{"schema":"qp-receipt/1","taskId":"d5af19b228","runPrefix":"qp","nonce":"14679b32d8b9c3892e531809","startedAt":"2026-11-04T15:50:14.232Z","finishedAt":"2026-11-04T15:50:32.198Z","status":"completed","verdict":"review","rulesFired":[{"id":"f","tier":"review","text":"network attempt (DNS, TCP or UDP, TLS included; TLS bodies are not inspected), or a bind/listen in the sandbox network namespace","observationIds":["o1","o2"]}],"package":{"requested":"fixture:netbenign","source":"fixture","name":"qp-fixture-netbenign","version":"1.0.0"},"limits":{"downloadSeconds":120,"downloadMaxBytes":52428800,"downloadMaxPackages":300,"sandboxSeconds":60,"pids":64,"memoryBytes":268435456,"cpus":0.5,"tmpfsWorkBytes":134217728,"tmpfsTmpBytes":67108864,"tmpfsHomeBytes":16777216},"images":{"tag":"s1-1aba83a3","sandbox":"qp-sandbox:s1-1aba83a3","sinkhole":"qp-sinkhole:s1-1aba83a3"},"download":{"container":"ar-qp-download-d5af19b228","hardening":{"container":"ar-qp-download-d5af19b228","id":"23c01a557c67b0e0bce2014b3f0c1be58e474271acb2a56fe18826b4ee0616f6","image":"qp-sandbox:s1-1aba83a3","imageId":"sha256:3c6a223b5c22a3a5d0ee2aa0a9cc22e049172d60af9998d26d7a27abc6dfbc85","User":"10001:10001","ReadonlyRootfs":true,"Privileged":false,"CapDrop":["ALL"],"CapAdd":null,"SecurityOpt":["no-new-privileges"],"PidsLimit":64,"Memory":268435456,"MemorySwap":268435456,"NanoCpus":500000000,"Tmpfs":{"/home/qp":"rw,exec,nosuid,nodev,size=268435456,uid=10001,gid=10001,mode=0700","/tmp":"rw,exec,nosuid,nodev,size=268435456,uid=10001,gid=10001,mode=0700"},"Binds":["ar-qp-vol-d5af19b228:/out","/opt/quarantine-package/fixtures/netbenign:/src:ro"],"Mounts":[{"Type":"volume","Name":"ar-qp-vol-d5af19b228","Destination":"/out","RW":true},{"Type":"bind","Destination":"/src","RW":false}],"NetworkMode":"bridge","PidMode":"","IpcMode":"private","UsernsMode":"","AutoRemove":true},"seconds":4.116,"exitCode":0,"precheck":{"ok":true,"reason":null,"stage":"tree","visited":0,"manifestsFetched":0,"nonRegistry":[]},"lockcheck":{"ok":true,"packageCount":1,"nonRegistry":[]},"inventory":{"name":"qp-fixture-netbenign","version":"1.0.0","packageCount":1,"unpackedBytes":1409,"nonRegistry":[],"installScripts":["node_modules/qp-fixture-netbenign"]},"output":"\n\nup to date in 967ms\nQP-RC lock 0\n\n\nadded 1 package in 710ms\nQP-RC install 0\n\nWARNING: Error loading config file: open /home/qp/.docker/config.json: permission denied\n"},"sandbox":{"container":"ar-qp-sandbox-d5af19b228","round":1,"fresh":true,"containerId":"eed363f7f3c64105a35e3f7abb15d58a8811f9803a8cbbb37a2ee2227fa7cf5d","seconds":6.548,"exitCode":0,"endedBy":"exit","limitsHit":[],"hardening":{"container":"ar-qp-sandbox-d5af19b228","id":"eed363f7f3c64105a35e3f7abb15d58a8811f9803a8cbbb37a2ee2227fa7cf5d","image":"qp-sandbox:s1-1aba83a3","imageId":"sha256:3c6a223b5c22a3a5d0ee2aa0a9cc22e049172d60af9998d26d7a27abc6dfbc85","User":"10001:10001","ReadonlyRootfs":true,"Privileged":false,"CapDrop":["ALL"],"CapAdd":null,"SecurityOpt":["no-new-privileges"],"PidsLimit":64,"Memory":268435456,"MemorySwap":268435456,"NanoCpus":500000000,"Tmpfs":{"/home/qp":"rw,exec,nosuid,nodev,size=16777216,uid=10001,gid=10001,mode=0700","/tmp":"rw,exec,nosuid,nodev,size=67108864,uid=10001,gid=10001,mode=0700","/work":"rw,exec,nosuid,nodev,