test(cli): run the promotion condition for ledger proof, and record what it says

[ion-alpha-dev]

What

Runs the promotion condition that RequireLedgerProof has been staged behind, on the three platforms CI runs on, and records the answer in the boundary register. The condition itself is rewritten, because the measurement says the original could never hold.

Platform	Sandbox containment	The planned item
windows-latest	kernel-confined	proven by its executed check
macos-latest	kernel-confined	proven by its executed check
ubuntu-latest	process-jail	unproven: containment_gate: containment_insufficient

Why

RequireLedgerProof is the register's one staged row. A staged row owes a switch and a promotion condition; it had both, and the condition was written to be checkable and then checked by nobody. A capability nobody is on the hook for is how default-off becomes permanent without anyone deciding it should, which is the failure the staged verdict exists to prevent.

The condition asked for the repository's own planned goals to prove every item they plan through an executed check, over the platforms CI runs on. Measured, that conflates two questions. Whether the producer proves what it plans is about this repository, and it is met: on both hosts that can contain semi-trusted work, the planned item came back proven by its executed check. Whether the host can run a model-authored command at all is not about this repository: an item's check is dispatched as semi-trusted work, GitHub's Ubuntu image forbids unprivileged user namespaces, so the sandbox falls back to a process jail and the containment gate refuses the check before it runs. No item can be proven on that host, and no amount of waiting changes it.

So the row stays staged, now with a measurement and a named obstacle behind it rather than a date, and what is left is a decision rather than more evidence: condition the default on the host's containment, which a run already reports before it starts, or leave it off with --require-proof as the operator's switch.

How to verify

go test ./cmd/flynn/ -run TestThePromotionConditionForLedgerProof.

It plans a goal whose item carries a check that exits 0, drives it through the assembly the binary uses, and reads the verdict off the goal the run leaves behind. The three platform rows in the table above are that test's output from this PR's own CI run.

Notes for reviewers

The assertion is an implication rather than an outcome, because what the host can contain decides which answer is correct. Where the sandbox can contain the check, the item must come back proven; where it cannot, no item can be proven and the run has to record why rather than leaving the item silently unsettled. What is never correct on either host is an item marked proven with no executed check behind it, and that is the third branch.

Keeping the measurement as a test rather than a note is the point: the row cannot go stale without a red check, and if a runner image changes what it allows, the table is wrong the same day rather than whenever somebody next reads the file.

No behaviour changes here. The default is untouched.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!