Add optional Runpod untrusted-caller lab

Isolate an opt-in CPU Serverless adversarial-caller lab from the core assurance claim, with fail-closed immutable-image preflight, signed local-controller records, bounded live execution, and unconditional cleanup.

Author: noah-ing

.github/workflows/runpod-live-lab.yml

@@ -0,0 +1,53 @@
+name: Runpod lab contract check (no Runpod resources)
+
+'on':
+  workflow_dispatch:
+    inputs:
+      worker_image:
+        description: Immutable linux/amd64 worker reference (registry/repository@sha256:...)
+        required: true
+        type: string
+      max_duration_minutes:
+        description: Bound validated for the local-only live runner
+        required: true
+        default: "10"
+        type: choice
+        options:
+          - "5"
+          - "10"
+          - "15"
+          - "20"
+          - "30"
+permissions:
+  contents: read
+
+jobs:
+  validate-only:
+    name: Validate inputs and fake worker
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    env:
+      WORKER_IMAGE: ${{ inputs.worker_image }}
+      MAX_DURATION_MINUTES: ${{ inputs.max_duration_minutes }}
+    steps:
+      - name: Check out source
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
+
+      - name: Install pinned uv
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          version: "0.12.5"
+          enable-cache: false
+
+      - name: Install the locked local test environment
+        run: uv sync --frozen --extra dev
+
+      - name: Run contract validation without Runpod infrastructure
+        shell: bash
+        run: |
+          ./examples/runpod-untrusted-caller/scripts/run-live.sh \
+            --validate-only \
+            --worker-image "$WORKER_IMAGE" \
+            --max-duration-minutes "$MAX_DURATION_MINUTES"

.github/workflows/verify.yml

@@ -21,6 +21,25 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Install pinned uv
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          version: "0.12.5"
+          enable-cache: false
+
+      - name: Install TPM build prerequisites
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes --no-install-recommends \
+            build-essential libtss2-dev pkg-config
+
+      - name: Audit locked core and worker dependencies
+        run: |
+          uv sync --frozen --extra dev
+          uv run --frozen pip-audit
+          uv run --frozen pip-audit \
+            -r examples/runpod-untrusted-caller/requirements.lock
+
       - name: Validate Compose configuration
         run: docker compose config --quiet
 
@@ -33,3 +52,20 @@ jobs:
       - name: Remove containers, volumes, and network
         if: always()
         run: docker compose down --volumes --remove-orphans
+
+      - name: Build isolated untrusted-caller worker
+        run: |
+          docker build --platform linux/amd64 \
+            --tag atcap-runpod-holder:ci \
+            examples/runpod-untrusted-caller
+
+      - name: Run worker smoke without network or privileges
+        run: |
+          docker run --rm --platform linux/amd64 --network none --read-only \
+            --env TMPDIR=/run/worker-tmp \
+            --tmpfs /run/worker-tmp:rw,noexec,nosuid,size=16m \
+            --cap-drop ALL --security-opt no-new-privileges \
+            atcap-runpod-holder:ci sh -c \
+              'python /opt/worker/self_test.py && python /opt/worker/handler_self_test.py'
+          test "$(docker image inspect atcap-runpod-holder:ci --format '{{.Architecture}}')" = amd64
+          test "$(docker image inspect atcap-runpod-holder:ci --format '{{.Config.User}}')" = 10001:10001

README.md

@@ -14,6 +14,7 @@ endorsement, and no upstream issue is claimed closed.
 | Clean verification | `docker compose build --pull --no-cache` followed by `docker compose up --abort-on-container-exit --exit-code-from verify verify` |
 | Expected smoke result | The full suite under branch-enabled combined coverage, real-`swtpm` integration, lint, format, type, security, and installed-package checks pass; the verifier prints `container smoke: PASS` and exits `0`. |
 | Reviewer map | [Audit guide](docs/audit-guide.md) and [threat model](docs/threat-model.md) |
+| Optional adversarial lab | [Runpod as an untrusted disposable holder](examples/runpod-untrusted-caller/README.md); excluded from the core assurance claim, with no Runpod resources or charges in ordinary CI. |
 | Report a vulnerability | Follow the repository's [security policy](SECURITY.md). |
 
