thirdshift setup: check that Security sessions can sandbox target code on this machine #608

This was generated by AI during triage.

Problem

The thirdshift-security-audit skill won't execute target code unless OS-enforced isolation is available: no external network, a scratch-only writable area, a dummy HOME and so on ("If every control cannot be enforced, do not execute target code"). When the host can't provide that, every Security review that needs a proof-of-concept ends incomplete, and every Security run will presumably hit the same limit. Nothing tells the operator this before a Run fails.

This happened on the thirdshift host for #596 / PR #605 (see #607 for the misleading Cause text). The host is Ubuntu 24.04:

• bwrap was not installed. bubblewrap 0.9.0 is now installed via apt.
• kernel.apparmor_restrict_unprivileged_userns = 1 (Ubuntu's default since 23.10). unshare --user --map-root-user and unshare --net fail with Operation not permitted.
• Even with bubblewrap installed, bwrap --unshare-user … fails with setting up uid map: Permission denied, and --unshare-all fails with loopback: Failed RTM_NEWADDR: Operation not permitted. Ubuntu 24.04 ships no AppArmor profile for /usr/bin/bwrap (later releases add one), so bwrap stays unusable until the operator adds a profile granting it userns, or relaxes the sysctl.

Request

thirdshift setup should check whether Security runs and Security reviews on this machine can actually sandbox target code, and say what is missing and how to fix it.

Open questions for triage

• What exactly should the check probe? A real attempt (for example, bwrap --unshare-all --ro-bind / / true) is more trustworthy than looking for binaries, because the binary can exist and still fail, as it does here.
• Which sandbox tools count? Only bwrap, or the skill's "equivalent platform capabilities" too (for example, macOS sandbox-exec)? What is the guidance on macOS?
• Should the check only warn, or should it also offer to install or configure anything? Changing the AppArmor policy needs root and weakens a kernel hardening default, so printing the commands is probably safer than doing it.
• Should it run only when Security is enabled in the User config, and should a Run's preflight also warn before spending a session?
• Should the probe live next to the skill's own requirements, so the two can't drift apart?