docs: reconcile sandbox policy and protocol results

docs/protocol/Lazaret.tla

@@ -4,8 +4,9 @@ EXTENDS Naturals, FiniteSets, Sequences, TLC
 (***************************************************************************
 Application-wide protocol model for Lazaret.
 
-The model covers Domain startup, ordered resource preparation, Client Session
-registration, host escalation, terminal ownership, failure, and teardown.
+The model covers Domain startup, ordered resource preparation, sandbox launch
+isolation, Client Session registration, host escalation, correlated result
+delivery, terminal ownership, failure, and teardown.
 Cryptographic algorithms, serialization, container commands, filesystems, and
 network packet handling are refinement boundaries validated by implementation
 tests rather than modeled internally.
@@ -24,6 +25,7 @@ CONSTANTS
     SessionFingerprint,
     DomainFingerprint,
     ConfigSafe,
+    SandboxIsolationSafe,
     RequestSession,
     RequestCommand,
     CertificateValid,
@@ -56,6 +58,7 @@ ASSUME
     /\ SessionFingerprint \in [Sessions -> STRING]
     /\ DomainFingerprint \in [Domains -> STRING]
     /\ ConfigSafe \in [Domains -> BOOLEAN]
+    /\ SandboxIsolationSafe \in [Domains -> BOOLEAN]
     /\ RequestSession \in [Requests -> Sessions]
     /\ RequestCommand \in [Requests -> Commands]
     /\ CertificateValid \in [Requests -> BOOLEAN]
@@ -75,11 +78,24 @@ TerminalRoutes == {"Detached", "Sandbox", "Prompt", "HostProcess"}
 ConnectionStates == {"Disconnected", "Connected"}
 RequestPhases == {
     "Unused", "Verified", "AwaitingApproval", "Approved", "Executing",
+    "CompletionPending", "DenialPending", "TimeoutPending",
+    "CancellationPending", "FailurePending",
     "Completed", "Denied", "TimedOut", "Cancelled", "Failed"
 }
 ApprovalSources == {NoApproval, "AutoRule", "Developer"}
+PendingResultPhases == {
+    "CompletionPending", "DenialPending", "TimeoutPending",
+    "CancellationPending", "FailurePending"
+}
 TerminalRequestPhases == {"Completed", "Denied", "TimedOut", "Cancelled", "Failed"}
 
+DeliveredResultPhase(p) ==
+    CASE p = "CompletionPending" -> "Completed"
+      [] p = "DenialPending" -> "Denied"
+      [] p = "TimeoutPending" -> "TimedOut"
+      [] p = "CancellationPending" -> "Cancelled"
+      [] p = "FailurePending" -> "Failed"
+
 (***************************************************************************
 Finite fixture operators used by Lazaret.cfg. The protocol itself depends only
 on the abstract constants above; other TLC configurations may override them with
@@ -96,6 +112,7 @@ SessionFingerprintFixture ==
     (S1 :> "config-a") @@ (S2 :> "config-a")
 DomainFingerprintFixture == D1 :> "config-a"
 ConfigSafeFixture == D1 :> TRUE
+SandboxIsolationSafeFixture == D1 :> TRUE
 RequestSessionFixture ==
     (R1 :> S1) @@ (R2 :> S2) @@ (R3 :> S1)
 RequestCommandFixture ==
@@ -289,6 +306,7 @@ StartSandbox(d) ==
     /\ domainPhase[d] = "Starting"
     /\ sidecarState[d] = "Ready"
     /\ sandboxState[d] = "Stopped"
+    /\ SandboxIsolationSafe[d]
     /\ sandboxState' = [sandboxState EXCEPT ![d] = "Ready"]
     /\ UNCHANGED <<
         domainPhase, coordinatorState, stateAnchorState, sidecarState,
@@ -532,14 +550,14 @@ DeveloperDeny(r) ==
     LET s == ReqSession(r) IN
     /\ requestPhase[r] = "AwaitingApproval"
     /\ sessionPhase[s] = "Prompting"
-    /\ requestPhase' = [requestPhase EXCEPT ![r] = "Denied"]
+    /\ requestPhase' = [requestPhase EXCEPT ![r] = "DenialPending"]
     /\ sessionPhase' = [sessionPhase EXCEPT ![s] = "Attached"]
     /\ terminalRoute' = [terminalRoute EXCEPT ![s] = "Sandbox"]
-    /\ activeRequest' = [activeRequest EXCEPT ![s] = NoRequest]
     /\ UNCHANGED <<
         domainPhase, coordinatorState, stateAnchorState, sidecarState,
         sandboxState, trustReady, lockOwner, published, registered, connected,
-        connectionState, approvalSource, approvedCommand, hostRunning
+        connectionState, activeRequest, approvalSource, approvedCommand,
+        hostRunning
         >>
 
