem-admin -p capsem-agent -p capsem-logger -p capsem-proto -p capsem-guard -p capsem-gateway -p capsem-service -p capsem -p capsem-tui -p capsem-router -p capsem-ledger -p capsem-proxy -p capsem-network -p capsem-mcp-aggregator -p capsem-mcp-builtin -p capsem-tray -p capsem-app -p capsem-process -p capsem-bench -p capsem-mock-server 2>&1 | tee cache/target/coverage/rust/summary.txt
+
+      # Run the production executables under the host's real Seatbelt policy.
+      # --lib/--bins above compiles but does not execute integration targets.
+      - name: Confined worker subprocess tests
+        run: cargo test --locked -p capsem-ledger -p capsem-proxy --test subprocess
 
       # Integration tests (tests/ directory, cross-crate)
       - name: Integration tests with coverage
@@ -297,6 +308,11 @@ jobs:
           CAPSEM_FRONTEND_JUNIT: ${{ github.workspace }}/cache/target/coverage/junit/frontend.xml
         run: bash build_system/scripts/web/check-web-surface.sh frontend-verify
 
+      - name: Build Python SDK distributions
+        run: |
+          uv sync --project sdk/python --frozen --no-install-project
+          uv run --project sdk/python --frozen --no-sync python -m build --no-isolation --outdir cache/target/sdk/python sdk/python
+
       # Python schema tests with coverage
       - name: Python SDK tests with coverage
         working-directory: sdk/python
@@ -313,13 +329,15 @@ jobs:
         working-directory: sdk/typescript
         run: |
           pnpm install --frozen-lockfile
+          pnpm run prewarm:package
           pnpm test --reporter=default --reporter=junit --outputFile=../../cache/target/coverage/junit/typescript-sdk.xml
 
       # Builds against the SDK package the step above just built.
       - name: MCP server tests with coverage
         working-directory: mcp/typescript
         run: |
           pnpm install --frozen-lockfile
+          pnpm run prewarm:packed
           pnpm test --reporter=default --reporter=junit --outputFile=../../cache/target/coverage/junit/mcp-typescript.xml
 
       - name: Cross-system Python schema tests with coverage
@@ -358,10 +376,12 @@ jobs:
       - name: Python integration tests (non-VM suites)
         run: |
           bash build_system/scripts/test/prepare-install-test-assets.sh
-          cargo build -p capsem-process -p capsem-service -p capsem -p capsem-mock-server -p capsem-bench
+          cargo build -p capsem-process -p capsem-ledger -p capsem-proxy -p capsem-service -p capsem -p capsem-mock-server -p capsem-bench
           for bin in cache/target/cargo/debug/capsem-process cache/target/cargo/debug/capsem-service cache/target/cargo/debug/capsem cache/target/cargo/debug/capsem-mock-server cache/target/cargo/debug/capsem-bench-rs; do
             codesign --sign - --entitlements build_system/packaging/macos/entitlements.plist --force "$bin"
           done
+          codesign --sign - --force cache/target/cargo/debug/capsem-ledger
+          codesign --sign - --force cache/target/cargo/debug/capsem-proxy
           uv run --project build_system --frozen python -m pytest -c build_system/pyproject.toml --rootdir . tests/capsem-bootstrap/ \
             tests/capsem-codesign/ \
             tests/capsem-rootfs-artifacts/ \

