Add owner-mediated bwrap execution boundary

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06def-6490-7033-8448-2eab2d12ed44

workplans/SAND-WP-0014-owner-mediated-execution.md

@@ -0,0 +1,121 @@
+---
+id: SAND-WP-0014
+type: workplan
+title: "Owner-mediated governed bwrap execution"
+domain: infotech
+repo: sand-boxer
+status: active
+owner: codex
+topic_slug: owner-mediated-execution
+created: "2026-09-04"
+updated: "2026-09-04"
+state_hub_workstream_id: "b616d1cd-208f-5ecf-a4a0-a028396422c4"
+---
+
+# Owner-mediated governed bwrap execution
+
+Promote intake `GLAS-IN-0002` into sand-boxer ownership. Replace the unusable
+consumer-side `nsenter` hint with an owner-executed command boundary that remains
+bound to the sandbox and its governed consumer identity. A refused execution
+must never fall back to a host checkout or another extension.
+
+## Define the governed execution contract
+
+```task
+id: SAND-WP-0014-T01
+status: done
+priority: high
+state_hub_task_id: "1b4349de-7027-5f01-8deb-122772e1404d"
+```
+
+Define request/result schemas and evidence for exact actor/project/session/run
+binding, ready/active lifecycle, workspace confinement, declared network
+posture, value-free credential route references, bounded command duration, and
+bounded output.
+
+## Implement owner-mediated bwrap execution
+
+```task
+id: SAND-WP-0014-T02
+status: done
+priority: high
+state_hub_task_id: "59f9af7c-7cd7-5e86-849f-5dfc7a3a06ee"
+```
+
+Add manager, extension, CLI, and authenticated HTTP surfaces. Only `ext.bwrap`
+may execute in this slice. The extension launches an owner broker inside bwrap,
+uses the sandbox workspace as its working directory, starts commands with a sanitized
+environment, and fails closed if the recorded workspace is not the exact
+owner-managed sandbox directory.
+
+## Remove direct namespace-entry guidance
+
+```task
+id: SAND-WP-0014-T03
+status: done
+priority: high
+state_hub_task_id: "4fc7d747-13d5-58e7-b89e-b72e845515aa"
+```
+
+Stop publishing raw consumer-side `nsenter` commands. Reachability describes
+owner-mediated execution without exposing a misleading direct-attach route.
+
+## Verify unit and local namespace behavior
+
+```task
+id: SAND-WP-0014-T04
+status: done
+priority: high
+state_hub_task_id: "c7ada937-4430-59d7-b3a6-9f3f36e9a907"
+```
+
+Cover identity/state/TTL refusal, unsupported-extension refusal, exact workspace
+validation, sanitized environment, credential route references, timeout/output
+bounds, API authentication, lifecycle restoration, and teardown. Run the full
+repository check and, when host user namespaces permit it, a non-secret live
+bwrap command proof.
+
+Implemented and verified 2026-09-04. `make check` passes with 119 tests. The
+first live attempt proved that even the bwrap owner cannot reliably `setns`
+from the host on this kernel (`IPC: Operation not permitted`), so execution was
+moved to a small read-only broker launched inside the namespace and reached via
+an owner-only Unix socket. `make smoke-bwrap-exec` then passed: actor `agt`,
+project/session/run binding reached the command; cwd was the copied sandbox;
+the host-source sentinel was absent; the command created an artifact; the net
+namespace exposed only `lo` under declared `default: deny`, `egress: []`; no
+credential routes or values were present; and teardown reported `destroyed`
+with the workspace removed.
+
+## Prove one governed rein and coordinate consumers
+
+```task
+id: SAND-WP-0014-T05
+status: wait
+priority: high
+state_hub_task_id: "c6812fd4-bb7b-5be0-8344-a122496fe5bc"
+```
+
+With Glas and rein-aharness, run one real selected rein command through the
+owner API using an explicitly declared egress profile and catalog credential
+route. Prove that the source checkout is absent, retain value-free evidence,
+destroy the workspace, then update Glas readiness and Activity Core
+`ACTIVITY-WP-0032-T05`. Do not trigger the production pilot before readiness
+changes.
+
+This task depends on a reviewed Glas profile revision, the owner-fronted
+`rein-openweights-openrouter-approle` read, and a deployed sand-boxer owner
+service. No credential value belongs in this workplan or State Hub.
+
+## Acceptance criteria
+
+- Execution requires the recorded actor, project, session, and run identity.
+- Only a live, unexpired, ready sandbox can start a command; concurrent commands
+  are refused.
+- Command execution is argument-vector based, starts inside the copied sandbox
+  workspace, and has no host/source-checkout fallback.
+- `ext.bwrap` supplies its declared read-only runtime paths and enforces the
+  profile's network namespace. Evidence reports default policy and egress list.
+- Credential inputs are non-secret catalog route references only.
+- Duration and captured output are bounded, lifecycle state is restored, and
+  teardown remains idempotent.
+- Consumer-facing reachability no longer recommends direct `nsenter`.