feat(coding-agent): add sandbox-backed session foundations - #2025

Draft

sethkarten wants to merge 311 commits into

mainfrom

feat/sandbox-backed-sessions

This pull request is big! We're only showing the most recent 250 commits

Commits on Sep 2, 2026

fix(sandbox): PAB1 codec - descriptor-first grant read, strict URL path, branding cleanup
sethkarten
committed
5cadc60
fix(sandbox): PAB1 codec - descriptor snapshot recursion, exact byte views, URL IP rejection
sethkarten
committed
a356d98
fix(sandbox): PAB1 codec cleanup - unused copy helper, duplicate grant check, intrinsic detached detection, array rejection
sethkarten
committed
d21f53c
feat(coding-agent): B14c sandbox-fd-bootstrap-reader with framed bootstrap FD reader
sethkarten
committed
fceafa3
feat(coding-agent): B14c sandbox-fd-bootstrap-reader with framed bootstrap FD reader
sethkarten
committed
2f516b8
feat(coding-agent): B14c sandbox-fd-bootstrap-reader final correction
sethkarten
committed
dc19f39
feat(coding-agent): B14c sandbox-fd-bootstrap-reader final deadline + public-throw fix
sethkarten
committed
490b56a
feat(coding-agent): B14c sandbox-fd-bootstrap-reader — fix freshPayload erasure + fresh frozen adapter
sethkarten
committed
28c22a2
feat(coding-agent): B14c sandbox-fd-bootstrap-reader — fresh frozen adapter + proxy get-trap isolation
sethkarten
committed
6b45d5a
test: assert FD3 adapter isolation
sethkarten
committed
723a8db
feat: implement PAAR v1 pure manifest/framing codec
sethkarten
committed
cf71d64
fix: verify-agent corrections to PAAR v1 codec
sethkarten
committed
f51886e
fix: final correctness pass for PAAR v1 codec
sethkarten
committed
4be1299
fix: exact decoder guard, buffer erasure, offset-zero regressions
sethkarten
committed
a17f558
docs: record accepted bootstrap and PAAR foundations
sethkarten
committed
8cf7e6e
feat(daemon): add pure B03 delivery-index marker codec and recovery accumulator
sethkarten
committed
5a0058d
fix(daemon): strict-copy recovery, atomic transition, correct actions, query validation
sethkarten
committed
75f0dd6
fix(daemon): factory/query return frozen results, validateMarker complete schema, atomic commit, never throw
sethkarten
committed
5e8e926
feat(coding-agent): PAB1 streaming SSH-stdin bootstrap frame reader
sethkarten
committed
02325cc
fix(sandbox-stdin-frame): registration-flag-before-on, listener-table assertions
sethkarten
committed
657e2c1
fix(sandbox-stdin-frame): registration-flag throw correction + throw-during-on tests
sethkarten
committed
4beeaa5
docs: record delivery index and stdin framing
sethkarten
committed
e9ee8f6
feat(coding-agent): B14 SSH spawn spec codec -- pure frozen DTO codec
sethkarten
committed
ee7be76
fixup: contract-gap fixes for B14 SSH spawn spec codec
sethkarten
committed
e5e8b81
fixup: remove constructor read from isPlainObject, add getter-invocation tests
sethkarten
committed
56991ed
fixup: remove constructor read from isPlainObject, add getter-invocation tests
sethkarten
committed
4dd8790
docs: record accepted SSH spawn specification
sethkarten
committed
6efce89
fix(coding-agent): resolve TypeScript regressions from stdin frame reader integration
sethkarten
committed
1d63a72
test: assert hostile SSH env rejection
sethkarten
committed
af83a78
test: type hostile SSH specification inputs
sethkarten
committed
a7add61
docs: refresh sandbox sessions integration baseline
sethkarten
committed
d211013
feat(coding-agent): add immutable journal publication
sethkarten
committed
8bd83db
docs: record immutable journal publication
sethkarten
committed
db70c4a
feat(coding-agent): add immutable delivery marker publication
sethkarten
committed
df846c0
docs: record immutable delivery publication
sethkarten
committed
0460b34
feat(coding-agent): add one-use sandbox relay upgrade auth
sethkarten
committed
a497629
docs: record accepted upgrade authentication
sethkarten
committed
8b0be96
feat(coding-agent): show sandbox execution metadata
sethkarten
committed
1ccb524
docs: record Agents View metadata
sethkarten
committed
07e87af
feat(coding-agent): normalize sandbox bootstrap stdin
sethkarten
committed
4a8962b
docs: record stdin normalization boundary
sethkarten
committed
ac32983
feat(coding-agent): write sandbox credential frames safely
sethkarten
committed
3f17cb6
docs: record credential write ownership
sethkarten
committed
ed64498
feat(coding-agent): add hosted subagent port boundary
sethkarten
committed
2da8b43
docs: record hosted subagent boundary
sethkarten
committed
1a03d46
feat(coding-agent): recover durable remote host records
sethkarten
committed
9df8a3d
docs: record bounded journal recovery
