M87 Governed Code Change — Evidence Package

This is an evidence package, not a product repository. It documents real runs of M87's governed code-change pipeline against a real (if small) fixture, using real, tested infrastructure that already exists in M87's private repos.

Every execution, decision, token, receipt, artifact, and verification result claimed by this package was produced by the real implementation. Components not exercised are explicitly identified in the table below.

What was demonstrated

The mission-core CLI proposed a pre-written fixture code change (add multiply() to a small calculator module — the patch itself ships in mission-core's own examples/ directory; see "Agent participation" below), had that proposal classified and authorized by a real governance gate (Spine-Pro), executed the change and its regression tests inside a real bubblewrap sandbox with network denied and the filesystem confined to the worktree, and produced a receipt-backed review package (patch + bundle + PR description) — without merging or deploying anything. A second run proved the same pipeline refuses an out-of-scope change (touching the sandbox policy file itself) before any code executes. A third pass ran three adversarial checks against the live system: a real network-egress attempt from inside the sandbox, a real filesystem-escape attempt, and a real receipt-tampering attempt — all three were caught, not merely designed-to-be-caught.

Agent participation — who authored what

No LLM agent authored code during this demo. The multiply() function, its test, and the privilege-escalation patch are static fixture files that ship with mission-core itself (examples/governed-pr/patches/*.patch) — canned example payloads written by mission-core's own maintainers to exercise the pipeline deterministically. The "agent" in this architecture is the m87-mission CLI acting as a scripted, non-LLM actor: it reads mission.yaml, loads a fixed patch file, and submits it to the gate. This demo proves the governance path holds for any proposed change, fixture-authored or LLM-authored — it does not demonstrate an LLM drafting a patch live. That is a separate, unbuilt capability (see "Which claims are NOT proven").

What was allowed

• Read the target module and its tests
• Apply a patch to src/* and tests/* (scope declared in mission.yaml)
• Run the approved test command (pytest), executed inside a bwrap sandbox: network denied, filesystem confined to the worktree
• Produce patch/bundle/report artifacts

What was prohibited (and proven prohibited, not just claimed)

• Modifying .m87/sandbox.yaml (the policy file itself) — denied by the real gate, effect-classified as PRIVILEGE_ESCALATION, reason TOOL_NOT_IN_MANIFEST. See artifacts/denied/.
• Network egress from inside test execution — blocked at the kernel level. A raw TCP connect attempt from inside the sandbox returned OSError: [Errno 101] Network is unreachable — there is no route out of the sandbox's network namespace, not merely a DNS or proxy block. See DEMO_TRANSCRIPT.md §7.
• Filesystem writes outside the worktree — confined, not merely rejected. A write to a path outside the worktree "succeeded" from the executing code's point of view (no permission error) but landed in the sandbox's own private, ephemeral filesystem layer; the real host file was verified byte-for-byte unchanged afterward. See DEMO_TRANSCRIPT.md §7.
• Tampering with a receipt after the fact — detected. Flipping one field in the receipt ledger (envelopes.jsonl) and re-running m87-mission verify produces a hash-recompute mismatch and an overall verification: FAILED, not a silent pass. See DEMO_TRANSCRIPT.md §8.
• Merging or pushing to a protected branch — mission-core's PR packager stops at producing pr/mission.patch, pr/mission.bundle, and pr/PR_DESCRIPTION.md. Publishing to a forge is out of scope for this component by design (github_publisher.py exists but requires a separate, explicit HITL-gated publish step not exercised here).

