Propose CH-009: confine robot file I/O to the data directory

Scopes M-004's fix at RobotData's single resolution point (re-root
absolute/traversing paths, enforce the documented 200000-byte quota),
closing FIO-001..003. Flags FIO-004's raw java.io scope as a blocking
open question against the architecture record's explicit sandbox
descoping.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011GShGLuFwRpnWNY2WL5Vz5

Author: flemming-n-larsen

.clue/id-ledger.yaml

@@ -5,7 +5,7 @@ counters:
     ARCH: "3"
     C: "7"
     CAP: "8"
-    CH: "8"
+    CH: "9"
     CRIT: "8"
     DES: "8"
     EVT: "15"
@@ -243,6 +243,11 @@ entries:
       state: reserved
       prefix: CH
       component: "8"
+    - id: CH-009
+      kind: numeric
+      state: reserved
+      prefix: CH
+      component: "9"
     - id: CRIT-001
       kind: numeric
       state: live

changes/CH-009-m004-file-io-sandboxing/open-questions.md

@@ -0,0 +1,15 @@
+## Blocking
+
+### Does `FIO-004` cover raw `java.io` access, or only access reached through `getDataFile`/`getDataDirectory`?
+
+`CAP-004`'s criteria name the ported classic test robots `FileAttack` and `FileOutputStreamAttack` as `FIO-004`'s evidence plan. Reading them in `C:/Code/robocode/robocode.tests.robots/src/main/java/tested/robots/`:
+
+- `FileOutputStreamAttack` calls `getDataFile("test")`, then opens a plain `java.io.FileOutputStream` on the returned `File`. This is exactly the path this change's resolver covers: `getDataFile` re-roots the name, and whatever opens the resulting `File` sees an already-confined path. Porting this robot needs no scope decision.
+- `FileAttack` never calls `getDataFile` at all. It opens `new FileInputStream("C:\\MSDOS.SYS")` and `new FileOutputStream("C:\\Robocode.attack")` directly. In classic, this is blocked by the JVM `SecurityManager`'s `checkRead`/`checkWrite` — a mechanism this repository's own architecture record says is out of scope: `docs/architecture/README.md` lists "threads, reflection, and sockets" as sandbox gaps "scoped out rather than forgotten," and `AGENTS.md` records that JDK 24 removed `SecurityManager` outright, which is why classic needs its own older JDK to run at all. A resolver inside `getDataFile` cannot see or redirect a call that never goes through it.
+
+Two ways to resolve this, neither of which this change should choose on its own:
+
+1. **Narrow `FIO-004` to the `getDataFile`-reached surface.** Port `FileOutputStreamAttack` as `FIO-004`'s evidence; drop `FileAttack` or retarget it at a different criterion (or a documented, deliberately out-of-scope gap alongside threads/reflection/sockets). This keeps `CAP-004` inside the boundary the architecture record already drew.
+2. **Widen scope to intercept raw `java.io` calls from robot code.** This would need a mechanism the bridge does not have today — a security-manager successor (Java's replacement APIs), a custom `FileSystemProvider`, or bytecode instrumentation of robot jars at wrap time — and is a materially larger and separately-plannable piece of work, arguably its own capability rather than a corner of `CAP-004`.
+
+This change proceeds on option 1's assumption (resolver-surface confinement only, `FileAttack` excluded or retargeted) unless directed otherwise, because option 2 is a different-shaped change that this plan door's own scope note (`docs/architecture/README.md`'s "scoped out rather than forgotten") argues against undertaking implicitly. Flagging here rather than deciding silently, per the scope-change rule in `AGENTS.md`.

