Adopt nono's phantom-token credential-proxy pattern for Phase-1 broker-not-mount

[rappdw]

Follow-up to the milestone-#12 evaluation (docs/security/CREDENTIAL_BROKER_EVALUATION.md), informed by nolabs-ai/nono — a shipped reference implementation of broker-not-mount (see docs/security/nono-comparison.md).

The borrow

nono keeps the real credential out of the sandbox entirely via a localhost reverse proxy + phantom token:

• Agent gets a per-session 256-bit phantom token (NONO_PROXY_TOKEN), never the real key.
• Agent calls http://127.0.0.1:<port>/<service>/...; the proxy validates the phantom token, swaps in the real credential, forwards over TLS. SDKs steered via OPENAI_BASE_URL/ANTHROPIC_BASE_URL — no agent code change.
• cmd:// lazy host-side capture: durable creds (e.g. gh auth token, an OAuth refresh) run on the host on first use, cached with a TTL; the sandbox only ever sees the phantom token.
• L7 endpoint_rules scope a credential to specific method+path (closes exfil-to-allowed-host, THREAT_MODEL R3).

This is concretely sandy's eval A1 (durable cred stays host-side) and A2 (proxy-side injection). It also confirms the eval's central trade-off: to inject at the proxy you must terminate TLS — nono's proxy is TLS-terminating, whereas sandy's egress proxy is deliberately passthrough (proxy/config.go "never terminate"). So this is not a free extension of the existing sidecar; it's the deliberate no-MITM-invariant fork the eval's A2 describes.

Scope for this issue (Phase-1 slice)

1. Spike a host-side credential broker exposing a localhost endpoint the container reaches (through the existing egress-proxy topology or a dedicated localhost forward), handing the container a phantom/short-lived token, not the raw key.
2. cmd://-style capture for the durable credential (start with gh auth token and the Claude/Gemini OAuth refresh-token → short-lived access-token case the eval's A1 already identified as the highest-value, no-provider-cooperation win).
3. Decide the injection point: A1 (broker hands a short-lived token in, agent still makes the request) vs A2 (proxy injects, agent never holds it → requires the TLS-terminating fork). A1 first.
4. Record the resolved posture (which creds brokered vs. still mounted) in sandy-session.json, mirroring the effort field.

Explicitly out of scope (track separately)

• nono's isolation primitive (Landlock/seccomp-notify) — sandy's container is the stronger boundary; borrow the credential layer only.
• Full SPIFFE/per-tool child sandboxes — longer-horizon.

References

• docs/security/nono-comparison.md, docs/security/CREDENTIAL_BROKER_EVALUATION.md (A1/A2), research/credential-broker-cb4a.md.

[rappdw]

New corroborating evidence (from the Aug-2026 landscape pass — see research/sandbox-landscape-synthesis-2026-08.md and INTEGRATION-OPPORTUNITIES-2026-08.md):

The phantom-token pattern isn't just a nono idea — Anthropic's own sandbox-runtime (srt) implements the same "credential masking / sentinel substitution" mechanism independently (swap a sentinel for the real secret only on egress to an approved host, with SigV4 re-signing for AWS). Two independent, credible implementations converging on the same design is strong signal this is the right shape for the broker.

One important scoping caveat this pass surfaced — split the credential space in two:

• git / gh / SSH credentials → this is the already-planned Family-2 Unix-socket broker (agent never holds the token; a host-side shim performs the credentialed op over a bind-mounted socket). No TLS termination required. This is the buildable Phase-1 target and where the phantom-token framing maps cleanly.
• LLM API keys (ANTHROPIC_API_KEY, etc.) → true phantom-token masking for these requires the proxy to terminate TLS to inject the real key at the upstream hop — which violates sandy's never-terminate-TLS invariant (the whole reason the proxy is SNI-demux, not MITM). So the API-key masking case should be explicitly scoped OUT of Phase-1 and flagged as blocked by the TLS invariant unless sandy ever revisits it (a 2.0-scale decision).

Net: prioritize the socket-broker (git/gh/SSH) as Phase-1 exactly as designed; treat "mask the LLM API key too" as a separate, invariant-blocked item, not part of this issue's scope.

[rappdw]

Near-term, broker-free slice split out as #130: SANDY_SUSPICIOUS for particularly-untrusted workspaces — strip the OAuth refresh token and mount an access-token-only credential, so an exfiltrated copy expires in hours instead of being permanent+renewable. This is the pre-broker delivery of this issue's A1 "OAuth refresh → short-lived access token" win (no host daemon, no TLS termination); #130 ships first and de-risks the A1 flow here.