CH-009: confine robot file I/O to the data directory

[flemming-n-larsen]

Acceptance brief

Plan item: P-001 / M-004; remains wanted. This merge closes FIO-001, FIO-002, FIO-003, leaves FIO-004 @draft, records IDR-007, and promotes C-005 to enforcement: partial. No unmerged base is authorized or included.

Scenario resolution

• FIO-001 — verifies: FileRedirectionConformanceTest proves a root-relative name is redirected into the data directory and nothing is written at the named path, on both engines; RobotDataResolveTest adds unit coverage of the resolver's strip/traversal-check ordering.
• FIO-002 — verifies: FileRedirectionConformanceTest proves a plain-name write through getDataFile appears in getDataDirectory's listing, on both engines.
• FIO-003 — verifies: FileQuotaConformanceTest proves the documented 200000-byte quota is reported, two chunks under it succeed, and the third is refused with classic's own message, on both engines.
• FIO-004 — stays @draft. Not proposed as closed by this change: IDR-007 records that classic's own evidence for it (FileAttack, FileOutputStreamAttack) depends on a JVM SecurityManager unconditional on path — even a getDataFile-confined target is blocked in classic — a mechanism JDK 24 removed and this bridge cannot reproduce. Neither classic robot could be ported as evidence; the probe built to test this was removed after confirming the finding empirically on both engines.

What merge binds

The merge binds the RobotData resolver (path re-rooting, quota tracking) and the RobocodeFileOutputStream write path calling into it, CAP-004's promotion to status: active and provenance: verified, C-005's partial-enforcement declaration (also provenance: verified), and P-001's M-004/M-119–M-122 bookkeeping (M-122 dropped as a closeable evidence door). It changes no frozen robocode.* signature and retires no criterion; FIO-004 remains open rather than retired, since its wording still states a true (if currently unreachable) requirement.

Human verification (Flemming N. Larsen): re-read CAP-004's README/criteria/design and C-005 against the shipped code and tests, found and fixed one carried-over inaccuracy (README.md and RobotData's Javadoc still said an "absolute path" gets re-rooted; only a root-relative name does — a true drive-letter-absolute name fails the write on both engines instead, which design.md and C-005 already stated correctly), then promoted all four documents' provenance from inferred to verified. clue validate now reports OK with no remaining activation-gate findings. A third context-isolated review pass, scoped to that verification commit, confirmed the correction is factually accurate (independently re-derived the File-merge semantics for both the root-relative and drive-absolute cases) and found no blocking findings.

Verification is complete on candidate 2a8b458: tier-1 unit tests (including RobotDataResolveTest), the full :conformance-test:test sweep (no regression across existing probes) plus the two new conformance tests on both engines, clue validate --coverage --reality-gaps --index-rows (OK), and three context-isolated agentic review passes. The first found one blocking finding — a path-traversal bypass in the resolver's asterisk/.. check ordering — repaired in 3f09647 with a unit regression test; the second, scoped to that repair, found nothing blocking; the third, scoped to the human-verification commit, likewise found nothing blocking. Advisories closed along the way: FIO-001/C-005 wording narrowed to what's actually tested, quota-before-write ordering noted as intentional, test naming aligned to the test<CRIT-ID>_... convention.

🤖 Generated with Claude Code