size=134217728,uid=10001,gid=10001,mode=0700"},"Binds":["ar-qp-vol-d5af19b228:/in:ro"],"Mounts":[{"Type":"volume","Name":"ar-qp-vol-d5af19b228","Destination":"/in","RW":false}],"NetworkMode":"container:eec1e3c1f9698dffa3ae7c56c3afc59170e0b8a2a436cc95cba11862a4d0b0be","PidMode":"","IpcMode":"private","UsernsMode":"","AutoRemove":true},"tracer":{"container":"ar-qp-tracer-d5af19b228","hardening":{"container":"ar-qp-tracer-d5af19b228","id":"bb978d32de4df0abe2b3e7032e94d3e20ae3327c22b05ac9285ca0e70458da65","image":"qp-sandbox:s1-1aba83a3","imageId":"sha256:3c6a223b5c22a3a5d0ee2aa0a9cc22e049172d60af9998d26d7a27abc6dfbc85","User":"0:0","ReadonlyRootfs":true,"Privileged":false,"CapDrop":["ALL"],"CapAdd":["CAP_SYS_PTRACE"],"SecurityOpt":["no-new-privileges"],"PidsLimit":16,"Memory":268435456,"MemorySwap":268435456,"NanoCpus":500000000,"Binds":null,"Mounts":[],"NetworkMode":"none","PidMode":"container:eed363f7f3c64105a35e3f7abb15d58a8811f9803a8cbbb37a2ee2227fa7cf5d","IpcMode":"private","UsernsMode":"","AutoRemove":true},"traceBytes":2369630,"truncated":false},"sinkhole":{"container":"ar-qp-sinkhole-d5af19b228","ip":"172.18.0.2","hardening":{"container":"ar-qp-sinkhole-d5af19b228","id":"eec1e3c1f9698dffa3ae7c56c3afc59170e0b8a2a436cc95cba11862a4d0b0be","image":"qp-sinkhole:s1-1aba83a3","imageId":"sha256:75195ea4538d1fe039d75b314829dae7593fe25a78daad4573c10478783d3184","User":"","ReadonlyRootfs":true,"Privileged":false,"CapDrop":["ALL"],"CapAdd":["CAP_NET_ADMIN"],"SecurityOpt":["no-new-privileges"],"PidsLimit":256,"Memory":536870912,"MemorySwap":536870912,"NanoCpus":500000000,"Tmpfs":{"/run":"size=1m","/tmp":"size=8m"},"Binds":null,"Mounts":[],"NetworkMode":"ar-qp-net-d5af19b228","PidMode":"","IpcMode":"private","UsernsMode":"","AutoRemove":true},"records":2,"controlRecords":0,"flushed":true},"network":{"name":"ar-qp-net-d5af19b228","internal":true,"subnet":"172.18.0.0/16","enableIPv6":false},"roles":{"stagePid":25,"npmPid":33,"harnessPid":57,"scanPid":26},"allowedAreaWrites":{"total":0,"omitted":0},"preloadForeignRecords":0},"harness":{"mode":"require, then the model harness when one is staged (S2)","loaded":true,"detail":{"mode":"fallback-require","error":null,"resolved":"node_modules/qp-fixture-netbenign/index.js"},"model":{"staged":true,"ran":true,"ok":true,"error":null,"fallback":null}},"explanation":{"label":"explanation","source":"model mimo-v2.6-pro","text":"The entry module only exports a static object, so requiring it performs no I/O. However, the package declares an `install` script (node check.js) described as probing for a binary download via a GET, which implies outbound network access and a spawned node child process at install time. No mechanism is indicated for writing files outside the package folder.","note":"The verdict is computed by deterministic rules from the observations; this explanation never changes it."