# Evolution 7 — Enforcement coverage

Data: `enforcement_inventory.json` (regenerated on every run by scanning the checkout).

## Inside the boundary

`cain/talos` is the only declared TALOS-protected path. Within it:

* One function starts a process: `talos_worker.run_confined` (one `Popen`, argv vector, `python -I`, empty
  environment, `close_fds`, new session). One file runs the workload: `talos_sandbox_launcher.py`.
* One function calls `run_confined`: `TalosVerifyKernel.execute`, after `verify_authorization` returned ALLOW
  and the execution intent was recorded.
* The adapters (`TalosGovernedCommandRunner`, `TalosGovernedPythonRunner`, `TalosGovernedFilesystem`,
  `TalosWorkerBoundary`) call `kernel.execute` and have no file or process access of their own.

Tests E7-E-050 and E7-E-051 check this statically (AST) on every run and fail if a new module or a new
process-start site appears in the package.

| Action path | Verified by TALOS before execution | Bound to the exact request | Runs in the sandbox | Refusal leaves no side effect |
|---|---|---|---|---|
| command (`COMMAND`) | yes | argv, cwd, env | yes | yes (canary) |
| Python tool (`PYTHON_CODE`) | yes | code, cwd, env | yes | yes |
| file read (`FS_READ`) | yes | path == signed target | yes, rule for that file only | yes |
| file write (`FS_WRITE`) | yes | path == signed target, content | yes, rule for that file or its parent | yes |

`verify_authorization` without a request verifies and consumes an envelope but starts nothing; a caller that
verified this way and then ran something itself would be outside the boundary. Nothing in the package does.

## Outside the boundary — not governed by TALOS

**`cain.talos` has no production caller.** No gateway route, MCP proxy path, in-process tool or `talos-coder`
tool calls it. Everything below is therefore outside what this evolution's evidence covers, and no statement
here should be read as covering it.

| Path | State |
|---|---|
| `talos-coder/daemon/tools/run_command.py` | `subprocess.run(cmd, shell=True)` with an optional prefix allowlist. Ungoverned. Evolution 5/6 reported it closed; it was not. Not changed here: wiring it in changes a product's behaviour and needs an issuer and trust-root deployment decision. |
| `cain/mcp_proxy.py` stdio tool servers | governed by MCPGate's own capability tokens with optional Landlock/seccomp (Sovereign Evolutions 1–3). A different boundary with its own evidence. |
| gateway request handlers and in-process tool bodies | run inside the gateway process. |
| every other Python file that can start a process | see the per-area counts in `enforcement_inventory.json`; mostly scripts, benchmarks and tests. |
| any agent that can reach tools without going through an adapter | not governed, by definition. |

Gate G03 is **PARTIAL** for this reason: mediation is complete for the declared paths and absent elsewhere.
Release statements must say "the four TALOS action paths", never "tool execution" or "the gateway".

## What it would take to move a path inside

1. An issuer deployment (who holds the CAIN signing key, separate from the process that runs TALOS).
2. TALOS trust roots, audience name, pinned policy digest and a durable ledger path in the gateway configuration.
3. The path's call site replaced by an adapter call, and a test that the old call site is gone.
4. A worker uid, and a decision on the sandbox's host requirements (root or user namespaces, x86_64).