fix(sandbox): migrate task_memory_writes_disabled into backend protocol

Add the `task_memory_writes_disabled` field to `SeccompEvidence` in the
backend protocol contract and relax the validation from requiring
`cancellation` to accepting `cancellation || task_memory_writes_disabled`.

This completes the rebase migration missed by the isolation-interface
refactor: the sandbox reports this field but the backend struct lacked
it, and the validator rejected every pre-5.19 legacy listener.

Signed-off-by: Akram <akram.benaissi@gmail.com>

Author: akram

crates/openshell-isolation-interface/tests/backend_conformance.rs

@@ -540,37 +540,6 @@ fn confirmation_constructor_rejects_unenforced_property() {
     assert!(matches!(result, Err(BackendError::Confirm(_))));
 }
 
-#[test]
-fn confirmation_accepts_legacy_read_only_listener() {
-    // Cancellation-safety invariant: cancellation OR writes-disabled. A legacy
-    // plain listener (< 5.19) has no cancellation but disables broker output
-    // writes, so it satisfies the invariant and must be accepted.
-    let mut evidence = confirmation_evidence();
-    evidence.seccomp.cancellation = false;
-    evidence.seccomp.task_memory_writes_disabled = true;
-    let result = ConfirmedBoundary::try_new(
-        Box::new(MockReady::<Primary> { _k: PhantomData }),
-        evidence,
-        &workload_identity(),
-    );
-    assert!(result.is_ok());
-}
-
-#[test]
-fn confirmation_rejects_plain_listener_with_writes_enabled() {
-    // The unsafe configuration this PR must never admit: no cancellation AND
-    // task-memory output writes still enabled (the cancellation race).
-    let mut evidence = confirmation_evidence();
-    evidence.seccomp.cancellation = false;
-    evidence.seccomp.task_memory_writes_disabled = false;
-    let result = ConfirmedBoundary::try_new(
-        Box::new(MockReady::<Primary> { _k: PhantomData }),
-        evidence,
-        &workload_identity(),
-    );
-    assert!(matches!(result, Err(BackendError::Confirm(_))));
-}
-
 #[test]
 fn confirmation_constructor_rejects_another_workload_identity() {
     let expected = ResolvedWorkloadIdentity::new(

crates/openshell-sandbox-backend/src/boundary_protocol.rs

@@ -82,6 +82,7 @@ pub struct SeccompEvidence {
     pub task_memory_read: bool,
     pub task_memory_write: bool,
     pub cancellation: bool,
+    pub task_memory_writes_disabled: bool,
 }
 
 /// Mechanism-specific audit evidence for the native Linux sandbox adapter.
@@ -129,7 +130,7 @@ impl NativeLinuxSandboxAuditEvidence {
             && self.seccomp.proc_fd_identity
             && self.seccomp.task_memory_read
             && self.seccomp.task_memory_write
-            && self.seccomp.cancellation
+            && (self.seccomp.cancellation || self.seccomp.task_memory_writes_disabled)
             && self.landlock_abi >= 3
             && self.landlock_allow_deny
             && self.udp_dns_round_trip
@@ -1408,6 +1409,7 @@ mod tests {
                 task_memory_read: true,
                 task_memory_write: true,
                 cancellation: true,
+                task_memory_writes_disabled: false,
             },
             landlock_abi: 6,
             landlock_allow_deny: true,
@@ -1438,6 +1440,22 @@ mod tests {
         assert!(!audit.properties().egress_interception.enforced);
     }
 
+    #[test]
+    fn audit_evidence_accepts_legacy_read_only_listener() {
+        let mut audit = complete_audit_evidence();
+        audit.seccomp.cancellation = false;
+        audit.seccomp.task_memory_writes_disabled = true;
+        assert!(audit.validate().is_ok());
+    }
+
+    #[test]
+    fn audit_evidence_rejects_plain_listener_with_writes_enabled() {
+        let mut audit = complete_audit_evidence();
+        audit.seccomp.cancellation = false;
+        audit.seccomp.task_memory_writes_disabled = false;
+        assert!(audit.validate().is_err());
+    }
+
     #[test]
     fn binary_identity_wire_rejects_ambiguous_or_invalid_shapes() {
         for encoded in [