stderr: /bin/sh: line 1: /tmp/cspa3-e59509353b61/canon/files/README.md: Permission denied

why: the delegated range tops out at 589823; uid 940 is not in it, so remapping lands on a principal with no authority over the store


route: docker exec, i.e. the root-equivalent socket

why: this is not a namespace weakness. It is the Docker socket, and its remediation is removing that socket, not changing namespaces.


error: Permission denied

route: /proc/<pid>/ns via the namespace boundary


stdout: DENIED Operation not permitted

why: ptrace_may_access requires matching uid or CAP_SYS_PTRACE in the target's user namespace. The authority is uid 940, which the agent cannot become -- so ptrace_scope=0 no longer helps it. This is the direct reversal of V2's result.


why: the Docker socket writes into the authority's filesystem regardless of who owns it


container_running: true

detail: the agent can 'docker rm -f' this container and start its own with substituted code; the container is running under the agent's own Docker authority

not_executed: the destructive form is not run because it would end the measurement; J2 already demonstrates write access to the authority's code, which is the same capability


detail: Permission denied

rename: denied (Permission denied)


stdout: ok

why: real host root; DAC does not apply to it and is not claimed to


output: Error: short-name resolution enforced but cannot prompt without a TTY

why: rootless container root maps to the agent uid or its delegated subuid range, neither of which owns the store