test(e2e): retain sandbox filesystem baseline

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

.audit/3388-public-policy-proto.tsv

@@ -46,3 +46,4 @@ ts	phase	decision	why	evidence	result
 2026-09-19T07:14:05Z	boundary-hardening	Validate complete provider and merged-policy documents before persistence, safely project JavaScript prototype-shaped parameter keys, and canonicalize legacy set-valued storage fields	Final independent review found that per-fragment validation missed aggregate limits, TypeScript object inheritance could erase untrusted map keys, and stricter public uniqueness rules could reject status-only rewrites of older equivalent records	provider mixed-batch and 1025-rule regressions; TypeScript __proto__/constructor regression; sandbox and provider durable rewrite regressions	All write paths now fail before partial persistence, SDK projection retains every own key without prototype mutation, and legacy duplicate ports or matcher alternatives preserve their enforcement meaning
 2026-09-19T07:26:31Z	build	Add protobuf to the Nix development shell	The pinned Rust Protovalidate runtime compiles its bundled constraint descriptor at build time; mise already provides protoc but the multi-architecture Rust CI shell did not	x86_64-linux Branch Checks lint failure; prost-protovalidate-types 0.6.0 build script; mise and flake tool inventories	Local and Nix-backed Rust builds now supply the same required descriptor compiler without changing runtime behavior
 2026-09-19T07:56:21Z	e2e-fixture	Adapt published community-image fixtures at the backend test boundary without accepting legacy YAML in production	The external base image still embeds singular port fields; container-backed suites can derive and import a corrected image while VM and tmachine lifecycle suites can select an explicit minimal PolicyDocument	e2e Dockerfile and Docker Podman Kubernetes launchers; VM policy fixture; tmachine conformance environment	Image-policy discovery remains covered on container backends, registry-only suites remain deterministic, and the strict authored contract is unchanged
+2026-09-19T08:21:32Z	e2e-filesystem-baseline	Retain the community base image filesystem Landlock and process baseline in explicit VM and tmachine fixtures	A structurally valid empty policy correctly denied the shell and sandbox paths needed by backend lifecycle conformance; relaxing production parsing would weaken the new contract	remote VM and tmachine Permission denied diagnostics; local Docker external-driver lifecycle with the explicit policy	Registry-independent suites can execute their existing lifecycle checks while network access remains denied unless a test supplies a purpose-built policy

e2e/configs/policy-document-default.yaml

@@ -2,6 +2,19 @@
 # SPDX-License-Identifier: Apache-2.0
 
 # Minimal explicit policy for backend lifecycle suites that cannot consume the
-# locally migrated community-image fixture. Tests that need additional access
-# pass their own purpose-built policies.
+# locally migrated community-image fixture. It retains only the community
+# image's filesystem, Landlock, and process baseline; tests that need network
+# access pass their own purpose-built policies.
 version: 1
+
+filesystem_policy:
+  include_workdir: true
+  read_only: [/usr, /lib, /proc, /dev/urandom, /app, /etc, /var/log]
+  read_write: [/sandbox, /tmp, /dev/null]
+
+landlock:
+  compatibility: best_effort
+
+process:
+  run_as_user: sandbox
+  run_as_group: sandbox

tests/ansible/playbooks/conformance/cli.yaml

@@ -48,6 +48,15 @@
       ansible.builtin.copy:
         content: |
           version: 1
+          filesystem_policy:
+            include_workdir: true
+            read_only: [/usr, /lib, /proc, /dev/urandom, /app, /etc, /var/log]
+            read_write: [/sandbox, /tmp, /dev/null]
+          landlock:
+            compatibility: best_effort
+          process:
+            run_as_user: sandbox
+            run_as_group: sandbox
         dest: /var/lib/openshell-conformance/policy-document-default.yaml
         owner: tmachine
         group: tmachine