Context
Split from #974 after the native provider-transport boundary was implemented in #983.
Today, run_command executes as a child of AgentSidecar. On macOS and Linux the whole sidecar remains wrapped by srt, so the shipping path retains a coarse kernel boundary. That is safe as an interim state, but it also means the raw command principal inherits the host process's authority domain. The target authority model requires shell execution to move into its own supervisor-owned, per-run worker before the whole-sidecar boundary can be narrowed.
Problem
Approval answers are interaction policy; they are not a kernel ceiling. A model-approved command must not inherit AgentSidecar secrets, state, listener authority, provider transport, or another command's grants merely because the sidecar launched it.
A generic "execution worker SDK" is explicitly out of scope. One-shot shell, long-lived ACP, and managed MCP/plugin processes have different lifecycles and contracts.
Required contract
- Electron main (or a dedicated native supervisor it owns) validates the executable, argv, environment, cwd, workspace roots, and grant revision before launch.
- Each invocation gets a fresh confined process tree with only its declared filesystem and process authority.
- The worker cannot read AgentSidecar state/secrets or write outside its granted roots.
- Network is denied by default. Any future network capability must be explicit, destination-bound, revocable, and use the host-selected route; it must not become ambient AgentSidecar egress.
accept-edits / auto remain user-interaction policy above the same kernel-enforced ceiling.- Cancellation, timeout, exit status, stdout, and stderr are bounded and deterministic.
- Concurrent commands cannot share grants, writable state, or process trees.
- Startup failure, crash, cancellation, and app shutdown terminate the entire worker tree and clean up its grants.
- The existing whole-sidecar
srt boundary stays in place until this and the other raw-runtime replacement gates are implemented and verified.
Acceptance evidence
- packaged macOS and Linux tests prove workspace access succeeds while HOME secrets, AgentSidecar
userData, non-granted paths, direct network, and sibling worker state remain inaccessible;
- tests cover approval, cancellation, output bounds, cleanup, and two concurrent invocations with different grants;
GRIDA-SEC-004 and the Desktop authority docs describe the landed worker boundary and residual platform limitations.
Non-goals
Context
Split from #974 after the native provider-transport boundary was implemented in #983.
Today,
run_commandexecutes as a child of AgentSidecar. On macOS and Linux the whole sidecar remains wrapped bysrt, so the shipping path retains a coarse kernel boundary. That is safe as an interim state, but it also means the raw command principal inherits the host process's authority domain. The target authority model requires shell execution to move into its own supervisor-owned, per-run worker before the whole-sidecar boundary can be narrowed.Problem
Approval answers are interaction policy; they are not a kernel ceiling. A model-approved command must not inherit AgentSidecar secrets, state, listener authority, provider transport, or another command's grants merely because the sidecar launched it.
A generic "execution worker SDK" is explicitly out of scope. One-shot shell, long-lived ACP, and managed MCP/plugin processes have different lifecycles and contracts.
Required contract
accept-edits/autoremain user-interaction policy above the same kernel-enforced ceiling.srtboundary stays in place until this and the other raw-runtime replacement gates are implemented and verified.Acceptance evidence
userData, non-granted paths, direct network, and sibling worker state remain inaccessible;GRIDA-SEC-004and the Desktop authority docs describe the landed worker boundary and residual platform limitations.Non-goals