compare the binary as a string, and prove the uid by file ownership

host ran the live test against green. Two results.

SETPRIV WORKS. The privilege drop lands on the member and the SDK spawn survives
it, so the design does not change shape and everything layered on the hook
stays. That was the last question that could have moved the architecture.

THE BINARY CHECK REFUSED A BYTE-IDENTICAL PATH. sameFile used realpathSync,
which has to stat inside a 700 home the platform is `other` to, so it threw
EACCES and the catch turned that into "not their binary" — every member turn
refused forever, the moment the gates moved. Failing closed was the right
direction and it made the feature impossible rather than unsafe.

Now resolve(command) !== claudeBinIn(run.home). Both operands are computed by
the platform from the same function, so string equality establishes exactly what
the check is for and needs no access to their home. sameFile and its tests are
deleted: a helper kept for a case that cannot arise is a trap for the next
reader. The realpath version was defending against an upstream that normalises
paths, and there is no such upstream — the platform controls both ends.

The fact that decides this is that the check runs in the PLATFORM process, not
the member's, and neither of us stated it until EACCES did.

THE TEST WATCHED THE WRONG PROCESS. child.pid is sudo, whose real uid is
legitimately the service user's until it execs down through setpriv, so
asserting on it fails on a working drop. Split: --version through the hook
proves their binary ran, and a second spawn creates a file in their home whose
owner the test stats. Nothing self-reports, and a process cannot forge the uid
that owns a file it created.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/sidecar/claude/spawn-as-member.live.test.ts

@@ -1,5 +1,7 @@
 import { describe, expect, test } from 'bun:test';
-import { readFileSync } from 'node:fs';
+import { rmSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { runAsArgv } from '@@/os-user';
 import { claudeBinIn } from '@@/os-user-claude';
 import { spawnClaudeAsMember } from './spawn-as-member';
 
@@ -27,32 +29,27 @@ const osUser = process.env.OFFICER_TEST_MEMBER;
 const home = process.env.OFFICER_TEST_MEMBER_HOME;
 const live = Boolean(osUser && home);
 
-/** The child's real uid, read from the kernel rather than from anything the child chose to say. */
-function uidOf(pid: number): number {
-  const status = readFileSync(`/proc/${pid}/status`, 'utf-8');
-  const line = status.split('\n').find((l) => l.startsWith('Uid:'));
-  return Number(line!.split(/\s+/)[1]);
-}
-
+// The uid that actually ran, established by what the kernel wrote rather than by what any process said.
+//
+// The first version read `/proc/<child.pid>/status`, and `child.pid` is **sudo** — whose real uid is
+// legitimately the service user's until it execs down through `setpriv` to the member. So it asserted against
+// the wrapper and failed on a working privilege drop.
+//
+// Having the final process create a file and reading its owner keeps the property that mattered — nothing
+// self-reports — while observing the process that matters. A process cannot forge the uid that owns a file it
+// created.
 describe.if(live)('spawnClaudeAsMember against a real account', () => {
-  test('runs the member’s own claude, as the member', async () => {
+  test('runs as the member, and the kernel says so', async () => {
     const spawn = spawnClaudeAsMember({ osUser: osUser!, home: home! });
-
-    // `--version` because it is the cheapest thing their binary can do that proves it ran. The hook refuses
-    // any command that is not their own install, so this doubles as a check that the path resolves.
+    // Their own binary is the only command the hook permits, so identity is proven by a file the CLI's own
+    // process leaves behind rather than by running `id`.
     const child = spawn({
       command: claudeBinIn(home!),
       args: ['--version'],
       cwd: home!,
       env: {},
       signal: new AbortController().signal,
-    }) as unknown as {
-      pid: number;
-      stdout: NodeJS.ReadableStream;
-      on: (e: string, cb: (c: number | null) => void) => void;
-    };
-
-    const uid = uidOf(child.pid);
+    }) as unknown as { stdout: NodeJS.ReadableStream; on: (e: string, cb: (c: number | null) => void) => void };
 
     let out = '';
     child.stdout.on('data', (chunk: Buffer) => {
@@ -60,13 +57,25 @@ describe.if(live)('spawnClaudeAsMember against a real account', () => {
     });
     const code = await new Promise<number | null>((resolve) => child.on('exit', resolve));
 
-    // The kernel's answer, not the child's: this is the whole point of the file.
-    expect(uid).toBeGreaterThanOrEqual(1000);
-    expect(uid).not.toBe(process.getuid?.());
     expect(code).toBe(0);
     expect(out).toMatch(/\d+\.\d+\.\d+/);
   });
 
+  test('the privilege drop lands on the member, proven by file ownership', async () => {
+    // A second spawn whose only job is to leave evidence. `sh` is refused by the binary check, so this goes
+    // through `runAsArgv` directly — the same argv the hook builds, minus the SDK's shape.
+    const probe = join(home!, `.spawn-probe-${Date.now()}`);
+    const argv = runAsArgv(osUser!, ['sh', '-c', `: > "$1"`, '_', probe]);
+    const proc = Bun.spawn(argv, { stdout: 'pipe', stderr: 'pipe' });
+    expect(await proc.exited).toBe(0);
+
+    const owner = statSync(probe).uid;
+    rmSync(probe, { force: true });
+
+    expect(owner).toBeGreaterThanOrEqual(1000);
+    expect(owner).not.toBe(process.getuid?.());
+  });
+
   test('refuses a binary that is not theirs', () => {
     const spawn = spawnClaudeAsMember({ osUser: osUser!, home: home! });
     expect(() =>