},"model":{"status":"ok","missing":[],"attempts":[{"purpose":"prediction","model":"mimo-v2.6-pro","status":"ok","latencyMs":4541,"httpStatus":null,"usage":{"prompt_tokens":309,"completion_tokens":749,"total_tokens":1058},"detail":null}],"model":"mimo-v2.6-pro","prediction":{"network":{"expected":true,"hosts":[]},"filesOutsidePackage":{"expected":false,"paths":[]},"childProcesses":{"expected":true,"commands":["node check.js"]}},"explanation":"The entry module only exports a static object, so requiring it performs no I/O. However, the package declares an `install` script (node check.js) described as probing for a binary download via a GET, which implies outbound network access and a spawned node child process at install time. No mechanism is indicated for writing files outside the package folder.","harness":{"source":"model","retries":0,"firstError":null,"finalError":null}},"predictionVsObserved":[{"dimension":"network","predicted":true,"predictedDetail":[],"observed":true,"observedDetail":["downloads.qp-fixture.example"],"observationIds":["o1","o2"],"status":"match","package":"qp-fixture-netbenign"},{"dimension":"filesOutsidePackage","predicted":false,"predictedDetail":[],"observed":false,"observedDetail":[],"observationIds":[],"status":"match","package":"qp-fixture-netbenign"},{"dimension":"childProcesses","predicted":true,"predictedDetail":["node check.js"],"observed":true,"observedDetail":["/usr/bin/sh","/usr/local/bin/node"],"observationIds":["o3","o4"],"status":"match","package":"qp-fixture-netbenign"}],"completeness":{"instrumentation-heartbeat":{"ok":true,"runs":[{"round":1,"ok":true,"detail":{"nodeProcesses":4,"missing":[],"reasons":{}}}]},"paths-resolved":{"ok":true,"runs":[{"round":1,"ok":true,"detail":{"unresolved":[]}}]},"kernel-trace":{"ok":true,"runs":[{"round":1,"ok":true,"detail":{"syscalls":10855,"state":"complete"}}]},"sinkhole-log":{"ok":true,"runs":[{"round":1,"ok":true,"detail":{"ready":true,"unmatchedObservationIds":[],"rule":"every traced package TCP connect / DNS query that reached the redirect has a sinkhole record (AF-4)"}}]},"ended-normally":{"ok":true,"runs":[{"round":1,"ok":true,"detail":{}}]},"harness-ran":{"ok":true,"runs":[{"round":1,"ok":true,"detail":{}}]}},"observations":[{"id":"o1","kind":"net-dns","actor":"package","pid":46,"exe":"/usr/local/bin/node","dest":"downloads.qp-fixture.example","orig_dest":"127.0.0.11:53","port":53,"sni":null,"proto":"udp","blocked":false,"payload":false,"path":null,"nonce":"14679b32d8b9c3892e531809","sinkholeLogged":true,"queries":[{"name":"downloads.qp-fixture.example","qtype":1}]},{"id":"o2","kind":"net-tcp","actor":"package","pid":46,"exe":"/usr/local/bin/node","dest":"downloads.qp-fixture.example","orig_dest":"198.18.0.1:80","port":80,"sni":null,"proto":"http","blocked":false,"payload":false,"path":null,"nonce":"14679b32d8b9c3892e531809","family":"inet","sinkholeLogged":true,"http":{"method":"GET","host":"downloads.qp-fixture.example","path":"/prebuilt/v1/linux-x64.json","payloadBytes":0}},{"id":"o3","kind":"spawn","actor":"package","pid":45,"exe":"/usr/bin/sh","dest":null,"orig_dest":null,"port":null,"sni":null,"proto":null,"blocked":null,"payload":null,"path":null,"nonce":"14679b32d8b9c3892e531809","argv":["sh","-c","node