Add owner-mediated bwrap execution boundary

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06def-6490-7033-8448-2eab2d12ed44

docs/meta-framework.md

@@ -92,7 +92,7 @@ Extends the `build-agent` self-register pattern: generic sandbox identities carr
 | `recreate` | Destroy and reprovision from stored seed | **Yes** |
 | `destroy` | Idempotent teardown | **Yes** |
 | `snapshot` / `restore` | Checkpoint workspace | **Yes** (compose-ssh, saas-stub) |
-| `exec` | Run command in sandbox | Harness-owned via SSH (glas-harness) |
+| `exec` | Owner-mediated command in a local bwrap sandbox | **Yes** (`ext.bwrap` only) |
 
 HTTP surface (optional v0; CLI calls core library directly):
 
@@ -107,6 +107,7 @@ HTTP surface (optional v0; CLI calls core library directly):
 - `PATCH /v1/sandboxes/{id}/ttl` — extend TTL
 - `POST /v1/sandboxes/expire` — TTL reap (query `apply=true`)
 - `GET /v1/sandboxes/{id}/reachability` — enriched descriptor + SSH one-liner
+- `POST /v1/sandboxes/{id}/exec` — authenticated owner-mediated bwrap command
 
 ---
 
@@ -133,6 +134,12 @@ Tunnel metadata is enriched from profile `reachability` and environment:
 sand-boxer **does not** bring tunnels up. Consumers use ops-bridge (MCP or
 `bridge` CLI) to attach SSH routes; the descriptor is a pointer only.
 
+For `ext.bwrap`, reachability is not an invitation to enter the recorded PID.
+The report contains `execution.mode: owner-mediated`; callers use `sandboxer
+exec` when running as the sandbox owner or the authenticated HTTP exec endpoint
+when calling the resident owner service. Direct consumer-side `nsenter` is not
+supported.
+
 `secret_refs` from `profile.setup` are resolved at the provision boundary and
 passed to the extension handle — they never appear on `SandboxStatus` or State
 Hub events.
@@ -159,6 +166,8 @@ consumer:
 
 sand-boxer records attribution on every lifecycle event. It does not interpret
 agent intent or authorize the caller — flex-auth owns authorization when enforced.
+An exec request must nevertheless repeat this block exactly. Any actor, project,
+session, or run mismatch is refused before extension dispatch.
 
 ---
 
@@ -170,6 +179,8 @@ Each extension implements:
 provision(profile, inputs, placement) → SandboxHandle
 wait_ready(handle) → Reachability
 teardown(handle) → CleanupReport
+supports_execution?() → bool
+execute?(handle, argv, credential_route_refs, execution_context, bounds) → CommandResult
 estimate_cost?(profile, duration) → MeterQuote   # optional; SaaS only
 ```
 
@@ -210,6 +221,9 @@ sand-boxer commits to:
    from Railiance01 production
 4. **Observable lifecycle** — every transition attributed to `adm` / `agt` / `atm`
 5. **Honest limits** — allowed tool paths can be abused by compromised agents
+6. **Fail-closed local execution** — exact identity/state/TTL binding, owner-managed
+   workspace validation, sanitized environment, bounded duration/output, and no
+   host-checkout or alternate-extension fallback
 
 sand-boxer does **not** provide intent-aware egress filtering in v1.
 
@@ -226,4 +240,4 @@ sand-boxer does **not** provide intent-aware egress filtering in v1.
 | SSH certificates | ops-warden |
 | Workstream / task state | state-hub |
 
-See `docs/integrations/` for per-sibling contracts.
+See `docs/integrations/` for per-sibling contracts.