 StartHostExecution(r) ==
@@ -564,29 +582,76 @@ CompleteHostExecution(r) ==
     LET s == ReqSession(r) IN
     /\ requestPhase[r] = "Executing"
     /\ r \in hostRunning
-    /\ requestPhase' = [requestPhase EXCEPT ![r] = "Completed"]
+    /\ requestPhase' = [requestPhase EXCEPT ![r] = "CompletionPending"]
     /\ hostRunning' = hostRunning \ {r}
     /\ sessionPhase' = [sessionPhase EXCEPT ![s] = "Attached"]
     /\ terminalRoute' = [terminalRoute EXCEPT ![s] = "Sandbox"]
-    /\ activeRequest' = [activeRequest EXCEPT ![s] = NoRequest]
     /\ UNCHANGED <<
         domainPhase, coordinatorState, stateAnchorState, sidecarState,
         sandboxState, trustReady, lockOwner, published, registered, connected,
-        connectionState, approvalSource, approvedCommand
+        connectionState, activeRequest, approvalSource, approvedCommand
         >>
 
 TimeoutRequest(r) ==
     LET s == ReqSession(r) IN
-    /\ requestPhase[r] \in {"Verified", "AwaitingApproval", "Approved"}
+    /\ requestPhase[r] \in {"Verified", "AwaitingApproval", "Approved", "Executing"}
     /\ activeRequest[s] = r
-    /\ requestPhase' = [requestPhase EXCEPT ![r] = "TimedOut"]
+    /\ requestPhase' = [requestPhase EXCEPT ![r] = "TimeoutPending"]
     /\ sessionPhase' = [sessionPhase EXCEPT ![s] = "Attached"]
     /\ terminalRoute' = [terminalRoute EXCEPT ![s] = "Sandbox"]
+    /\ hostRunning' = hostRunning \ {r}
+    /\ UNCHANGED <<
+        domainPhase, coordinatorState, stateAnchorState, sidecarState,
+        sandboxState, trustReady, lockOwner, published, registered, connected,
+        connectionState, activeRequest, approvalSource, approvedCommand
+        >>
+
+CancelRequest(r) ==
+    LET s == ReqSession(r) IN
+    /\ requestPhase[r] \in {
+        "Verified", "AwaitingApproval", "Approved", "Executing"
+        }
+    /\ activeRequest[s] = r
+    /\ connectionState[s] = "Connected"
+    /\ requestPhase' = [requestPhase EXCEPT ![r] = "CancellationPending"]
+    /\ sessionPhase' = [sessionPhase EXCEPT ![s] = "Attached"]
+    /\ terminalRoute' = [terminalRoute EXCEPT ![s] = "Sandbox"]
+    /\ hostRunning' = hostRunning \ {r}
+    /\ UNCHANGED <<
+        domainPhase, coordinatorState, stateAnchorState, sidecarState,
+        sandboxState, trustReady, lockOwner, published, registered, connected,
+        connectionState, activeRequest, approvalSource, approvedCommand
+        >>
+
+FailHostExecution(r) ==
+    LET s == ReqSession(r) IN
+    /\ requestPhase[r] = "Executing"
+    /\ activeRequest[s] = r
+    /\ connectionState[s] = "Connected"
+    /\ requestPhase' = [requestPhase EXCEPT ![r] = "FailurePending"]
+    /\ sessionPhase' = [sessionPhase EXCEPT ![s] = "Attached"]
+    /\ terminalRoute' = [terminalRoute EXCEPT ![s] = "Sandbox"]
+    /\ hostRunning' = hostRunning \ {r}
+    /\ UNCHANGED <<
+        domainPhase, coordinatorState, stateAnchorState, sidecarState,
+        sandboxState, trustReady, lockOwner, published, registered, connected,
+        connectionState, activeRequest, approvalSource, approvedCommand
+        >>
+
+DeliverResult(r) ==
+    LET s == ReqSession(r) IN
+    /\ requestPhase[r] \in PendingResultPhases
+    /\ activeRequest[s] = r
+    /\ connectionState[s] = "Connected"
+    /\ sessionPhase[s] = "Attached"
+    /\ requestPhase' = [requestPhase EXCEPT
+        ![r] = DeliveredResultPhase(@)]
     /\ activeRequest' = [activeRequest EXCEPT ![s] = NoRequest]
     /\ UNCHANGED <<
         domainPhase, coordinatorState, stateAnchorState, sidecarState,
         sandboxState, trustReady, lockOwner, published, registered, connected,
-        connectionState, approvalSource, approvedCommand, hostRunning
+        sessionPhase, terminalRoute, connectionState, approvalSource,
+        approvedCommand, hostRunning
         >>
 
