feat(engine): expose strict sandbox and target-renderer evidence - #1

Why

CapGo's experimental Creative renderer needs Chromium's process sandbox and site isolation to remain active, and the native canary must prove which exact renderer process produced each captured frame. HyperFrames 0.7.90 currently hard-codes unsafe launch flags and did not expose target-to-renderer process evidence.

This draft adds explicit, opt-in proof hooks without changing the 0.7.90 default. It is based on a dedicated capgo/v0.7.90-base branch so CapGo can pin the exact reviewed commit.

Strict browser profile

• Existing behavior remains the default as legacy-unsafe.
• PRODUCER_BROWSER_SANDBOX_MODE=strict:
  • refuses Linux launch unless HyperFrames verifies a non-root UID;
  • omits --no-sandbox, --disable-setuid-sandbox, and --no-zygote;
  • enables --site-per-process and stops disabling site isolation;
  • fails closed for unknown values.
• The same policy covers normal render, hardware-GPU probe, and HDR engine launches.

Exact browser and renderer evidence

PRODUCER_SANDBOX_STATUS_PATH=/absolute/path.json writes bounded, atomic evidence from the exact browser selected after fallback handling and before the composition page opens.

When both PRODUCER_TARGET_RENDERER_STATUS_PATH and PRODUCER_TARGET_RENDERER_ACK_PATH are set, HyperFrames additionally:

• traces on the page-target CDP session and maps the exact main-frame ID and loopback URL to a live Chromium renderer PID;
• checkpoints navigation, every synchronous frame only after the final pixel buffer exists, and completion;
• writes each status atomically and blocks until an external inspector ACKs the same sequence, target ID, and renderer PID;
• fails closed for static deduplication, pipelined worker capture, verification recapture, and batch capture, which cannot provide equivalent per-frame proof;
• bounds tracing commands, completion, ACK waits, and CDP cleanup, and settles trace cleanup before detaching sessions.

Both hooks are inert when their environment variables are absent. They are diagnostic canary evidence, not cryptographic attestation and not a substitute for container isolation.

Scope and deployment gate

This change does not claim that Cloudflare Containers pass the sandbox or no-egress gate. CapGo separately proves non-root execution, exact browser/renderer /proc hardening, cleanup, and externally observed egress behavior in a native linux/amd64 canary. Any ambiguous or missing evidence remains a deployment blocker; there is no unsafe fallback.

Verification

• engine suite: 1,360 passed, 3 skipped
• targeted status/lifecycle/order tests: 7/7
• engine typecheck, changed-file format, lint, and git diff --check
• idle real-Chrome loopback probe: exact frame/URL mapped to live renderer PID within the unchanged 5-second timeout
• probe browser exited cleanly
• all commits are SSH-signed and GitHub reports the latest signature verified/valid

Review status

Draft on purpose. It should remain unmerged until the native Creative container proof and upstream review are complete.