changes/CH-009-m004-file-io-sandboxing/proposal.md

@@ -0,0 +1,25 @@
+---
+id: CH-009
+type: change
+status: proposed
+links: [P-001, M-004, CAP-004, C-005, FIO-001, FIO-002, FIO-003, FIO-004, IDR-002]
+title: Confine robot file I/O to the robot's data directory
+---
+
+# CH-009 — Confine robot file I/O to the robot's data directory
+
+## What
+
+Give `RobotData.getDataFile`/`getDataDirectory` — the one resolution point `robocode.RobocodeFileOutputStream` and `robocode.RobocodeFileWriter` already route through — the confinement classic Robocode has and the bridge does not: an absolute or traversing path a robot names is re-rooted inside the robot's data directory rather than passed through, and the directory's total size is capped at the documented 200000-byte quota. Move `FIO-001`, `FIO-002`, `FIO-003` out of `@draft` with integration evidence, and give `C-005` machine enforcement in place of the agent-judgment note it currently carries.
+
+`FIO-004`'s scope is a blocking open question (see `open-questions.md`) and is not committed to by this proposal until it is answered.
+
+## Why
+
+`C-005` already states the defect: `RobotData.getDataFile` uses `java.nio.file.Path#resolve`, which returns an absolute argument unchanged rather than re-rooting it — the opposite of classic's silent redirection. A rumble bot that writes to a root-level path (`AN-012`'s note on Windows permission-failure floods) produces thousands of access-denied errors under the bridge where classic produced a normal write inside the robot's directory. `IDR-002` aligned `getDataDirectory` and `getDataFile` to the same lookup but explicitly left confinement undone; `FIO-002`'s `@draft` status is the record of that gap, and this change is what closes it.
+
+The quota (`FIO-003`) is documented in three Javadoc comments (`RobocodeFileOutputStream`, `RobocodeFileWriter`, `IAdvancedRobotPeer#getDataFile`) and enforced nowhere; a robot that reads its own Javadoc and expects a `SYSTEM:`-prefixed quota message and an `IOException` at 200000 bytes currently gets neither.
+
+## Route
+
+Full. This closes acceptance criteria that are currently `@draft` (`FIO-001`, `FIO-002`, `FIO-003`) and promotes `C-005` from `enforcement: agent` to machine-enforced — both are contract changes, not refactors of unchanged behaviour.

changes/CH-009-m004-file-io-sandboxing/tasks.md

@@ -0,0 +1,11 @@
+- [ ] Resolve the blocking open question on `FIO-004`'s scope before starting its task below.
+- [ ] Implement the single resolution point in `RobotData`: re-root an absolute or drive-rooted `filename` argument inside the data directory, resolve `..` traversal inside the directory rather than escaping it, and keep `getDataDirectory`/`getDataFile` agreeing as `IDR-002` already requires — serves `FIO-001`, `FIO-002`.
+- [ ] Add the 200000-byte data-directory quota at the same resolution point (tracking bytes written across the directory's lifetime, refusing further writes with the same `IOException` classic raises) — serves `FIO-003`.
+- [ ] Port classic's `TestFileWriteSize` conformance robot/test (`C:/Code/robocode/robocode.tests.robots/.../FileWriteSize.java` and its test) for `FIO-003`'s quota-exceeded evidence, and a companion positive case that stays under quota.
+- [ ] Port `FileOutputStreamAttack` (and, depending on the open question's answer, `FileAttack` or a retargeted equivalent) as conformance evidence for `FIO-001`/`FIO-004` under `ARCH-003`'s tier.
+- [ ] Add a focused unit case for `FIO-002`: writing through `getDataFile(name)` and listing `getDataDirectory()` see the same file, for both a plain name and a re-rooted absolute/traversing one.
+- [ ] Remove `@draft` from `FIO-001`, `FIO-002`, `FIO-003` in `CAP-004/criteria.md`; leave `FIO-004` `@draft` if its scope is narrowed to a criterion this change does not fully close, or resolve it if the answer lets it close here.
+- [ ] Update `CAP-004/design.md` and `CAP-004/README.md` to describe the resolver as implemented rather than intended, and update `C-005` from `enforcement: agent` to its machine-enforced state (or promote-with-residual note if `FIO-004` stays partly open).
+- [ ] Update `P-001`'s evidence-door table (`M-119`–`M-122` equivalents don't exist for `FIO-00x`; confirm the milestone-status row for `M-004` and any doors naming `FIO-001`..`FIO-004`) to reflect what closed.
+- [ ] Run the tier-1 unit suite and the focused tier-2 conformance tests with the matched local Tank Royale API/runner pair; retain any environment limitation in the handoff.
+- [ ] Digest: regenerate indexes, run `clue validate`, commit the final state, and delete this change workspace.