sethkarten
committed
86d9fa0
docs: record sandbox session correction tracks
sethkarten
committed
f10f66b
feat(coding-agent): add sandbox and sandbox_options to rlm.spawn kwargs (B08)
sethkarten
committed
26ffef3
feat(coding-agent): add sandbox and sandbox_options to rlm.spawn kwargs (B08)
sethkarten
committed
f6ede58
docs: record RLM sandbox option integration
sethkarten
committed
858ee7d
feat(sandbox): B14 SSH process monitor with exhaustive adversarial tests
sethkarten
committed
169c295
fix(sandbox): track admission settlement, preserve terminal events on subscribe backout, remove any
sethkarten
committed
7fd5770
fix(sandbox): intrinsic Promise.then call, own-then brand validation, adversarial tests
sethkarten
committed
2da8baa
test(sandbox): satisfy monitor repository checks
sethkarten
committed
784d41f
fix(sandbox): type-check SSH monitor boundary
sethkarten
committed
55fe678
docs: record accepted SSH monitor and replacement tracks
sethkarten
committed
c6a6ff4
fix(sandbox): scrub credentials after terminal relay auth
sethkarten
committed
0afbaac
feat(rlm/paar): add Python PAAR manifest codec with safe-int parity
sethkarten
committed
905a492
paar: salvage Python codec as pure manifest codec only (no streaming/parser)
sethkarten
committed
dc2e175
docs: update sandbox session integration evidence
sethkarten
committed
298f683
test(paar): run Python codec coverage in CI
sethkarten
committed
9c5275e
feat(sandbox): add Node Writable credential adapter v2
sethkarten
committed
31d6ded
fix(sandbox): preserve exact Node writable ownership
sethkarten
committed
08b890c
feat(sandbox): add bounded PAAR streaming verifier
sethkarten
committed
32b1db6
feat(relay): add serialized durable relay store
sethkarten
committed
c72e622
docs: record durable store and artifact review
sethkarten
committed
48bccff
fix(relay): reject aliased durable store capabilities
sethkarten
committed
6a5c715
docs: accept durable relay store
sethkarten
committed
7f88944
feat(relay): expose recovered journal record in frame state
sethkarten
committed
5e365f4
feat(relay): add ordered durable delivery
sethkarten
committed
15ec561
test(relay): cover exact ACK replay after restart
sethkarten
committed
b03e9d8
fix(relay): reject application-context reentry
sethkarten
committed
3c7ad6c
docs: record ordered durable relay
sethkarten
committed
aa4f5d1
feat(relay): add durable agent-message application
sethkarten
committed
cf99a13
test(relay): compose durable agent-message delivery
sethkarten
committed
63a1b0a
docs: record durable agent-message boundary
sethkarten
committed
70c256d
feat(runtime): build verified PAAR archives
sethkarten
committed
4cd92e6
docs: accept verified PAAR builder
sethkarten
committed
6c6030e
feat(runtime): install verified PAAR archives
sethkarten
committed
5f753b0
docs: accept verified PAAR installer
sethkarten
committed
2380fc7
feat(coding-agent): add owned Node SSH session adapter
sethkarten
committed
789dead
docs: record accepted Node SSH session adapter
sethkarten
committed
b034e68
docs: reject unsafe offline runtime composer v3
sethkarten
committed
706a3e5
docs: reject recursive FD3 wrapper v5
sethkarten
committed
522dde8
docs: reject incomplete observation persistence v6
sethkarten
committed
7c7aadc
docs: reject unsafe listener server v9
sethkarten
committed
9418857
docs: reject unsafe runtime and bridge replacements
sethkarten
committed
5a7fdc8
docs: reject observation application v7
sethkarten
committed
eaaf6ab
docs: reject listener ownership core v10
sethkarten
committed
0a1f071
feat(coding-agent): add owned FD3 bootstrap bridge
sethkarten
committed
e1209d8
docs: record accepted FD3 bootstrap bridge
sethkarten
committed
118b75d
docs: reject listener ownership core v11
sethkarten
committed
eb550d5
docs: reject observation application v8
sethkarten
committed
46a4ac6
docs: reject offline runtime composer v5
sethkarten
committed
a7edbcc
feat(coding-agent): compose pinned offline runtimes
sethkarten
committed
dd486fe
docs: record accepted offline runtime composer
sethkarten
committed
268d094
feat(relay): add canonical observation records
sethkarten
committed
cdd45df
docs: record accepted observation codec
sethkarten
committed
26a2388
feat(relay): add durable observation application
sethkarten
committed
c71c2a8
docs: record accepted durable observation application
sethkarten
committed
83a1cce
docs: reject unsafe B03 scanner replacement
sethkarten
committed
58dbc76
feat(relay): persist durable observations on Node
sethkarten
committed
d86e7d6
docs: record accepted observation backend
sethkarten
committed
d65bb91