 (***************************************************************************
@@ -664,6 +729,9 @@ RequestProgress(r) ==
     \/ StartHostExecution(r)
     \/ CompleteHostExecution(r)
     \/ TimeoutRequest(r)
+    \/ CancelRequest(r)
+    \/ FailHostExecution(r)
+    \/ DeliverResult(r)
 
 Next ==
     \/ (\E s \in Sessions :
@@ -710,6 +778,9 @@ TypeOK ==
 ConfigurationConfinement ==
     \A d \in Domains : domainPhase[d] # "Absent" => ConfigSafe[d]
 
+SandboxNamespaceIsolation ==
+    \A d \in Domains : sandboxState[d] = "Ready" => SandboxIsolationSafe[d]
+
 OrderedNetworkStartup ==
     \A d \in Domains : sandboxState[d] = "Ready" => sidecarState[d] = "Ready"
 
@@ -764,9 +835,21 @@ StateAnchorOwnership ==
     \A d \in Domains : stateAnchorState[d] = "Mounted" =>
         coordinatorState[d] \in {"Starting", "Ready", "Stopping"}
 
+ResultDeliveryStateConsistent ==
+    /\ \A r \in Requests : requestPhase[r] \in PendingResultPhases =>
+        LET s == ReqSession(r) IN
+        /\ activeRequest[s] = r
+        /\ connectionState[s] = "Connected"
+        /\ sessionPhase[s] = "Attached"
+        /\ r \notin hostRunning
+    /\ \A r \in Requests : requestPhase[r] \in TerminalRequestPhases =>
+        /\ activeRequest[ReqSession(r)] # r
+        /\ r \notin hostRunning
+
 Safety ==
     /\ TypeOK
     /\ ConfigurationConfinement
+    /\ SandboxNamespaceIsolation
     /\ OrderedNetworkStartup
     /\ PublishedDomainsReady
     /\ RegisteredSessionsConnected
@@ -777,6 +860,7 @@ Safety ==
     /\ TerminalIsolation
     /\ NoOrphanHostProcess
     /\ StateAnchorOwnership
+    /\ ResultDeliveryStateConsistent
 
 (***************************************************************************
 Liveness properties. TLC configurations may check these separately from the