Enforce read-only workflow Agent authority

[taras]

Story

As a workflow user, I want Agents under xmd workflow to be mandatorily read-only, so Agent judgment can inspect retained work without mutating Workspace, Git, journal, or external systems outside durable XMD effects.

Contract

The workflow host enforces a read-only ceiling through its provider permission bridge, provider-native sandbox, environment policy, network policy, and filesystem view. Document components, repository .codex/.claude configuration, and prompt content cannot raise that authority. A provider that cannot enforce the contract fails before Prompt execution.

Native Agent processes receive disposable read-only materializations of a logical Workspace root. These views have no write-back path. Provider caches and session state remain separate from Workspace data.

Agent.AddDir explicitly registers a Workspace-relative directory with the Agent session. Registration is ordered and may occur between prompts:

<Agent>
  <Agent.AddDir path={apiWorktree} />
  <Prompt>Review the API.</Prompt>
  <Agent.AddDir path={sdkWorktree} />
  <Prompt>Compare the SDK.</Prompt>
</Agent>

Lexical Dir changes cwd for XMD operations; it does not register Agent access. Repository defaults may provide .codex and .claude configuration inside the read-only view, subject to the same authority ceiling.

Agent session mappings are retained with the WorkflowRun. Completed replay restores Prompt results without launching an Agent. Partial replay reattaches a compatible provider session when supported or reports explicit incompatibility.

Acceptance

• Agents cannot write Workspace files, Git metadata, journal storage, or host paths.
• Agents cannot invoke workflow-owned Git/forge effects, native commands, undeclared environment values, secrets, or default network destinations.
• Agent.AddDir registers explicit paths in document order and has no special first-directory behavior.
• Lexical Dir and Agent.AddDir remain distinct operations.
• .codex and .claude defaults can configure the Agent but cannot raise host authority.
• Unsupported providers fail before Prompt execution.
• Scope-owned processes, sessions, streams, and materializations finish teardown on success, failure, and cancellation.
• Session identity and compatible resumption survive process restart without hidden transcript-only state.
• Generated file changes use Evaluate Agent-generated XMD through a constrained allowlist #369 rather than a writable Agent channel.

Dependencies

• Contain filesystem access at the provider boundary #227 defines filesystem containment claims.
• Add named Repository and Worktree composition #293 supplies retained Repository and Worktree paths.
• Add workflow inspection, cancellation, suspension, and deletion #367 supplies lifecycle ownership and cancellation.
• PR 📝 Specify retained workflow Workspaces #358 supplies the workflow Agent boundary.
• End goal: Document adversarial implementation workflow WIP #181.