 ## What the experiment establishes
@@ -188,16 +189,38 @@ excludes the Linux-only `swtpm` profile; Compose is authoritative for that path.
 ```sh
 uv sync --frozen --python 3.12 --extra dev
 TZ=UTC ./scripts/verify-coverage.sh -m 'not swtpm'
+uv run --frozen pytest examples/runpod-untrusted-caller/tests -m 'not swtpm'
 uv run --frozen ruff check .
 uv run --frozen ruff format --check .
 uv run --frozen mypy
+uv run --frozen mypy --strict examples/runpod-untrusted-caller/lab \
+  examples/runpod-untrusted-caller/bounded_capture.py \
+  examples/runpod-untrusted-caller/deadline_supervisor.py \
+  examples/runpod-untrusted-caller/billing_observation.py \
+  examples/runpod-untrusted-caller/evidence_manifest.py \
+  examples/runpod-untrusted-caller/provider_readback.py \
+  examples/runpod-untrusted-caller/handler.py \
+  examples/runpod-untrusted-caller/handler_self_test.py \
+  examples/runpod-untrusted-caller/self_test.py \
+  examples/runpod-untrusted-caller/lab_test_support.py
 uv run --frozen bandit -q -r src
 uv run --frozen bandit -q scripts/verify-package.py
+uv run --frozen bandit -q -r examples/runpod-untrusted-caller/lab
+uv run --frozen bandit -q \
+  examples/runpod-untrusted-caller/bounded_capture.py \
+  examples/runpod-untrusted-caller/deadline_supervisor.py \
+  examples/runpod-untrusted-caller/billing_observation.py \
+  examples/runpod-untrusted-caller/evidence_manifest.py \
+  examples/runpod-untrusted-caller/provider_readback.py \
+  examples/runpod-untrusted-caller/handler.py \
+  examples/runpod-untrusted-caller/handler_self_test.py \
+  examples/runpod-untrusted-caller/self_test.py
 package_dist_dir="$(mktemp -d)"
 uv run --frozen python -m build --no-isolation --outdir "${package_dist_dir}"
 uv run --frozen python scripts/verify-package.py --dist-dir "${package_dist_dir}"
 find "${package_dist_dir}" -depth -delete
 uv run --frozen pip-audit
+uv run --frozen pip-audit -r examples/runpod-untrusted-caller/requirements.lock
 uv run --frozen detect-secrets scan --all-files \
   --exclude-files '(^|/)(\.git|\.venv|\.mypy_cache|\.pytest_cache|\.ruff_cache|build|dist)/' .
 ```
@@ -207,9 +230,12 @@ verification step rather than a frozen behavioral result.
 
 ## Deliberately deferred
 
-Live TPM hardware, production AK enrollment, cloud evidence, elaborate provenance
-DAGs, fuzzing, Sigstore, published SBOMs, external workloads, broad CLI work,
-availability engineering, and external services are outside this experiment.
+Live TPM hardware, production AK enrollment, cloud attestation, elaborate
+provenance DAGs, fuzzing, Sigstore, published SBOMs, broad CLI work, and
+availability engineering are outside the core experiment. The optional Runpod
+example tests application behavior against a remote untrusted caller; it does
+not extend the core assurance ceiling or treat any cloud service as an
+attestation root.
 
 ## License
 

compose.yaml

@@ -33,6 +33,7 @@ services:
         condition: service_healthy
     environment:
       ATCAP_SWTPM_TCTI: swtpm:host=swtpm,port=2321
+      ATCAP_LAB_COMMIT_SHA: ${ATCAP_LAB_COMMIT_SHA:-0000000000000000000000000000000000000000}
       TPM2TOOLS_TCTI: swtpm:host=swtpm,port=2321
     command: ["./scripts/container-smoke.sh"]
     security_opt:

