test(enforcement): behavioral proof for ENFORCE_SIGNAL gate promotion

[ErenAri]

What

Closes the one remaining Tier-3 validation gap. Gate promotion (#214) and the signal-fallback arms (#212) were unit- and load-tested, but the end-to-end no-BPF-LSM enforcement behavior had no behavioral test.

tests/enforcement/signal_fallback_proof.sh exercises the agent's real no-BPF-LSM code path on any kernel via the AEGIS_LSM_PATH test seam (kernel_features.cpp reads it instead of /sys/kernel/security/lsm). The agent then believes BPF-LSM is absent and attaches only the tracepoints — exactly what happens on a genuinely no-BPF-LSM kernel. The tracepoint + bpf_send_signal mechanism is kernel-version-independent.

Asserts (end-to-end)

• Gate promotes: runtime_state == ENFORCE_SIGNAL, audit_only == false
• No-Pretend: enforce_capable == false (the BPF_LSM_DISABLED blocker is still reported)
• Enforcement fires: a denied open() from a non-exempt cgroup is killed by a signal (exit > 128). Without the signal the open would succeed (no LSM -EPERM on this path), so a signal-kill is unambiguous proof.

Verified locally (6.17)

PASS gate promoted to ENFORCE_SIGNAL
PASS audit_only=false (enforcing, not degraded)
PASS No-Pretend: enforce_capable=false (BPF_LSM_DISABLED honest)
PASS denied open killed by signal (exit=143)
signal-fallback proof: ALL PASS

Wired into kernel-matrix.yml (runs on every matrix kernel; exit 77 = honestly skipped when not root / no systemd-run). GUARANTEES.md updated — gate-promotion behavior is now behaviorally proven, not a follow-up.

🤖 Generated with Claude Code