check.js"]},{"id":"o4","kind":"spawn","actor":"package","pid":46,"exe":"/usr/local/bin/node","dest":null,"orig_dest":null,"port":null,"sni":null,"proto":null,"blocked":null,"payload":null,"path":null,"nonce":"14679b32d8b9c3892e531809","argv":["node","check.js"]},{"id":"o5","kind":"load","actor":"harness","pid":57,"exe":null,"dest":null,"orig_dest":null,"port":null,"sni":null,"proto":null,"blocked":null,"payload":null,"path":null,"nonce":"14679b32d8b9c3892e531809","ok":true,"mode":"fallback-require","error":null,"resolved":"node_modules/qp-fixture-netbenign/index.js"},{"id":"o6","kind":"completeness","actor":null,"pid":null,"exe":null,"dest":null,"orig_dest":null,"port":null,"sni":null,"proto":null,"blocked":null,"payload":null,"path":null,"nonce":"14679b32d8b9c3892e531809","marker":"instrumentation-heartbeat","ok":true,"detail":{"nodeProcesses":4,"missing":[],"reasons":{}}},{"id":"o7","kind":"completeness","actor":null,"pid":null,"exe":null,"dest":null,"orig_dest":null,"port":null,"sni":null,"proto":null,"blocked":null,"payload":null,"path":null,"nonce":"14679b32d8b9c3892e531809","marker":"paths-resolved","ok":true,"detail":{"unresolved":[]}},{"id":"o8","kind":"completeness","actor":null,"pid":null,"exe":null,"dest":null,"orig_dest":null,"port":null,"sni":null,"proto":null,"blocked":null,"payload":null,"path":null,"nonce":"14679b32d8b9c3892e531809","marker":"kernel-trace","ok":true,"detail":{"syscalls":10855,"state":"complete"}},{"id":"o9","kind":"completeness","actor":null,"pid":null,"exe":null,"dest":null,"orig_dest":null,"port":null,"sni":null,"proto":null,"blocked":null,"payload":null,"path":null,"nonce":"14679b32d8b9c3892e531809","marker":"sinkhole-log","ok":true,"detail":{"ready":true,"unmatchedObservationIds":[],"rule":"every traced package TCP connect / DNS query that reached the redirect has a sinkhole record (AF-4)"}},{"id":"o10","kind":"completeness","actor":null,"pid":null,"exe":null,"dest":null,"orig_dest":null,"port":null,"sni":null,"proto":null,"blocked":null,"payload":null,"path":null,"nonce":"14679b32d8b9c3892e531809","marker":"ended-normally","ok":true,"detail":{}},{"id":"o11","kind":"completeness","actor":null,"pid":null,"exe":null,"dest":null,"orig_dest":null,"port":null,"sni":null,"proto":null,"blocked":null,"payload":null,"path":null,"nonce":"14679b32d8b9c3892e531809","marker":"harness-ran","ok":true,"detail":{}}],"network":{"sinkholeLog":[{"answer":"198.18.0.1","name":"downloads.qp-fixture.example","qtype":1,"srcIp":"127.0.0.1","srcPort":40661,"t":"2026-11-04T15:50:26.867019Z","type":"dns"},{"bytesReceived":104,"chunked":false,"dstIp":"198.18.0.1","dstName":"downloads.qp-fixture.example","dstPort":80,"host":"downloads.qp-fixture.example","method":"GET","path":"/prebuilt/v1/linux-x64.json","payloadBytes":0,"protocol":"http","srcIp":"172.18.0.2","srcPort":33408,"t":"2026-11-04T15:50:26.869462Z","type":"tcp"}]},"secretScan":{"sandbox":{"keyLikeEnvNames":[],"ignoredImageVars":["GPG_KEY"],"dockerSockPresent":[],"mounts":[{"mountPoint":"/","fsType":"overlay","readOnly":true},{"mountPoint":"/proc","fsType":"proc","readOnly":false},{"mountPoint":"/dev","fsType":"tmpfs","readOnly":false},{"mountPoint":"/dev/pts","fsType":"devpts","readOnly":false},{"mountPoint":"/sys","fsType":"sysfs","readOnly":true},{"mountPoint":"/sys/fs/cgroup","fsType":"cgroup2","readOnly":true},{"mountPoint":"/dev/mqueue","fsType":"mqueue","readOnly":false},{"mountPoint":"/dev/shm","fsType":"tmpfs","readOnly":false},{"mountPoint":"/in","fsType":"ext4","readOnly":true},{"mountPoint":"/tmp","fsType":"tmpfs","readOnly":false},{"mountPoint":"/work","fsType":"tmpfs","readOnly":false},{"mountPoint":"/etc/hostname","fsType":