chamber CLAUDE.md

Working on Chamber

Chamber's claim is that its gates are real. Everything below was learned by a gate turning out not to be — usually while a green test suite said otherwise.

The gates that matter are the probes, not the tests

npm test passed at 312, 315, 319, 324, 329, 340 and 350 tests while, in the same tree, the sandbox denied all execution on Linux, the debt gate parked every commit, an audit row could never be written, and a vendor tool description chose the code that ran. The unit suite uses stubs and encodes intent; it cannot fail for the reasons that matter.

npm run probes     # the gate. exits non-zero if any escape reproduces.
npm test           # necessary, never sufficient
npm run typecheck
npm run lint

CI gates on all four. A probe that cannot fail is not a gate — if you add one, make sure it can go red, and prove it once by breaking the thing it watches.

Verification rules that have each been paid for

Ask what state exists at the moment a guard fires. This one question found defects in the sandbox, the debt gate, the checkpoint, the anchor log and the turn path. chamber turn committed an observation and then discovered it could not reach a model. exportCheckpoint wrote the receipt and then let the anchor append refuse. A precondition checked after the write is not a precondition.

Isolation cannot be tested on macOS. There is no bwrap here, so CHAMBER_SANDBOX_REQUIRED=1 refuses for the right reason and for every wrong reason identically. A test asserting "it refuses" passes either way. Verify on Linux:

docker run --rm --privileged -e CHAMBER_SANDBOX_REQUIRED=1 -v "$PWD:/app:ro" node:24-slim \
  bash -c 'apt-get update -qq && apt-get install -y -qq bubblewrap && cd /app && node --experimental-strip-types -e "…"'

Plant a secret in $HOME and assert the payload cannot read it. --privileged is needed for bwrap's namespaces. Note that bwrap applies mount ops left to right: a --tmpfs over a parent placed after a --bind beneath it silently hides the bind.