agent: OS-level isolation for the agent tool boundary (SPEC §10)

harnessd gains --socket mode (Unix socket, trusted uid, mutating ops
serialized); the harness client speaks socket when
HOTPATH_HARNESS_SOCKET is set. scripts/agent-isolated.sh launches an
attempt with the agent tree confined — mountns mode (repo bind-mounted
read-only, CAP_SYS_ADMIN/CAP_SYS_PTRACE dropped; no credential copying)
or user mode (unprivileged hpagent, bench-metal shape).
scripts/isolation-check.sh + just isolation-check verify the boundary
from the agent's side: 19 checks, both modes, all passing — repo
writes, forged ledger INSERTs, trust-binary replacement, rw remounts,
and userns re-entry all refused; the harnessd socket door works.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EcKPWQ3MQD4NdEHwar96u2

justfile

@@ -47,3 +47,12 @@ verdict target candidate run_id class hypothesis hotspot *flags:
         --candidate-bin "{{candidate}}" --run-id "{{run_id}}" \
         --playbook-class {{class}} --hypothesis "{{hypothesis}}" \
         --hotspot "{{hotspot}}" {{flags}}
+
+# One unattended agent attempt behind the SPEC §10 OS boundary:
+# harnessd (trusted uid) on a Unix socket, agent loop as user hpagent.
+agent-attempt target run_id max_turns="40":
+    sh scripts/agent-isolated.sh {{target}} {{run_id}} {{max_turns}}
+
+# Verify the OS boundary from the agent user's side (negative + positive)
+isolation-check:
+    sh scripts/isolation-check.sh