Commits on Sep 3, 2026

feat(coding-agent): add single-use sandbox relay listener core
sethkarten
committed
9d40331
docs: record accepted sandbox relay listener core
sethkarten
committed
c6bb019
feat(coding-agent): add Node sandbox relay adapter
sethkarten
committed
cf826a0
docs: record accepted Node relay adapter
sethkarten
committed
c07f16d
docs: reconcile sandbox sessions implementation status
sethkarten
committed
b7c67d3
feat: add dependency-free FD3 child readiness monitor
sethkarten
committed
adf4057
docs: record accepted FD3 readiness monitor
sethkarten
committed
0c8cf15
feat(coding-agent): add Node FS backend for B03 DurableRelayStore
sethkarten
committed
bbe38dc
docs: record accepted Node B03 backend
sethkarten
committed
213a4d8
test: type Node B03 backend assertions
sethkarten
committed
5430f0c
feat: implement B10 durable target inbox core
sethkarten
committed
000a5b2
fix: harden durable target inbox lifecycle
sethkarten
committed
b43ed63
fix: preserve target inbox recovery failures
sethkarten
committed
5d0738a
docs: record accepted durable target inbox
sethkarten
committed
2f278bf
feat: add owned fd3 runtime launcher
sethkarten
committed
2cd1471
docs: record accepted fd3 runtime launcher
sethkarten
committed
798de25
feat(coding-agent): add numeric FD3 runtime dispatch
sethkarten
committed
64a196b
docs: record numeric FD3 runtime integration
sethkarten
committed
509ea39
fix: DurableTargetInbox semantic replay returns current transport frameId
sethkarten
committed
87ff033
test(coding-agent): tighten cross-transport inbox replay coverage
sethkarten
committed
0c223e3
style(coding-agent): format inbox replay test
sethkarten
committed
5c563be
feat(coding-agent): add durable target inbox authorization and dispatch
sethkarten
committed
5a92fa2
docs: record accepted B10 authorization and transcript dispatch
sethkarten
committed
7fc4499
feat(coding-agent): add durable provider call record codec
sethkarten
committed
ac0e313
docs: record accepted provider call codec
sethkarten
committed
814fda8
feat(coding-agent): compose production FD3 wrapper
sethkarten
committed
af3d31e
feat(coding-agent): apply ordered target inbox admission
sethkarten
committed
304e349
docs: record FD3 wrapper and ordered target app
sethkarten
committed
19d3a1d
feat(coding-agent): add hosted RLM runtime port
sethkarten
committed
98189de
docs: record hosted runtime boundary review
sethkarten
committed
09b93ec
feat(coding-agent): adapt hosted port to ordered relay
sethkarten
committed
8618dc2
feat(coding-agent): recover provider call journals
sethkarten
committed
8ed8977
feat(coding-agent): scan durable session transcripts
sethkarten
committed
c9efecd
docs: record durable transport recovery layers
sethkarten
committed
ca6b5ab
docs: track production composition corrections
sethkarten
committed
5841b57
docs: replace stalled hosted runtime track
sethkarten
committed
48a77dc
docs: replace unsafe daemon relay composition
sethkarten
committed
c92e8e0
docs: reject unsafe provider store candidate
sethkarten
committed
2d13a5c
docs: replace stalled sandbox codec track
sethkarten
committed
635adb9
docs: restart target inbox registry cleanly
sethkarten
committed
332b146
docs: record clean composition baseline
sethkarten
committed
be965f8
fix(coding-agent): close raw sandbox identity exposure gap
sethkarten
committed
91d9532
docs: record opaque identity and rejected corrections
sethkarten
committed
0d8fb97
Add SandboxCommandRecordV1 codec with four-variant encode/decode
sethkarten
committed
f0c47a3
docs: record command durability and correction restarts
sethkarten
committed
8bc1734
feat: add permanent target inbox registry
sethkarten
committed
27ef4c8
docs: record registry integration and durability reviews
sethkarten
committed
43f362e
docs: record registry root verification
sethkarten
committed
7578963
feat: add remote relay target dispatcher
sethkarten
committed
effd481
docs: record relay dispatcher and durability audits
sethkarten
committed
e467dba
fix(hosted-rlm-run-controller): raw semantic values for createHostedRlmRuntimePort adapter
sethkarten
committed
71a1631
docs: record hosted controller integration
sethkarten
