# Sibyl MCP Isolation And Migration Suite 2026-06-01

Focused security suite for cross-HOME data isolation and destructive migration/setup behavior.

## How to run

```bash
docker run --rm --network none --cap-drop ALL --security-opt no-new-privileges --pids-limit 192 --memory 768m --cpus 1 --tmpfs /tmp:rw,nosuid,nodev,size=128m --tmpfs /data:rw,nosuid,nodev,size=512m,mode=1777 -v "$PWD:/work" -w /work -e SIBYL_SECURITY_DATA_ROOT=/data sibyl-memory:local python scripts/run_mcp_security_isolation_migration_suite.py
```

## Summary

| Metric | Count |
|---|---:|
| Total | 31 |
| PASS | 25 |
| FAIL | 6 |

## Runs

| Run | Status | Checks | Reason |
|---|---:|---:|---|
| run-2026-06-01-mcp-run188-isolation-basic-entity | PASS | 4 / 4 | none |
| run-2026-06-01-mcp-run189-isolation-same-key-different-homes | PASS | 5 / 5 | none |
| run-2026-06-01-mcp-run190-isolation-state-key | PASS | 4 / 4 | none |
| run-2026-06-01-mcp-run191-isolation-journal-search | PASS | 5 / 5 | none |
| run-2026-06-01-mcp-run192-isolation-archive-one-home | PASS | 5 / 5 | none |
| run-2026-06-01-mcp-run193-isolation-list-category | PASS | 3 / 3 | none |
| run-2026-06-01-mcp-run194-isolation-search-token-abuse | PASS | 3 / 3 | none |
| run-2026-06-01-mcp-run195-isolation-parallel-two-homes | PASS | 5 / 5 | none |
| run-2026-06-01-mcp-run196-isolation-home-special-path | PASS | 3 / 3 | none |
| run-2026-06-01-mcp-run197-isolation-memory-dir-symlink-to-other-home | FAIL | 1 / 2 | a_write_rejected_or_isolated; .sibyl-memory symlink to another HOME lets one HOME write into another HOME database. |
| run-2026-06-01-mcp-run198-isolation-db-symlink-to-other-home | PASS | 2 / 2 | none |
| run-2026-06-01-mcp-run199-migration-clean-preserves-data | PASS | 4 / 4 | none |
| run-2026-06-01-mcp-run200-migration-twice-idempotent | PASS | 3 / 3 | none |
| run-2026-06-01-mcp-run201-migration-backup-symlink-outside-home | PASS | 2 / 2 | none |
| run-2026-06-01-mcp-run202-migration-db-symlink-outside-home | PASS | 2 / 2 | none |
| run-2026-06-01-mcp-run203-migration-credentials-symlink-outside-home | PASS | 2 / 2 | none |
| run-2026-06-01-mcp-run204-migration-home-memory-dir-symlink-outside | PASS | 2 / 2 | none |
| run-2026-06-01-mcp-run205-migration-backup-path-with-spaces | PASS | 3 / 3 | none |
| run-2026-06-01-mcp-run206-migration-backup-path-is-file | PASS | 2 / 2 | none |
| run-2026-06-01-mcp-run207-migration-db-path-directory | PASS | 2 / 2 | none |
| run-2026-06-01-mcp-run208-migration-backup-parent-readonly | PASS | 2 / 2 | none |
| run-2026-06-01-mcp-run209-migration-large-existing-db | PASS | 3 / 3 | none |
| run-2026-06-01-mcp-run210-migration-after-invalid-credentials-json | PASS | 2 / 2 | none |
| run-2026-06-01-mcp-run211-migration-backup-dir-many-existing-files | PASS | 3 / 3 | none |
| run-2026-06-01-mcp-run212-isolation-home-symlink-to-other-home | FAIL | 1 / 2 | write_rejected_or_isolated; HOME path symlink to another HOME lets one profile write into another profile database. |
| run-2026-06-01-mcp-run213-isolation-home-parent-symlink-to-other-home | FAIL | 1 / 2 | write_rejected_or_isolated; Symlinked HOME ancestor lets one profile path resolve into another profile database. |
| run-2026-06-01-mcp-run214-isolation-env-db-symlink-to-other-home | PASS | 2 / 2 | none |
| run-2026-06-01-mcp-run215-isolation-env-db-parent-symlink-to-other-home | FAIL | 1 / 2 | a_write_rejected_or_isolated; SIBYL_MEMORY_DB parent symlink to another HOME lets one profile write into another profile database. |
| run-2026-06-01-mcp-run216-isolation-db-hardlink-to-other-home | PASS | 2 / 2 | none |
| run-2026-06-01-mcp-run217-guarded-exception-run217 | FAIL | 1 / 2 | runner_completed; run217 raised AttributeError |
| run-2026-06-01-mcp-run218-guarded-exception-run218 | FAIL | 1 / 2 | runner_completed; run218 raised AttributeError |

## Patch targets

1. Enforce HOME/data-root isolation even when .sibyl-memory or memory.db are symlinked.
2. Make migration reject or constrain symlinked db, credentials, and backup paths that resolve outside HOME.
3. Keep migration failures sanitized: no backend exception names, stack traces, or internal paths in public output.
4. Preserve data through clean and repeated migrations.