Incident containment: real enforcement effects

[jeremymanning]

Description

src/incident/containment.rs line ~42 has a TODO: "Implement actual containment effects (Phase 7 T076-T080)". The containment primitives (FreezeHost, QuarantineWorkloadClass, BlockSubmitter, RevokeArtifact, DrainHostPool) create audit records but do not execute real enforcement.

Requirements

• FreezeHost: Send SIGSTOP to all sandbox processes on target host, block new lease assignments
• QuarantineWorkloadClass: Update policy engine to reject jobs of the quarantined class
• BlockSubmitter: Add submitter to ban list, reject new submissions, cancel in-flight jobs
• RevokeArtifact: Remove artifact from approved registry, halt jobs using it
• DrainHostPool: Gracefully migrate all workloads off a set of hosts, block new assignments
• All actions must complete within 60 seconds (per spec)
• All actions produce immutable audit records with actor identity, justification, reversibility

Success Criteria

• Each containment primitive executes its enforcement effect, not just logs
• FreezeHost stops all sandbox processes within 60 seconds
• QuarantineWorkloadClass causes policy engine to reject new jobs of that class
• BlockSubmitter prevents new submissions and cancels in-flight jobs
• RevokeArtifact halts jobs using the revoked artifact
• All actions are reversible (except RevokeArtifact which requires re-signing)
• Integration tests for each containment primitive
• cargo test passes

Testing (Principle V)

• Start real sandbox, trigger FreezeHost, verify processes stopped
• Submit job of quarantined class → rejected
• Block submitter, verify in-flight job cancelled
• Revoke artifact, verify running job using it is halted

[jeremymanning]

Partially addressed by spec 004 / PR #59 — not closing. Most containment primitives are implemented (FreezeHost via SIGSTOP, QuarantineWorkloadClass, DrainHostPool). HOWEVER, src/governance/admin_service.rs::ban() is explicitly a placeholder — returns Ok(()) without updating any trust registry. Real ban enforcement is not wired.

Remaining work tracked here.

[jeremymanning]

Spec 005 progress — PR #61

STATUS: Real ban registry implemented.

Done (commit f60c766):

• Real ban() implementation in src/governance/admin_service.rs:
  • BanRecord struct with subject_id, reason, banned_at (DateTime)
  • In-memory HashMap<String, BanRecord> owned by AdminServiceHandler
  • ban() rejects AlreadyExists on duplicate; emits warning log
  • unban() + is_banned() + ban_record() + banned_subjects() accessors
  • 5 new unit tests (double-ban rejection, unban, record preservation, etc.) — all pass

Remaining:

• Wiring of is_banned() into the policy engine's pre-dispatch check — code reference exists but integration test not written. Track as follow-up.

See notes/session-2026-04-19-spec-005-kickoff.md.