Which components participated

Component	Role in this demo	Status
Spine-Pro	The Gate — proposal → decision → Ed25519-signed token → executor → hash-chained receipt ledger	Real, tested (253/253 tests pass in this environment)
m87-mission-core	Integration membrane — mission.yaml → sandbox policy → Spine-Pro → bwrap-confined executor → receipt envelope → mission report → PR artifact	Real, tested (110/110 tests pass in this environment as of the isolation fix below — up from 89/109; the fix is now upstreamed to m87-mission-core in PR #4, where the canonical suite passes 111/111; see "Isolation: closed, not disclosed-around")
M87-Crew	Governed task state machine; has a crew_adapter.py contract in mission-core (MissionTaskSpec → MissionStepResult)	Real and tested (552 tests) in its own repo — not exercised in this run. This demo used mission-core's CLI directly, not a Crew-dispatched task.
M87 Console	Operator UI for composing/routing/proving agent workflows	Not built. Confirmed from the repo itself: clean-room, specs-only, no implementation. mission-core's console_export.py produces a static, read-only HTML run viewer (in screenshots/) — this is a report generator shipped inside mission-core, not the Console product. This package refers to it consistently as the "console-view HTML report," never as "Console," to avoid conflating the two.
ContextOS	Governed context retrieval	Exists, but was not integrated into this demonstration. Correction from an earlier draft of this README: the repo's top-level README still describes a stale "Pass 0 — empty-but-governed, zero feature code" status, but the repository itself (as of this writing) contains real implementation — src/, tests/, supabase/, governance/, a typed GraphAPI client, an AI provider layer, and 15+ commits including "feat(graph): port typed GraphAPI client + freeze v1 contract (Pass 2)." This demo's agent used the fixture repo's own two files as context, not ContextOS-governed retrieval, so ContextOS was genuinely not exercised here — but "not built" was inaccurate and has been corrected.

Isolation: closed, not disclosed-around

An earlier version of this evidence package ran both missions with execution.isolation: none — a documented, receipted opt-out — because the sandbox environment used to generate this evidence had no root access to install a bwrap-bindable system Python, and mission-core's own isolation.py failed closed (execvp ENOENT) rather than run unconfined.

That gap is now closed for real, not just disclosed. Two fixes were required:

1. Upstream fix (m87-mission-core main, commit 85bc701/f0f0fe3, "isolation: bind the interpreter's prefix into the bwrap sandbox"): binds sys.prefix, sys.base_prefix, sys.exec_prefix, sys.base_exec_prefix, and the interpreter's own directory into the bwrap sandbox read-only, so non-system Python installs (venvs, uv, pyenv) are visible inside confinement.
2. A follow-on fix for multi-hop interpreter symlinks was upstreamed to m87-mission-core in PR #4 and merged as commit 112834d5d36b33c53f224e9633ad9b904e30d818. The root cause it addresses: the upstream fix alone was insufficient in this environment because uv-managed Pythons use a double symlink layout — a venv's bin/python points at an unversioned alias directory (cpython-3.11-linux-x86_64-gnu), which itself is a symlink to the real versioned install (cpython-3.11.15-linux-x86_64-gnu). os.path.realpath() collapses straight past the alias hop, so only the final target got bound — the alias directory itself was never exposed inside the sandbox, and execvp failed resolving that intermediate path component. A new _symlink_chain_dirs() helper walks and binds every hop in the chain, not just the final target. A preserved copy of the fix is kept here as a minimal diff (see patches/) for historical reference; the canonical implementation now lives in m87-mission-core.

With both fixes applied and execution.isolation: required restored (no opt-out), both missions were re-run from scratch:

• Both runs' native receipts now record "isolation": {"backend": "bwrap", "network": "deny"} — a receipted, verifiable claim, not an assertion.
• mission-core's own dedicated test_isolation.py suite (13 tests, including test_bwrap_denies_network, test_bwrap_hides_host_filesystem, test_bwrap_confines_writes) passes in full.
• The full mission-core suite went from 89/109 to 110/110 passing — every failure traced to this one root cause, and fixing it fixed all of them.
• Three adversarial checks (network egress, filesystem escape, receipt tampering) were run against the live confined system and all three were caught for real — see DEMO_TRANSCRIPT.md §6–8 for exact commands and output.

The artifacts/success-legacy-isolation-none/ and artifacts/denied-legacy-isolation-none/ directories are kept for reference — they are the original, honestly-disclosed unconfined runs superseded by the confined runs now in artifacts/success/ and artifacts/denied/.

