jobtrackingapp/docs/verification/sec-007-parser-isolation.md

SEC-007 parser isolation verification

Implemented boundary

• The FastAPI web process reads at most 5 MiB and performs cheap extension, signature and DOCX-container preflight checks.
• TXT, Markdown, PDF, DOCX and image decoding runs in parser_child.py, never in the web process.
• Only one parser child is admitted at a time; excess work receives a stable busy response instead of building an in-memory parser queue.
• The child receives a minimal environment without AI provider keys or the service token.
• Linux applies CPU, address-space, output-file, open-file and core-dump limits before importing parser libraries.
• The parent enforces a 25-second deadline and terminates the process group/tree, including OCR descendants.
• Per-request work uses an owner-private temporary directory. Old work-* directories are reconciled without following symlinks or removing unrelated paths.
• The backend has no PDF/DOCX/image fallback. Stable messages replace unexpected internal exceptions and paths.

Container boundary

The production Compose definition resolves the AI service with:

• non-root Dockerfile user;
• read-only root filesystem;
• all Linux capabilities dropped;
• no-new-privileges;
• 96 PID, 2 CPU and 2 GiB memory limits;
• 768 MiB noexec,nosuid,nodev /tmp tmpfs;
• one writable named volume only for the Hugging Face model cache.

Local proof

• Parser tests: 37/37 passed.
• Focused backend extraction/operation tests: 51/51 passed.
• Full backend: 719/719 passed.
• Python compilation: app.py and parser_child.py passed.
• Compose config: valid with all intended controls present.
• Timeout regression spawns a harmless sleeping descendant and proves the process tree is gone after the deadline.
• Environment regression proves GEMINI_API_KEY, GROQ_API_KEY and AI_SERVICE_TOKEN are absent from the child.

Remaining external proof

Docker Desktop's Linux daemon is offline, so the image could not be built or run. Before activation:

1. Build the hash-locked image and record its digest.
2. Confirm the runtime UID is non-root and the root filesystem rejects writes.
3. Inspect the applied CPU/memory/PID/capability/tmpfs settings.
4. Exercise benign TXT, Markdown, PDF, DOCX and image extraction within the configured budgets.
5. Measure peak parent/child memory and OCR duration; lower or evidence any limit increase.
6. Run the authenticated browser upload/review journey with synthetic files.
7. Canary in production only after explicit authorization; disable CV import rather than removing the boundary if the budget is insufficient.