docs(adr-0018): propose the sandboxed-host shell engine + phased development plan (#194)

[hartsock]

What this PR does

Adds ADR 0018 (Status: Proposed) — the decision record and phased development plan for #194's Option C: a sandboxed-host shell engine behind the ADR 0005 D2 seam.

The engine spawns a real POSIX shell (/bin/sh -c) as the root of the confined process tree with zero L2 enforcement — dynamic constructs ($(...), backticks, pipes, redirects) run because the kernel, not the parser, bounds their reach. Every restricted axis is either held by an L3 backend at the grain that backend honestly claims, or the engine refuses (reusing confinement_unenforceable / the ADR 0012 floor verbatim). Highlights:

• Engages the post-0005 L3 line directly: Seatbelt exec → Kernel (ADR 0014) means the engine can serve restricted-exec grants on macOS; Landlock gets ADR 0011 boundary grain; net gets the ADR 0015 fence + ADR 0016 proxy through the env seam; Tier-2 identity (ADR 0013 rootfs) is a later optional phase.
• Honesty is preserved in both directions: where the subset engine's interceptor would be the stronger real posture, the host engine refuses — no request ever gets a weaker real posture by switching engines. Where the jail holds everything at kernel grain, the engine is stronger than an interceptor (which is blind to a permitted child's interior).
• Selection is an ADR 0017 mechanism knob (shell.engine = "subset" | "host"), never authority; defaults reproduce today byte-for-byte.
• Six-phase development plan (skeleton → fs jail → exec → net → config knob → embedder adoption), one PR per phase, TDD.

ADR 0005 D3 (subset default) and D4 (brush-bridle-core deferred) are untouched; #20 stays dormant. Nothing waits on reubeno/brush#1184 anymore.

Test plan

Docs-only PR — no code paths change. just check green (pre-push gate). The ADR's Development-plan section defines the test spine for each implementation phase (envelope parity, fail-closed matrix across ADR 0012 floors, per-axis report assertions).

Out of scope

• Any engine implementation (phase 1 lands only after this ADR is accepted and phase issues are filed).
• Auto-fallback routing from the subset engine, per-dispatch engine override, PTY/interactive, Windows (all named in D5).
• Changes to ADR 0005's decisions — this extends, amends nothing.

Closes nothing; ratification of #194's Option C. Downstream adoption tracked at Gilamonster-Foundation/newt-agent#868.

🤖 Generated with Claude Code

[hartsock]

Closing as superseded — the sandboxed-host engine shipped through the renumbered line, all merged to main:

• ADR 0019 docs/adr/0019-sandboxed-host-shell-engine.md (Accepted) — docs(adr): 0019 — sandboxed-host shell engine (PROPOSED, for review) (#194) #198. This PR's 0018- number collides with the already-merged 0018-first-class-unbridle.md, which is why it was renumbered to 0019.
• Engine implementation — feat: sandboxed-host shell engine (ADR 0019, #194) #199 (HostShellTool, feature host-shell), with real-Landlock reality-check tests proving a $(...) dynamic construct runs while an out-of-scope write is kernel-denied.
• Weekly combinatorial regression sweep — ci: combinatorially-exhaustive weekly regression sweep (feature powerset) #200.

The six-phase plan's intent is captured in ADR 0019's Tracking section + issue #194; the engine landed in one focused PR rather than six phases. Nothing here is lost. Reopen if you'd rather land the phased-plan doc as history — but it would need to be renumbered off 0018 first.