"ext4","readOnly":true},{"mountPoint":"/etc/hosts","fsType":"ext4","readOnly":true},{"mountPoint":"/etc/resolv.conf","fsType":"ext4","readOnly":true},{"mountPoint":"/home/qp","fsType":"tmpfs","readOnly":false},{"mountPoint":"/proc/bus","fsType":"proc","readOnly":true},{"mountPoint":"/proc/fs","fsType":"proc","readOnly":true},{"mountPoint":"/proc/irq","fsType":"proc","readOnly":true},{"mountPoint":"/proc/sys","fsType":"proc","readOnly":true},{"mountPoint":"/proc/sysrq-trigger","fsType":"proc","readOnly":true},{"mountPoint":"/proc/acpi","fsType":"tmpfs","readOnly":true},{"mountPoint":"/proc/asound","fsType":"tmpfs","readOnly":true},{"mountPoint":"/proc/interrupts","fsType":"tmpfs","readOnly":false},{"mountPoint":"/proc/kcore","fsType":"tmpfs","readOnly":false},{"mountPoint":"/proc/keys","fsType":"tmpfs","readOnly":false},{"mountPoint":"/proc/latency_stats","fsType":"tmpfs","readOnly":false},{"mountPoint":"/proc/scsi","fsType":"tmpfs","readOnly":true},{"mountPoint":"/proc/timer_list","fsType":"tmpfs","readOnly":false},{"mountPoint":"/sys/firmware","fsType":"tmpfs","readOnly":true}],"envNamesScanned":12,"pass":true},"receipt":{"pass":true,"hits":[]}},"hostProbe":null,"teardown":{"removed":{"containers":["ar-qp-sinkhole-d5af19b228"],"networks":["ar-qp-net-d5af19b228"],"volumes":["ar-qp-vol-d5af19b228"]},"leftoversForTask":[],"hostTempDirs":[]},"knownLimitations":["L-4: ICMP is out of scope: the sandbox has no capability to open raw sockets, and unprivileged ICMP is not logged.","L-4: TLS bodies are not inspected: the sinkhole records the SNI from the ClientHello and refuses the handshake.","UDP other than DNS is logged as an attempt; its original destination comes from the kernel trace when the socket names it.","DNS over TCP is logged as a TCP attempt to port 53 (query name not parsed).","Env-var reads are seen by the in-process preload only; a package can bypass or forge it in its own process. Forged preload records can only add observations; trace-derived completeness markers come from the tracer stream.","Inside the harness process every rule-relevant syscall is attributed to the package (the harness itself performs none).","Paths written through fchdir-relative or unknown directory fds are reported as unresolved and treated as outside the allowed areas.","Side channels inside the kernel (timing, /proc enumeration) are not observed.","L-4: Evasion: in the shared pid namespace a package can see that it is traced (TracerPid, the strace process) and behave benignly; S1 does not hide the tracer.","npm CLI processes do not get the env-read preload (npm fails with a wrapped process.env); an npm started by package code is therefore reported as incomplete instrumentation (review).","L-1: Shell expansion of env variables (e.g. $NPM_TOKEN inside a lifecycle sh) and env reads by sh itself (perl and awk are removed from the image since S2, X10) are invisible to both the kernel trace and the preload (DEC-11r5; their file, network and process activity is still traced and judged).","L-2: DEC-11r4: a package lifecycle that executes a script directly from /work, /tmp or HOME (e.g. \"./install.sh\" rather than \"sh ./install.sh\" or \"node x.js\") fails the instrumentation marker and gets review (i): the trace cannot tell