fix(defaults): fail closed on the four remaining pre-audit gaps

[las7]

Follow-up to #153. Those were controls that did not work. These are defaults and boundaries that worked exactly as written, but where what was written was the permissive choice — and a scanner reads the default, not the warning next to it.

1. security_mode now defaults to strict

It was permissive, so on any host without gVisor every job silently ran on runc while CLAUDE.md says "gVisor remains the sole isolation boundary". Strict refuses to run instead. Set permissive explicitly for local dev and CI on hosts without gVisor.

2. Loopback by default, and unauthenticated network bind is refused

server_host now defaults to 127.0.0.1, and binding a non-loopback interface while api_auth_enabled is false is refused at startup rather than warned about. That combination is an unauthenticated remote code-execution endpoint; a log line is the wrong control for it, because the operator who most needs it is the one not reading logs.

allow_unauthenticated_network_access: true is the explicit opt-out for deployments that authenticate in front of Tako VM — and it still emits the warning.

3. Dependency cache scoped per job type

The shared uv cache is mounted read-write at a path the sandbox user owns, and it stays mounted for the container's whole life, not just the install phase. So one job can write a cache entry that a later job's uv pip install resolves and executes. It was a single host-wide volume.

Now scoped per job type. This narrows the blast radius to a group the operator defines; it does not eliminate the channel — jobs sharing a job type still share a cache. Tako VM has no tenant identity to key on, and inventing one here would be the wrong call. Documented honestly in uv_cache_volume().

4. Session workspace containment, added before the path is reachable

build_session_run_command puts workspace_dir straight into -v {dir}:/workspace, and SessionRecord.workspace_dir validated length only. Now validated at the point of use: absolute, normalized, no .., not a sensitive system directory, and symlink-resolved so a symlinked workspace cannot redirect the mount.

Nothing calls this yet (Phase 1a scaffolding). The guard goes in while the path is still unreachable, rather than after.

Tests

Each item has coverage: the secure defaults; that the unauthenticated network bind is refused while loopback / authenticated / explicitly-opted-out all still work; that cache scopes are distinct and shell-safe; and a table of unsafe workspace paths including a symlink redirect.

Existing tests that asserted the old defaults are updated to assert the new intent, not the new strings. test_default_posture relaxes only security_mode when the host has no gVisor, since seccomp and capabilities are runtime-independent.

Verification

gVisor was installed on the audit host for this (it was the gap flagged in #153):

• 802 passed under strict + runsc.
• 798 passed with runsc removed to simulate a CI runner; the remaining failures were this box's known load-related container stalls, which reproduce on origin/main and did not recur after freeing disk (the host sits at 92% full).

Also worth recording from that exercise: of the four defects in #153, the seccomp-blocks-init one was runc-specific — runsc runs its own container init and never tripped the filter. The entrypoint chown abort and the CAP_KILL timeout failure reproduced identically under gVisor, i.e. they broke the recommended production boundary.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HCi216irm5J9XxAW14WGPh