land: confine-busy-db

[aft-alfonso]

Accepted agent delivery; branch-keyed search descriptor included.

---

Summary by cubic

Tool calls no longer fail sporadically while the database is opening or briefly busy; saved session confinement stays enforced, and expired waits still fail closed.

• Carries in-memory confinement answers through to admission, along with the policy generation, so a busy database slot cannot turn an unconfined call into confine_policy_unavailable; carried answers are rejected once a confining save invalidates them.
• Waits off-loop for keyed calls' opening policy store, shares the existing persistence deadline, and bounds blocking reads with permits held until completion; unreadable policies, exhausted wait budgets, and over-limit concurrent reads fail closed.
• Rejects untrusted shell capabilities before any confinement or database lookup, and treats never-configured persistence as unconfined even behind a busy slot.
• Adds deterministic tests for held slots, slow opens, wait-budget exhaustion, refusal ordering, and reads that finish after their caller times out.

^{Written for commit 464d189. Summary will update on new commits.}

Confidence Score: 5/5

The PR appears safe to merge; no new actionable issues were found.

Summary

The PR keeps confinement checks off the frame loop while the database opens or stays busy.

• Scoped tool calls wait for their saved confinement policy.
• Untrusted shell calls are refused before policy lookup.

Both earlier findings are addressed in the current code. Both threads were manually resolved without explanatory replies.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Tool call] --> B{Shell capability refused?}
  B -->|Yes| R[Return error]
  B -->|No| C{Policy known in memory?}
  C -->|Yes| D[Carry answer and generation]
  C -->|No| E{Budget and read permit available?}
  E -->|No| R
  E -->|Yes| F[Wait for database opening]
  F --> G[Read policy off-loop]
  G --> D
  D --> H[Ledger admission wait]
  H --> I{Current policy answer available?}
  I -->|No| R
  I -->|Yes| J[Apply confinement and admit]

Loading

_{Reviews (2) · Last reviewed commit: "mason: clarify carried policy invalidati..." · Reviewed by Greptile}