committed
04265dd
feat(sandbox): implement SandboxEventOutboxRecordV1 codec with true recursive fresh freezing
sethkarten
committed
76d0035
docs: record event codec and provider audit
sethkarten
committed
d7879a5
style: format sandbox event codec
sethkarten
committed
a1a590a
feat: compose bidirectional target inbox entries
sethkarten
committed
2ee56f0
docs: record bidirectional relay composition
sethkarten
committed
92b2782
docs: record runtime and provider boundary audits
sethkarten
committed
d69f981
fix: erase owned provider codec bytes
sethkarten
committed
e4274e3
docs: record provider codec hardening
sethkarten
committed
e6020ec
docs: reconcile active sandbox session tracks
sethkarten
committed
3333f6f
feat: add opaque sandbox lifecycle recovery
sethkarten
committed
6701cd2
docs: record lifecycle recovery integration
sethkarten
committed
92812ad
docs: reconcile sandbox sessions implementation roster
sethkarten
committed
069e6f0
feat(rlm): enforce hosted and branded local runtime union
sethkarten
committed
191695e
docs: record accepted RLM runtime union
sethkarten
committed
80dee87
docs: reconcile active sandbox correction tracks
sethkarten
committed
e0fc555
amend command recovery: uncertain/alias, sync guard, invalid vs accessor,
sethkarten
committed
a32f01f
fix: rewrite B14 sandbox event-outbox recovery - coherent cleanup, exact byte transfer, event state sequencing
sethkarten
committed
caecc4e
docs: record accepted command and event recovery
sethkarten
committed
14b2316
fix(store): frozen arrays, codec-normalize with proof, erase split, ownership, close fixes
sethkarten
committed
39c62a7
fix(daemon): align provider recovery receipts
sethkarten
committed
180a7f6
docs: record accepted provider store
sethkarten
committed
d3fdd68
docs: reconcile sandbox store tracks
sethkarten
committed
9115d88
docs: record durability validation stage
sethkarten
committed
fa2442a
docs: refresh sandbox integration baseline
sethkarten
committed
06c2b15
docs: record durability candidate audits
sethkarten
committed
4d2e620
feat(sandbox): B14 durable sandbox command store
sethkarten
committed
c50e618
feat(daemon): add B14 sandbox-event-outbox store with factory, FIFO, recovery, and tests
sethkarten
committed
3f62d7d
docs: record accepted command and event stores
sethkarten
committed
d7488f0
docs: map sandbox domain application topology
sethkarten
committed
fc1b913
docs: reconcile sandbox runtime correction tracks
sethkarten
committed
cf69fee
feat(daemon): restart-safe provider delivery evidence extension
sethkarten
committed
f33e65f
fix(daemon): update dispatcher SEND_VALUE_KEYS for journalReceipt, harden validateReceipt
sethkarten
committed
115bbc3
fix(relay): correct rejected ACK semantics, scanComplete, outgoing revalidation
sethkarten
committed
4e0d463
fix(relay): bind queried delivery evidence
sethkarten
committed
cbc0668
fix(relay): scan full durable journal range
sethkarten
committed
c8eaea9
docs: record accepted relay delivery evidence
sethkarten
committed
0499ee5
docs: correct workspace artifact contract
sethkarten
committed
a711653
feat(daemon): add relay application multiplexer v1 with ownership-first close, alias detection, FIFO, deep-fresh envelope, 56 tests
sethkarten
committed
d35af25
fix(daemon): correct relay application multiplexer v1 — close, clone, freeze, uncertainty, tests
sethkarten
committed
3596ebf
fix(daemon): multiplexer cast-free, cross-instance reentry, Proxy close uncertainty, 77 tests
sethkarten
committed
7005713
fix(daemon): audit corrections on 9760612c2 — null/primitive INVALID_ARGUMENT, symbol data vs accessor, raw-object-only dedup, bounded sub-owner capture, 94 tests
sethkarten
committed
7e5b9f4
fix(daemon): close multiplexer ownership audit gaps
sethkarten
committed
8c8dec7
fix(daemon): reject multiplexer proxy without reflection
sethkarten
committed
c6d8652
docs: record accepted relay multiplexer
sethkarten
committed
8aaa1ae
docs: reconcile sandbox session implementation
sethkarten
committed
452ffca
docs: record runtime integration blockers
sethkarten
committed
7a85993
feat(daemon): add replayUndelivered boundary to ProviderCallStoreCapability
sethkarten