.github/workflows/release.yaml

@@ -381,6 +381,8 @@ jobs:
             -p capsem \
             -p capsem-service \
             -p capsem-process \
+            -p capsem-ledger \
+            -p capsem-proxy \
             -p capsem-tui \
             -p capsem-router \
             -p capsem-mcp-aggregator \
@@ -396,9 +398,9 @@ jobs:
         env:
           APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
         run: |
-          for bin in capsem capsem-service capsem-process capsem-tui capsem-router capsem-mcp-aggregator capsem-mcp-builtin capsem-gateway capsem-tray capsem-admin capsem-mock-server capsem-bench-rs; do
+          for bin in capsem capsem-service capsem-process capsem-ledger capsem-proxy capsem-tui capsem-router capsem-mcp-aggregator capsem-mcp-builtin capsem-gateway capsem-tray capsem-admin capsem-mock-server capsem-bench-rs; do
             entitlement_args=()
-            if [[ "$bin" != capsem-router ]]; then
+            if [[ "$bin" != capsem-router && "$bin" != capsem-ledger && "$bin" != capsem-proxy ]]; then
               entitlement_args=(--entitlements build_system/packaging/macos/entitlements.plist)
             fi
             codesign --sign "$APPLE_SIGNING_IDENTITY" \
@@ -734,7 +736,7 @@ jobs:
           pkgutil --pkg-info com.capsem.pkg | grep -F "version: $VERSION"
           test -d "/Applications/Capsem.app"
           test -x "/Applications/Capsem.app/Contents/MacOS/capsem-app"
-          for bin in capsem capsem-admin capsem-gateway capsem-router capsem-mcp-aggregator capsem-mcp-builtin capsem-process capsem-service capsem-tray capsem-tui capsem-mock-server capsem-bench-rs; do
+          for bin in capsem capsem-admin capsem-gateway capsem-router capsem-mcp-aggregator capsem-mcp-builtin capsem-process capsem-ledger capsem-proxy capsem-service capsem-tray capsem-tui capsem-mock-server capsem-bench-rs; do
             test -x "$HOME/.capsem/bin/$bin"
             "$HOME/.capsem/bin/$bin" --version | grep -F "$VERSION"
           done
@@ -819,7 +821,7 @@ jobs:
           sudo dpkg -i "$package"
           test ! -e /var/run/capsem/install-manifest
           dpkg-query -W -f='${Version}' capsem | grep -Fx "$VERSION"
-          for bin in capsem capsem-admin capsem-app capsem-gateway capsem-router capsem-mcp-aggregator capsem-mcp-builtin capsem-process capsem-service capsem-tray capsem-tui capsem-mock-server capsem-bench-rs; do
+          for bin in capsem capsem-admin capsem-app capsem-gateway capsem-router capsem-mcp-aggregator capsem-mcp-builtin capsem-process capsem-ledger capsem-proxy capsem-service capsem-tray capsem-tui capsem-mock-server capsem-bench-rs; do
             test -x "/usr/bin/$bin"
             if [ "$bin" != "capsem-app" ]; then
               "/usr/bin/$bin" --version | grep -F "$VERSION"

AGENTS.md

@@ -43,6 +43,7 @@ See `/dev-just` for the full recipe reference and dependency chains.
 ```
 crates/capsem-foundation/      Low-level paths, UDS, logging, polling, and IPC handshake
 crates/capsem-archive/  Block-compressed body archive for session ledgers (pure Rust)
+crates/capsem-ledger/           Confined session-ledger worker and archive codec executor
 crates/capsem-telemetry/       Every metrics-facade metric name, kind, unit, and description
 crates/capsem-assets/          Asset manifest compatibility, resolution, download, and verification
 crates/capsem-api/             Gateway wire types and OpenAPI contract shared by clients
@@ -52,6 +53,7 @@ crates/capsem-credentials/     Credential provider contracts and durable credent
 crates/capsem-core/            VM, hypervisor, security engine, and host network runtime
 crates/capsem-service/         Daemon service (axum HTTP over UDS, VM lifecycle)
 crates/capsem-process/         Per-VM process (boots VM, bridges vsock, job store)
+crates/capsem-proxy/           Confined HTTP/DNS proxy worker for VM and standalone traffic
 crates/capsem/                 CLI client (create, shell, exec, list, install, assets, update)
 crates/capsem-tui/             Terminal control UI (reads and drives state via the gateway)
 crates/capsem-admin/           Runtime image/asset/release administration (validate, materialize, publish)