docs/audit-guide.md

@@ -345,16 +345,38 @@ Host checks use the committed lock and exclude only the Linux `swtpm` marker:
 ```sh
 uv sync --frozen --python 3.12 --extra dev
 TZ=UTC ./scripts/verify-coverage.sh -m 'not swtpm'
+uv run --frozen pytest examples/runpod-untrusted-caller/tests -m 'not swtpm'
 uv run --frozen ruff check .
 uv run --frozen ruff format --check .
 uv run --frozen mypy
+uv run --frozen mypy --strict examples/runpod-untrusted-caller/lab \
+  examples/runpod-untrusted-caller/bounded_capture.py \
+  examples/runpod-untrusted-caller/deadline_supervisor.py \
+  examples/runpod-untrusted-caller/billing_observation.py \
+  examples/runpod-untrusted-caller/evidence_manifest.py \
+  examples/runpod-untrusted-caller/provider_readback.py \
+  examples/runpod-untrusted-caller/handler.py \
+  examples/runpod-untrusted-caller/handler_self_test.py \
+  examples/runpod-untrusted-caller/self_test.py \
+  examples/runpod-untrusted-caller/lab_test_support.py
 uv run --frozen bandit -q -r src
 uv run --frozen bandit -q scripts/verify-package.py
+uv run --frozen bandit -q -r examples/runpod-untrusted-caller/lab
+uv run --frozen bandit -q \
+  examples/runpod-untrusted-caller/bounded_capture.py \
+  examples/runpod-untrusted-caller/deadline_supervisor.py \
+  examples/runpod-untrusted-caller/billing_observation.py \
+  examples/runpod-untrusted-caller/evidence_manifest.py \
+  examples/runpod-untrusted-caller/provider_readback.py \
+  examples/runpod-untrusted-caller/handler.py \
+  examples/runpod-untrusted-caller/handler_self_test.py \
+  examples/runpod-untrusted-caller/self_test.py
 package_dist_dir="$(mktemp -d)"
 uv run --frozen python -m build --no-isolation --outdir "${package_dist_dir}"
 uv run --frozen python scripts/verify-package.py --dist-dir "${package_dist_dir}"
 find "${package_dist_dir}" -depth -delete
 uv run --frozen pip-audit
+uv run --frozen pip-audit -r examples/runpod-untrusted-caller/requirements.lock
 uv run --frozen detect-secrets scan --all-files \
   --exclude-files '(^|/)(\.git|\.venv|\.mypy_cache|\.pytest_cache|\.ruff_cache|build|dist)/' .
 ```
@@ -369,8 +391,9 @@ docker compose up --abort-on-container-exit --exit-code-from verify verify
 docker compose down --volumes --remove-orphans
 ```
 
-`container-smoke.sh` checks simulator usability first and then runs the complete
-pytest suite under branch-enabled combined coverage, Ruff lint and formatting,
+`container-smoke.sh` checks simulator usability first and then runs the core
+pytest suite under branch-enabled combined coverage plus the isolated lab's
+no-Runpod-infrastructure fake-transport and real-local-`swtpm` tests, Ruff lint and formatting,
 strict mypy, Bandit, and strict package verification. Coverage.py combines
 statement and branch opportunities for its configured `fail_under`: the `85.00%`
 combined floor is below the measured `85.66%` pre-change host combined baseline.
@@ -385,6 +408,14 @@ environment. `tests/test_verify_package.py` fixes duplicate-member, duplicate
 advisory result changes with its online database and neither is part of the TPM
 behavioral smoke.
 
+The optional live runner performs a separate fail-closed worker gate before any
+Runpod mutation: it anonymously pulls the configured immutable `linux/amd64`
+digest and runs both deployed self-tests with no network, a read-only root
+filesystem, non-root identity, dropped capabilities, and
+`no-new-privileges`. The worker Dockerfile rejects an empty dependency lock,
+runs `pip check`, and imports the copied handler during the build. These are
+local startability checks, not evidence that Runpod executed that image.
+
 The Docker path has a digest-pinned base-image index and a committed Python lock.
 It is not bit reproducible:
 apt package versions come from floating Debian repositories, and the

docs/threat-model.md

@@ -270,4 +270,7 @@ to its trust domain.
 
 The reference Compose topology is a verification environment, publishes no
 simulator port, and uses one disposable `swtpm` instance. It is not a production
-network or deployment model and provisions no external service.
+network or deployment model and provisions no external service. The isolated
+[Runpod example](../examples/runpod-untrusted-caller/README.md) is outside this
+core assurance claim and treats its remote host, control plane, queue, worker,
+registry metadata, and output as untrusted.

examples/runpod-untrusted-caller/.dockerignore

@@ -0,0 +1,11 @@
+*
+!Dockerfile
+!handler.py
+!handler_self_test.py
+!self_test.py
+!requirements.lock
+!lab/
+!lab/__init__.py
+!lab/errors.py
+!lab/worker.py
+!lab/worker_wire.py

examples/runpod-untrusted-caller/Dockerfile

@@ -0,0 +1,40 @@
+# This exact multi-platform base index is the same reviewed Python 3.12.11
+# Bookworm base used by the verification harness. Build and deploy linux/amd64.
+FROM python:3.12.11-slim-bookworm@sha256:519591d6871b7bc437060736b9f7456b8731f1499a57e22e6c285135ae657bf7
+
+ARG TARGETPLATFORM
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PATH=/opt/worker-venv/bin:${PATH}
+
+RUN test "$TARGETPLATFORM" = "linux/amd64" \
+    && groupadd --gid 10001 worker \
+    && useradd --uid 10001 --gid 10001 --create-home --shell /usr/sbin/nologin worker \
+    && python -m venv /opt/worker-venv \
+    && chown -R worker:worker /opt/worker-venv
+
+WORKDIR /opt/worker
+
+COPY --chown=worker:worker requirements.lock ./requirements.lock
+RUN test -s requirements.lock \
+    && python -m pip install --no-cache-dir --require-hashes --requirement requirements.lock \
+    && python -m pip check \
+    && python -c 'import ca2a_runtime, cryptography, joserfc, pydantic, rfc8785, runpod'
+
+COPY --chown=worker:worker handler.py handler_self_test.py self_test.py ./
+COPY --chown=worker:worker \
+    lab/__init__.py \
+    lab/errors.py \
+    lab/worker.py \
+    lab/worker_wire.py \
+    ./lab/
+
+# Import the exact copied entrypoint and shared modules during the build. This
+# makes a missing runtime dependency or malformed source a build failure rather
+# than a worker that can never join the Runpod dispatcher.
+RUN python -c 'import handler, lab.worker, lab.worker_wire'
+
+USER 10001:10001
+
+CMD ["python", "-u", "handler.py"]