committed
48775e6
fix(daemon): correct replayUndelivered tests — safe narrowing, >64 pagination, factory recovery, rename concurrent
sethkarten
committed
2c0bb6c
docs: record provider restart index
sethkarten
committed
58f78e7
feat(daemon): add session-backed sandbox command effects
sethkarten
committed
97ea053
docs: record command effect port
sethkarten
committed
ae472cf
feat(daemon): add node-sandbox-journal-backend with zero-transfer security, mutation detection, and full integration tests
sethkarten
committed
eae547f
fix(daemon): enforce _taFill erasure preflight and scanJournalDir uid filtering
sethkarten
committed
ac71982
fix(daemon): add post-publish prototype verification and malicious-publisher test
sethkarten
committed
47418e2
docs: record production journal runtime
sethkarten
committed
545e1c4
feat: sandbox command relay application v1
sethkarten
committed
db87fb7
fix: correct rejected sandbox command relay application v3
sethkarten
committed
5b8899f
fix: final corrections for sandbox command relay v3
sethkarten
committed
476eba5
fix: narrow clean-up — remove unused constants, replace misleading tests
sethkarten
committed
da5f1ce
fix: capture all seven AgentSession methods at factory; fix reentry/hostile tests
sethkarten
committed
522680b
fix: zero casts — capture all seven session methods at factory with descriptor validation
sethkarten
committed
d16481f
docs: accept sandbox command relay application
sethkarten
committed
7da324d
feat: implement pure PAWS manifest codec v3
sethkarten
committed
263f52c
feat: implement pure PAWS manifest codec v3
sethkarten
committed
637d379
fix: enforce header-only decode in pure PAWS manifest codec
sethkarten
committed
0b5fee2
fix: address all pure PAWS manifest codec audit items
sethkarten
committed
e09c49f
fix: guard empty-manifest order validation, erase both byte buffers on conflict
sethkarten
committed
ef1cb68
fix: proxy-safe entry admission, backing buffer validation, strict gate compliance
sethkarten
committed
b185cc3
fix: reject C1 control characters in PAWS paths (U+0080-U+009F)
sethkarten
committed
5d8611b
fix: canonical JSON validation in snapshot and changeset decode, eliminate subarray fallback
sethkarten
committed
b7b4b94
fix: pass manifestStr for canonical JSON validation, remove typed-array byte comparisons
sethkarten
committed
afb329a
fix: replace live reencoded.byteLength with captured intrinsic getter
sethkarten
committed
93c4538
fix: apply Biome formatting to satisfy strict check
sethkarten
committed
e88e2d4
docs: accept pure PAWS manifest codec
sethkarten
committed
580bf2b
docs: record integrated durability matrix
sethkarten
committed
6fcaff9
feat(sandbox): add durable local agent-message dispatcher
sethkarten
committed
e624b82
docs: record sandbox local message dispatcher
sethkarten
committed
82d985a
docs: reconcile hosted composition corrections
sethkarten
committed
d093e7e
Merge origin/main into feat/sandbox-backed-sessions
sethkarten
committed
fe906bf
docs: record sandbox sessions draft PR
sethkarten
committed
64e40ba
feat(daemon): classify side-specific relay ingress
sethkarten
committed
c27957b
test: document best-effort cleanup catches
sethkarten
committed
9c02300
docs: reconcile sandbox sessions implementation status
sethkarten
committed
e3ae745
Merge remote-tracking branch 'origin/main' into feat/sandbox-backed-sessions
sethkarten
committed
99dd8af
docs: record current main merge
sethkarten
committed
893a994
feat: add sandbox provider relay client
sethkarten
committed
719d90c
feat: add durable relay application gate
sethkarten
committed
4c9a315
docs: record accepted relay integrations
sethkarten
committed
7c35944
fix: sequential reverse-order close for owners; add order, aliasing, and uncertainty tests
sethkarten
committed
e51860e
feat: coordinate durable home provider calls
sethkarten
committed
a0a84bf
fix: validate Node 22 context promises exactly
sethkarten
committed
5ab7744
docs: record provider and Promise foundations
sethkarten
committed
77c3dc5
fix: synchronize daemon schema identity
sethkarten
committed
af04d8c
feat: verify PAWS archives with stable streaming evidence
sethkarten
committed
4de6616