fix: prevent direct AI approval inheritance

src/lumi_eggcracker/supervisor.py

@@ -708,16 +708,25 @@ class Supervisor:
         return value
 
     def _authorizes_protected_scope(
-        self, snapshot: ProcessSnapshot, provenance: dict[str, Any] | None
+        self,
+        snapshot: ProcessSnapshot,
+        provenance: dict[str, Any] | None,
+        *,
+        profile: str | None = None,
     ) -> bool:
-        """Authorize descendants of one exact root-approved workload cgroup.
+        """Authorize a qualified topology worker in one approved cgroup.
 
         A topology launcher commonly execs or forks a worker whose PID/start
         time was not present at the pre-exec gate.  The root-owned provenance
         record and exact delegated cgroup are the approval closure for that
-        worker; UID and cgroup identity remain mandatory, so this does not
-        broaden approval to a user, directory, process name or wildcard.
+        worker.  Direct profiles deliberately do not receive this cgroup-wide
+        closure: an approved launcher must not shelter a separate direct AI
+        process.  UID and cgroup identity remain mandatory, so the topology
+        exception does not broaden approval to a user, directory, process name
+        or wildcard.
         """
+        if profile not in {"content.gguf-ollama", "content.safetensors-vllm"}:
+            return False
         if provenance is None or snapshot.uid != self.policy["workload_uid"]:
             return False
         selected = f"0::{provenance['cgroup']}"
@@ -1703,6 +1712,12 @@ class Supervisor:
                     "",
                 )
                 scope_provenance = provenance_by_cgroup.get(candidate_cgroup)
+                # A root-approved launch identity authorizes only that exact
+                # process.  Cgroup-wide approval is reserved for detector
+                # profiles whose contract explicitly includes a qualified
+                # launcher/worker topology.  A direct profile (for example
+                # GGUF+llama) must not let an approved Python launcher hide a
+                # separate AI process in the same owned cgroup.
                 authorized = (
                     provenance is not None
                     and launch_authorizes(
@@ -1714,7 +1729,9 @@ class Supervisor:
                         provenance,
                     )
                 ) or self._authorizes_protected_scope(
-                    candidate.snapshot, scope_provenance
+                    candidate.snapshot,
+                    scope_provenance,
+                    profile=detected.profile,
                 )
                 # An active local lockdown turns an exact protected
                 # recurrence into an enforcement candidate even when a stale

tests/test_supervisor.py

@@ -109,6 +109,33 @@ class SupervisorTests(unittest.TestCase):
         self.assertTrue(supervisor._managed(snapshot))
         self.assertFalse(supervisor._discovery_excluded(snapshot))
 
+    def test_approved_cgroup_closure_is_limited_to_topology_profiles(self) -> None:
+        supervisor = self._instance()
+        cgroup = "/system.slice/lumi-eggcracker-workload-" + "a" * 24 + ".service"
+        supervisor.active_cgroups = {cgroup}
+        snapshot = ProcessSnapshot(
+            ProcessIdentity(10, 100),
+            2001,
+            "/usr/bin/python3",
+            "python3",
+            ("python3",),
+            ("0::" + cgroup,),
+            (),
+            (),
+        )
+        provenance = {"cgroup": cgroup}
+
+        self.assertFalse(
+            supervisor._authorizes_protected_scope(
+                snapshot, provenance, profile="content.gguf-llama"
+            )
+        )
+        self.assertTrue(
+            supervisor._authorizes_protected_scope(
+                snapshot, provenance, profile="content.gguf-ollama"
+            )
+        )
+
     def test_group_refresh_replaces_preexec_gate_snapshot_without_losing_evidence(self) -> None:
         identity = ProcessIdentity(10, 100)
         stale = ProcessSnapshot(