Cordon::Runner

TEST-NET-1 (RFC 5737): reserved for documentation, never routed on the public internet. A short --connect-timeout keeps this fast rather than hanging if this ever runs unsandboxed.

Returns true if the underlying sandbox binary is present and usable.

Confirms that this runner does not merely exist (see #available?) but actually enforces isolation on the current host.

#available? only checks that the sandbox binary is on PATH — it can't see kernel restrictions (e.g. unprivileged user namespaces disabled), a restrictive AppArmor/SELinux profile, or a container missing the right capabilities. Some of these failure modes are silent: the tool runs and exits 0 without actually confining anything, which #available? has no way to detect at all.

Runs a handful of real, spawned probes — using #run, so they go through the real platform-native invocation, the same path #run itself takes — and reports pass/fail for each with captured stdout/stderr for diagnosis. This spawns several subprocesses, so call it explicitly (e.g. from cordon confirm), not as part of every #run.

Replaces the current process with command, inside the sandbox described by policy. Used for self-relaunch (Cordon.relaunch) — the caller does not resume; either the sandboxed command takes over the process image, or this raises.

Short platform-facing name for this runner (e.g. "bwrap", "sandbox-exec"), used in ConfirmReport output.

Runs command inside the sandbox described by policy.

If shell is true, command must be a single-element array holding a full shell script string, executed via /bin/sh -c. No positional-arg forwarding is supported — build the complete script string yourself before calling. /bin/sh must be exec-granted by policy (e.g. via Preset::System), same as any other target; shell: true is not an implicit exec exception.

If shell is false (the default), command is the literal argv — command[0] is exec'd directly with command[1..] as its arguments, no shell involved.