a script from an ELF binary there (fail closed; narrowed in S2, X8).","L-3: Download phase: a non-registry spec in the root manifest aborts before any network request; one deeper in the tree is rejected before it is fetched, but registry metadata of the dependencies visited before it has been fetched. Download-container egress is not limited to the registry host in S1.","L-4: execveat is handled (envp never trusted, SR-3) but is covered by unit tests only, not by a runtime fixture.","L-4: image builds are not byte-reproducible: the bases are pinned by digest, but distribution packages (strace, iptables, tcpdump) are installed at build time.","L-6b: relative file operations of a child process printed before the clone return of its parent have no inherited cwd: they are unresolved, so a write gives (a) and a read gives review (fail closed).","L-8: a chdir by a thread not yet attributed to any process that overlaps an unrelated fork marks that fork raced: relative paths of the child are unresolved (over-condemnation, never install).","L-8b: a benign multi-threaded package whose non-forking thread ever changes directory (e.g. main thread process.chdir while a worker spawns) gets the relative paths of its children unresolved: relative writes give do-not-install (a), relative reads give review. Fail closed by design (dispatch 3).","L-9: a chdir whose outcome is unknown (killed mid-call, \"= ?\", or never resumed before the trace ends) is treated as applied: the cwd of the thread group and of overlapping or later children become unresolved (fail closed).","L-10: a process cloned with CLONE_FS but not CLONE_THREAD shares its working directory with its parent; both sides get an unresolved cwd for the whole trace (fail closed). Only native code issues such a clone; node, dash and perl do not.","L-11: io_uring is not traced. Node 22 / libuv in the sandbox never issues io_uring_setup (checked with UV_USE_IO_URING=1), and native io_uring is denied by the default Docker seccomp profile the sandbox runs under; native code from a writable mount gives review anyway (L-2).","L-13: a native addon (.node) that the package loads can read env in-process with getenv(); there is no exec and no preload record, so only the intent signal (c1) is lost. Same class as L-1: the sandbox env holds no secret value (C7) and any exfiltration still fires (d)/(f).","Sinkhole memory bound: when more than 128 MB is buffered across open connections, the connection holding the most is recorded early with what it sent so far; later bytes on it are not counted.","UDP payloads are logged but, per DEC-2r1, UDP attempts are rated review (f), never do-not-install by payload."],"logs":{"sandboxOutput":"QP-TRACER-ATTACHED\nQP-PHASE copy\nQP-RC copy 0\nQP-PHASE scan\nQP-PHASE rebuild\n\n> qp-fixture-netbenign@1.0.0 install\n> node check.js\n\n[fixture-netbenign] prebuilt check: HTTP 403, building from source instead\nrebuilt dependencies successfully\nQP-RC rebuild 0\nQP-PHASE harness\nQP-RC harness 0\nQP-PHASE done\n"},"runs":[{"round":1,"harness":"model","mode":"fallback-require","modelHarness":{"ok":true,"error":null},"container":"ar-qp-sandbox-d5af19b228","seconds":6.548,"exitCode":0,"endedBy":"exit","limitsHit":[],"observations":11,"traceFile":null}]}