# Security Gate LLM Containment

audience: AI coding agents first.

status: IDLE
task IDs: #140
source request: Contain security-gate LLM subprocesses that invoke raw `codex exec`/`claude -p --dangerously-skip-permissions` without imposing per-call container latency.

## Outcome

Every gate LLM call executes in cheap persistent/pooled containment off the laptop, with unchanged verdict semantics and bounded latency.

## Preserved evidence

- Suspect source: `modules/security/orchestrator/llm_runner.py:59-69`.
- It shells directly to agent CLIs and bypasses `agent-sandbox`/`sandbox-run`.
- Gate invokes many fast stateless calls; per-session container setup is unsuitable.
- Other dispatch paths reportedly showed 128 container-mode CDX runs and zero host fallback.
- Task #140 is marked completed, but its own description says design unresolved; treat as false completion until installed proof.

## Constraints

- Never test containment failure modes on laptop/buildboxes; use danger-lab VM.
- Never weaken security gate or alter verdicts to improve latency.
- Fail closed if pool unavailable.

## Execution steps

1. Verify current source/install behavior.
2. Design persistent remote worker/pool protocol with bounded queue and identity.
3. Test normal/failure branches in danger-lab.
4. Measure latency against current calls.
5. Install, verify real pre-push invocation, land/deploy.

## Current receipt

No installed containment receipt. Registry completion is contradicted.

## Next executable action

Read current `llm_runner.py` and deployment mapping, then measure call frequency/latency before selecting pool design.