Add bounded stdin to owner execution

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06def-6490-7033-8448-2eab2d12ed44

docs/extension-sdk.md

@@ -19,11 +19,13 @@ Optional (checkpoints): `supports_snapshots()`, `snapshot(handle)`,
 
 Optional (owner-mediated execution): `supports_execution()`, then
 `execute(handle, command, credential_route_refs, execution_context,
-timeout_seconds, max_output_bytes)`. The default implementation fails closed.
+timeout_seconds, max_output_bytes, stdin_text)`. The default implementation fails closed.
 `ext.bwrap` is the reference implementation. An executing extension must
 validate that its workspace belongs to the exact sandbox handle, sanitize the
 child environment, use an argument vector, enforce the requested bounds, and
 must not fall back to a host workspace.
+Bounded stdin is content-bearing and must never be included in lifecycle logs or
+execution evidence.
 
 ### Base class
 

docs/integrations/glas-harness.md

@@ -43,6 +43,20 @@ identity mismatch, non-ready or expired state, concurrent execution, and every
 extension without an owner execution implementation. It never retries against
 the host source checkout.
 
+For the local owner transport, retain these values from gateway resolution:
+
+| sand-boxer field | Glas source |
+|---|---|
+| `consumer.actor` | `ExecutionRequest.actor` |
+| `consumer.project` | `ExecutionRequest.project` |
+| `consumer.run_id` | resolved `request_id` |
+| `credential_route_refs` | exact selected `HarnessProfile.credential_route_refs` |
+| `timeout_seconds` | selected profile limit |
+
+Use bounded `stdin_text` with an in-sandbox writer command to create the private
+task file under `.git`; sand-boxer does not echo stdin in the result or lifecycle
+evidence. Local transport must not write the task file through host `Path` APIs.
+
 ## Ownership
 
 | Concern | Owner |

docs/meta-framework.md

@@ -225,6 +225,11 @@ sand-boxer commits to:
    workspace validation, sanitized environment, bounded duration/output, and no
    host-checkout or alternate-extension fallback
 
+Owner execution also accepts up to 1,000,000 UTF-8 bytes of `stdin_text`. It is
+delivered only to the child process and excluded from results and lifecycle
+events, allowing a harness to create prompt/task files inside the sandbox
+without putting their content in argv or writing through the host workspace.
+
 sand-boxer does **not** provide intent-aware egress filtering in v1.
 
 ---

docs/runbooks/profile-bwrap-local.md

@@ -61,6 +61,7 @@ Call `POST /v1/sandboxes/SANDBOX_ID/exec` with a bearer token and this body:
     "run_id": "run-456"
   },
   "credential_route_refs": [],
+  "stdin_text": null,
   "timeout_seconds": 30,
   "max_output_bytes": 65536
 }
@@ -68,6 +69,7 @@ Call `POST /v1/sandboxes/SANDBOX_ID/exec` with a bearer token and this body:
 
 The bearer authenticates access to the owner service; exact consumer identity
 matching additionally binds the command to the existing sandbox grant.
+`stdin_text` is capped at 1,000,000 UTF-8 bytes and is not returned or logged.
 
 ## Destroy