What a compromised fixer that read the canary would try (python3 -m agents.trust):
fixer-root/.expectrail-signing-keyDENIED (absent from the mount)
fixer/player/.expectrail-signing-keyDENIED (absent from the mount)
absolute-root/.expectrail-signing-keyDENIED (path missing)
relative-escape/../verifier-host/.expectrail-signing-keyREACHABLE (shared host FS, no sandbox)
relative-escape/../../verifier-host/.expectrail-signing-keyDENIED (path missing)
absolute-verifier-host-keyREACHABLE (shared host FS, no sandbox)
Deny-by-absence is a claim about the fixer's mount: on a shared host file system, the verifier's key is still reachable outside it. The OS sandbox closes that gap:
OS sandbox canary, bubblewrap (CI job agents-sandbox: agents.trust --require-sandbox)BLOCKED (exit 1)
Machine log: runs/trust/trust-evidence.md and canary-attempts.json.
Release signing: an Ed25519 keypair is generated per run; its public half is published in release-candidate.json.
Where it signs: only on the verifier host. The private key never touches the fixer's workspace.