What evidence was produced

• artifacts/success/ — full output of a PASSING run, with real bwrap confinement engaged: mission_report.json, MISSION_REPORT.md, proposals, decisions, native Spine-Pro receipts, the receipt envelope ledger, the patched worktree, and the PR artifact (pr/mission.patch, pr/mission.bundle, pr/PR_DESCRIPTION.md).
• artifacts/denied/ — full output of a DENIED run, same confinement: no PR artifact was produced, because nothing executed.
• artifacts/success-legacy-isolation-none/, artifacts/denied-legacy-isolation-none/ — the original unconfined runs, kept for comparison.
• receipts/success-envelopes.jsonl, receipts/denied-envelopes.jsonl — the raw hash-chained receipt ledgers for the confined runs.
• screenshots/success-console-view.html, screenshots/denied-console-view.html — mission-core's own read-only console-view HTML report for each confined run.
• Independent chain verification output for both runs (see DEMO_TRANSCRIPT.md) — both verification: OK.
• DEMO_TRANSCRIPT.md §6–8 — real output from the isolation fix and the three adversarial checks.
• evidence_manifest.json — machine-readable summary of every claim in this package, with commit references and file pointers.
• VERIFYING.md — three levels of verification a reader can perform themselves, from "read the artifacts" to "reproduce from source."
• patches/isolation_symlink_chain_fix.diff — minimal unified diff of the follow-on fix, preserved for historical reference now that it has been upstreamed to m87-mission-core in PR #4 (merge commit 112834d5d36b33c53f224e9633ad9b904e30d818), plus its regression test, now part of the canonical test_isolation.py suite.

Which claims are proven

• A real governance gate (not a mock) classified a proposed effect and denied it before any code ran.
• A real governance gate authorized an in-scope change, and the change + its tests executed under that authorization, inside real bwrap confinement.
• Network egress from inside test execution is blocked at the kernel level (verified via a direct connect attempt, not just an absence of outbound calls in the transcript).
• Filesystem writes outside the declared worktree do not reach the host filesystem (verified by reading the host file before and after).
• Receipt tampering is detected by m87-mission verify, not silently accepted (verified by tampering a real ledger file and re-running verification).
• The full decision → token → execution → receipt chain is present, hash-linked, and independently re-verifiable via m87-mission verify <run-dir> — anyone can run this command against the artifacts in this repo and get the same OK.
• The pipeline never merges or pushes; it stops at a receipted, reviewable artifact bundle.

Which claims are NOT proven

• No Console. The operator-workflow experience described in earlier planning docs does not exist yet. What's here is a CLI + a static HTML report.
• No ContextOS integration in this run. ContextOS itself has real code (see table above), but this demo's context was two files in a fixture repo, not ContextOS-governed retrieval.
• No Crew dispatch. The task was run directly via mission-core's CLI, not routed through Crew's state machine, even though the adapter contract for that exists and is tested.
• No live network deployment. live_spine mode (an external Spine-Pro service reachable over the network) exists in the code but is explicitly documented upstream as "intentionally not wired" — this demo used local_spine (real gate, real crypto, in-process).
• No LLM-authored patch. The code change proposed in this demo is a static fixture shipped by mission-core, not a change drafted live by an AI agent. See "Agent participation" above.

How to verify the receipts yourself

pip install -e path/to/Spine-Pro
pip install -e path/to/m87-mission-core
m87-mission verify artifacts/success/
m87-mission verify artifacts/denied/

Both should print verification: OK for every envelope in the chain. See VERIFYING.md for three levels of verification, from artifact-only to full reproduction.

Canonical m87-mission-core now includes the symlink-chain fix and regression coverage. The isolation suite passes 14/14 and the full suite passes 111/111 at the merged revision.

---

Generated 2026-07-10, updated same day after closing the isolation gap. Backbone (Spine-Pro, m87-mission-core) is real and tested. Console remains unbuilt. ContextOS has real code but was not integrated into this demonstration.