Module containment 

Containment classes: what an operator declares versus what a host actually achieves.

The two directions are deliberately kept apart:

• The declared floor (murmur_artifact::ContainmentClass) is a requirement, combined from the manifest, the workspace config and --containment by taking the strongest (see murmur_artifact::effective_containment_floor).
• The achieved class starts from [EnforcementTier], which is host-probed at launch time. [achieved_class_for_tier] takes nothing else — not the manifest, not the grant set — so no declaration can ever talk a host into reporting a class it cannot back. Exactly one manifest property may then talk a capsule down from that ceiling, and only downwards: capabilities.filesystem.workdir_exec: true caps the result at ContainmentClass::Advisory (see [achieved_containment_class]), because a capsule whose own workdir is executable has given up the claim scoped makes. The cap is applied in a separate wrapper rather than inside [achieved_class_for_tier] precisely so the “no declaration raises a class” property stays a property of one small, pure function.

ContainmentClass::Sealed is reachable exactly when [EnforcementTier::KernelSealed] is: a Linux host with a usable Landlock ABI, AppArmor out of the way of unprivileged user namespaces, and a namespace probe that really created one. See crate::sealed for the mechanism and for the SealedBlocker taxonomy that turns “not sealed here” into a specific command an operator can run.

The shortfall reason for sealed is therefore mechanism-specific, not a fixed string: a host missing the AppArmor profile and a container missing CAP_SYS_ADMIN both fail to reach sealed, but they are fixed in completely different places, and a refusal that cannot tell them apart is a refusal an operator cannot act on.

Structs

ScopeReport

Read-only answer to “what would this capsule actually be allowed to do on this host?”.

Functions

check_containment_floor

The refusal gate: Ok(()) when the host’s achieved class meets or exceeds the declared floor, RuntimeError::ContainmentFloorUnmet otherwise.

containment_shortfall_reason

Why achieved falls short of declared, naming the missing mechanism rather than the missing class. None when the floor is met.

detect_achieved_containment

Probes this host and reports the strongest class it can actually provide.

detect_sealed_blocker

Which single mechanism keeps this host below sealed, or None when nothing does.

explain_scope

Builds a ScopeReport for policy against this host, with declared as the already- combined floor. Probes the host tier once and reads nothing else.