Loop 10 — Isolated Behavior Backend

[sairintechnologycom]

Feature Spec

Add a real isolated behavior analysis backend.

Goal:
Provide safer behavior analysis for suspicious packages without host exposure.

Scope:

• Linux isolation first
• network disabled by default
• no host HOME
• no host credentials
• disposable filesystem
• resource limits
• non-root execution
• clean teardown

Do not enable by default until validated.

Build Loop:

• Inspect behavior_analysis model
• Inspect heuristic runner
• Inspect isolated mode placeholder
• Inspect sandbox/runner code
• Inspect tests for BLOCK never executes
• Build isolated runner interface
• Build Linux backend using container/namespace approach where available
• Add unavailable backend fail-closed behavior
• Add policy switch for isolated behavior
• Add network policy controls
• Add resource limit controls
• Add behavior trace output

Validation Loop:

• gofmt -w .
• go test ./...
• go test -race ./...
• go vet ./...
• make build
• isolated runner tests on supported platform

Review Loop:

• Is isolation strong enough to call isolated?
• Which platforms are supported?
• What are the limitations?
• Should it be GA, preview, or experimental?

Evidence file:

• evidence/loops/loop-10-isolated-behavior-backend.md

[sairintechnologycom]

Loop 10 implementation complete.

Built:

• Added runner selection for heuristic vs isolated behavior analysis.
• Added experimental Linux isolated backend using bubblewrap when available.
• Added non-Linux fail-closed isolated runner that never falls back to heuristic execution.
• Wired npm registry/local scans through the runner selector.
• Preserved BLOCK-never-executes behavior.
• Added behavior trace fields and updated behavior-analysis docs/report wording.

Validation:

• gofmt -w .: pass
• go test ./...: pass
• go test -race ./...: pass
• go vet ./...: pass
• make build: pass
• make package: pass, including Linux cross-compile
• Built binary isolated-mode sample on Darwin: unavailable/fail-closed as expected
• Static BLOCK sample with isolated mode: behavior analysis skipped before execution

Evidence recorded in evidence/loops/loop-10-isolated-behavior-backend.md.

Caveat:

• Runtime positive isolation tests require a Linux host with working bubblewrap; this host is Darwin and has no bwrap.