{
  "checker": {
    "details": {
      "argv": [
        "/workspace/target/release/ai-jail",
        "--no-agent-state",
        "--no-update-check",
        "echo",
        "sandbox-ok"
      ],
      "kind": "cli",
      "needs_browser": false,
      "needs_credentials": false,
      "returncode": 0,
      "scope": "product operation",
      "stderr": "\u25b8 Jail Active: /workspace\n\u25b8 Landlock: fully enforced",
      "stdout": "sandbox-ok",
      "working": true
    },
    "status": "PASS"
  },
  "fault_detail": "Earlier failed probe invoked sh -c 'echo sandbox-ok' through a shell. The probe should invoke the installed product directly (argv starting with the ai-jail binary, operation echo sandbox-ok), as in .coldpass/probe.json. No repo change was needed; repo source is unchanged.",
  "fault_owner": "test",
  "main_blocker": null,
  "operation": "Ran the built ai-jail binary directly: ai-jail --no-agent-state --no-update-check echo sandbox-ok; the bwrap+Landlock sandbox launched and printed sandbox-ok with rc 0.",
  "operation_scope": "Linux sandbox launch only (bubblewrap + Landlock, network off). Not exercised: agent harness launches (claude/codex etc.), network-allowed modes, macOS, full unit/lint suites (intentionally skipped per smoke scope). No credentials or browser required.",
  "outcome": "working",
  "steps": [
    "apt-get install -y bubblewrap curl build-essential pkg-config ca-certificates",
    "rustup toolchain 1.97.1 (per rust-toolchain.toml)",
    "cargo build --release --locked",
    "install -Dm755 target/release/ai-jail ~/.local/bin/ai-jail",
    "target/release/ai-jail --version",
    "target/release/ai-jail --no-agent-state --no-update-check echo sandbox-ok"
  ],
  "stuck_step": null,
  "suggested_fix": null
}