Enforce explicit egress and scope operator file exports (SPEC-007 4.9)

[IanFrelinger]

Summary

Explicit egress sites recorded denied decisions but still sent data, wrote exports, or launched working-tree code. This implements SPEC-007 4.9: each site now refuses before the operation or follows its defined graceful-degradation behavior when enforcement is enabled. The default profile switch remains the separate 4.11 phase.

Changes

• Enforce all 17 original explicit sites and the audited process launches, including Docker API build/run/start. Working-tree execution remains off-host with --no-build or --no-restore. Docker CLI classification requires recognized network-off/no-pull arguments and a local daemon selection.
• Carry an internal initiator only for named operator file exports. Public export APIs, publish/share, and runtime publishing still enforce. Refused native/cloud exports preserve existing bundles; allowed replacements remove stale files.
• Preserve local admission, promotion, and mesh listening when an export is refused. Return CLI exit 77, keep IDE remote errors fixed and redacted, and distinguish refusal counts and audit outcomes from ordinary failures.
• Require explicit decisions to be acted on, constrain the evaluated process entry, and update the inventory, process audit, startup diagnostic, and phase records. Align Docker SDK references with Testcontainers' existing Enhanced dependency to avoid incompatible assemblies sharing the same name.

Testing

All local .NET commands ran through scripts/test-in-container.sh on Linux against committed source.

• make build-core: passed.
• make test-prod-style: 131 passed, zero skipped; nonzero-test guard passed.
• bash scripts/run-cert-gate.sh: 3,174 passed, zero skipped; discovery floor and skip guard passed.
• CLI egress and promotion-audit selection: 63 passed, zero skipped.
• In-process API egress tests on the API's net10.0 framework: four passed, zero skipped.
• bash scripts/ci/run-repo-gates.sh: all 28 passed.
• make composition-mesh-gate-tier-b: three bridge tests passed, zero skipped; nonzero-test guard passed.
• All 77 post-commit mutation proofs are reconciled against final head e4b7dbff: intended assertion failures, exact source restoration, clean state, and passing reruns. The 21 cases affected by the macOS test transport correction were re-proved against 19609af9; the final documentation commit changes no mutation target or test source. Fresh CLI checks passed 63 tests, canonical certification passed 3,174 tests (both zero skips), and all 28 repository gates passed.

Testing strategy (blast radius)

The changed API paths have real WebApplicationFactory tests. Docker execution guards use loopback transport twins that assert refusal before any daemon request and verify transport is reached in report mode. On the previous candidate f9f3f832, Kernel Tier A passed in PR CI (46, 22, and 107 tests; zero skips). Kernel coverage passed: Domain 100%, Infrastructure 84.43%, Core.Application 71.55%. The coverage test runs passed 83, 5,139, and 407 tests respectively; Infrastructure retained eight skips. Canonical certification separately passed all 3,174 tests with zero skips. UAT and all three cross-platform loop checks also passed. Its macOS readiness lane exposed an unavailable multicast route in the discovery test. Commit 19609af9 uses an internal instance-scoped send boundary and real loopback delivery, retaining zero-send refusal, continued listening, multicast destination, and positive-send assertions. Production multicast behavior is unchanged. Fresh CI is required on that correction.

Checklist

• Scoped build and behavioral checks passed locally.
• Documentation and generated knowledge graph updated.
• Public export signatures preserved; enforcement behavior and operator exception documented.
• All 77 mutation proofs reconciled after the macOS test transport correction.
• Required checks, kernel gate, and coverage gate green.

Release

• Not a versioned release.

Coordinated integration

[coordinated-integration] SPEC-007 4.9 requires an atomic cross-layer change: Abstractions defines the initiator and guard semantics, Infrastructure enforces explicit and process routes, and application CLI/API paths handle refusals and scoped operator exports. These pieces must ship together to avoid leaving routes unenforced or breaking operator exports.