fix(supervisor-network): distinguish absent policy binary from filesystem-access failure

[letv1nnn]

Summary

resolve_binary_in_container reported an absent non-glob policy binary candidate (ENOENT) with the same WARN as a genuine failure to access /proc/<pid>/root, wrongly telling operators to add CAP_SYS_PTRACE or canonicalize paths. Built-in profiles like pypi list multiple candidate layouts, so images using one layout emitted a burst of misleading warnings on every policy rebuild. This change classifies resolution outcomes into a typed result and logs absent candidates quietly while keeping genuine access failures actionable.

Related Issue

Closes #2883

Changes

• Replace resolve_binary_in_container's Option<String> return with a typed BinaryResolution enum (Resolved, Literal, Absent, Inaccessible, ChainBroken); the resolver no longer logs.
• Move all logging to the caller (proto_to_opa_data_json): Resolved → info, Absent → debug, Inaccessible/ChainBroken → warn. Fixes a pre-existing double-log and a mislabeled broken-chain path.
• Probe /proc/<pid>/root reachability up front: an unreachable process root (pid gone → ENOENT, or denied → EACCES) is classified Inaccessible, while a leaf ENOENT under a reachable root is Absent — resolving the errno ambiguity.
• Always retain the original literal binary path; existing symlinks still contribute their canonical targets.
• Add tests: errno classification (NotFound/PermissionDenied), absent candidate → Absent, unreachable root → Inaccessible, and a caller-level test asserting absent candidates emit zero WARN events. Update existing resolver tests to the enum.

Testing

Since I'm on macOS, I ran the Linux-only tests in a rust:latest Docker container to make sure the #[cfg(target_os = "linux")] paths actually pass.

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[johntmyers]

/ok to test f7a386a

[johntmyers]

gator-agent

PR Review Status

This concentrated fix is project-valid against linked issue #2883. The initial review found no blocking defects; the typed resolution outcomes preserve literal matching while separating expected absent candidates from actionable process-root and symlink-chain failures.

Blocking findings:

• No blocking findings remain

Carried findings:

• None

Non-blocking suggestions:

• GATOR-f7a386ac-01: Preserve the failing intermediate component in ChainBroken warnings so operators can diagnose multi-level symlink failures more directly.

Gator metadata

• Validation: Concentrated supervisor-network bug fix implementing linked issue bug: avoid misleading symlink-resolution warnings for absent policy binaries #2883 with a clear reproduction and regression coverage.
• Docs: Not needed because this refines internal warning classification and does not change a supported user workflow, CLI/API contract, policy syntax, or configuration.
• Checks: DCO and vouch gates are green; current-head branch and Helm gates have not started yet.
• E2E: test:e2e applied and /ok to test f7a386ac0b11a3b3c1bdd2c4ed28fe9b5e00eab9 posted; required current-head workflows are not yet observed as queued.
• Head SHA: f7a386ac0b11a3b3c1bdd2c4ed28fe9b5e00eab9
• Base SHA: 8be8b62ab58e42ee08213494b0d556ebc829e5de
• Merge base SHA: 905e99aa2a960c17d5672b11cf64f10ff7d18b41
• Patch ID: ccc8bf532fef3c2d9070bcf9d4c9b3219cbf12d8
• Gator payload: 7
• Review mode: initial
• Previous reviewed SHA: none
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:in-review

[github-actions]

Label test:e2e applied for f7a386a. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[johntmyers]

/ok to test d8df79d

[johntmyers]

gator-agent

PR Review Status

The follow-up review found no blocking defects in the latest author delta. The test-only setup reorder is safe, the prior diagnostic-path suggestion remains non-blocking, and current-head Branch Checks, Helm Lint, and E2E workflows are now dispatched.

Blocking findings:

• No blocking findings remain

Carried findings:

• None

Gator metadata

• Validation: Concentrated supervisor-network bug fix implementing linked issue bug: avoid misleading symlink-resolution warnings for absent policy binaries #2883 with a clear reproduction and regression coverage.
• Docs: Not needed because this refines internal warning classification and does not change a supported user workflow, CLI/API contract, policy syntax, or configuration.
• Checks: Current-head Branch Checks and Helm Lint workflows are queued or running; DCO is green.
• E2E: test:e2e is applied, /ok to test d8df79d21066cd8fbd04dba047e51bf3bceef5b7 was posted, and the current-head E2E workflow is queued.
• Head SHA: d8df79d21066cd8fbd04dba047e51bf3bceef5b7
• Base SHA: 572843baf8a68263dda80a46441d1697e201ba74
• Merge base SHA: 905e99aa2a960c17d5672b11cf64f10ff7d18b41
• Patch ID: 4a6cd0dab8268ef5206ca1f049abd75dd7b42df9
• Gator payload: 7
• Review mode: follow_up
• Previous reviewed SHA: f7a386ac0b11a3b3c1bdd2c4ed28fe9b5e00eab9
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:watch-pipeline

[johntmyers]

gator-agent

Monitoring Complete

Monitoring is complete because this PR has merged.

Final status: The PR reached gator:merge-ready, received maintainer approval, and completed the required current-head checks, including E2E.

I removed the active gator:* label because there is nothing left for gator to monitor on this PR.