feat(sdk): isolate hosted Babysitter capability

docs/BABYSITTER-CATALOG-HANDOFF.md

@@ -19,11 +19,75 @@ exact live `babysit` label and the bound session/head. Permission declarations
 are not enforcement. Export success is byte verification, not execution approval.
 
 The native package source is `extensions/babysitter` (see its README for the
-turn contract). It is unreleased and cannot execute: #549 still refuses it,
-the SDK context has no `capabilities.cloud.babysitterTurn`, and its
-`compat` requires a surface release after 2.0.25 that routes `labeled`,
-`unlabeled`, and `ready_for_review`. Export it only from a reviewed, merged
-commit.
+turn contract). Flows 2.0.26 is published, but the package cannot execute
+through the generic executor: #549 still refuses it. The SDK now has a separate Linux-only
+capability sandbox that injects exactly
+`capabilities.cloud.babysitterTurn.queue` without exposing the base context,
+workspace, environment credentials, network, helpers, MCP, or harnesses. It is
+not wired to hosted dispatch and must not be treated as enablement. The package's
+`compat` requires the published 2.0.26 Surface/SDK release that routes
+`labeled`, `unlabeled`, and `ready_for_review`. Export it only from the reviewed
+release commit pinned below. The Software Factory flow's own independently
+versioned header remains `2.0.22`; a regression requires the hosted identity to
+equal the identity obtained from that exact reviewed source.
+
+The sandbox contract is deliberately narrower than #442. It re-verifies the
+complete lock-backed installation and every manifest, binds it to the exact
+reviewed Software Factory source in the same `loadHostedExtensionRuntime` generation, detects
+cross-extension route ambiguity, accepts only the exact published Babysitter
+ref/digest/manifest and native permission profile, imports the entry only
+inside Linux bubblewrap plus Node's
+permission model under inherited 16 GiB address-space and 3 GiB
+data/anonymous-memory hard limits, mounts a
+minimal trusted Surface facade (`flow`, `github`,
+and `getFlowDefinition`) from six integrity-pinned private runtime files instead
+of the general helper runtime, checks
+normalized input against non-serializable verified dispatch authority, and
+permits one queue call. The parent capability adapter
+receives that original authority plus immutable extension provenance; the
+capability request never carries workspace, activation, listener, session,
+lineage, label, head, prompt, merge, route, or config authority. Cloud PR #3942 owns the
+lineage/authority core and must inject workspace, activation, and listener from
+persisted dispatch context, re-read live PR/label/head state, and return only
+`{ receiptId, status: 'queued' | 'duplicate' }`. Refusal or in-doubt transport
+rejects once with no fallback.
+
+Only the parent validator is a security boundary. The isolated entry can write
+its inherited protocol descriptor directly and bypass child-side routing,
+context, call-count, and completion checks. Parent validation therefore treats
+every frame as hostile, permits at most the one exact delivery already bound to
+the branded dispatch, and waits for the adapter's authoritative outcome before
+settling any premature child terminal frame. An authoritative adapter rejection
+settles immediately with its original typed error even if the child hangs.
+
+Before replacing #549's refusal, the hosted caller must obtain an opaque base
+and installation as one generation with `loadHostedExtensionRuntime`, then call
+`runHostedCapabilityExtension` with both values. Every dispatch rechecks the
+current extension declarations and complete project source tree against that
+generation. Directory entries are streamed beneath a shared entry bound;
+nonblocking no-follow descriptors and explicitly bounded reads enforce the
+cumulative-byte limit before source contents are buffered. The loader never imports
+tenant base code to derive authority. It
+requires the exact reviewed Software Factory flow-file SHA-256 and assigns its
+pinned name/version in the parent; project `node_modules`, relative imports,
+stdout, process termination, globals, and module caches therefore cannot forge
+that identity. The sandbox separately requires exact SHA-256 pins for every
+Surface runtime file it needs, copies those bytes into its private runtime, and
+mounts only the copies. A final generation check runs after both private
+snapshots exist and immediately before launch;
+using the ordinary compose loader would import extension top-level JavaScript
+in the host before the sandbox exists. Cross-project, cross-redeploy, stale,
+and structural pairings fail before import. The selected store bytes are copied into a
+private snapshot whose digest is recomputed before bubblewrap mounts it, so a
+later live-store replacement cannot alter imported code. Independent review
+must prove this path at the exact release head. Broader per-agent-step
+file/network/access-preset enforcement remains open in #442 and is not claimed
+by this slice.
+
+The reviewed native source ref is
+`github:AgentWorkforce/flows@8b33ebab8347514f80d9da5a81206a087f641714#extensions/babysitter`,
+the commit included in the published 2.0.26 install. The earlier byte-identical
+pre-release commit is not accepted as authority.
 
 ## Export reviewed bytes
 

docs/CLOUD.md

@@ -389,8 +389,26 @@ handler keep the base flow's default body; overlapping or malformed matches
 fail closed. This release also refuses a matching handler with
 `plugin_unsupported` before either body starts because schema-2 entries are
 ordinary JavaScript and their manifest permissions are not yet isolated by the
-runtime (gate 8 / #442). A handler's trigger is therefore a requirement, but
-the handler cannot execute until that boundary exists. The deploy body carries
+runtime (gate 8 / #442). The SDK now contains a Linux-only, capability-only
+isolation primitive for the native Babysitter profile. Hosted callers must load
+the base and complete installation together with
+`loadHostedExtensionRuntime` (which internally sets `extensions: 'none'` and
+does not import extension JavaScript), then pass its two opaque,
+same-generation results to `runHostedCapabilityExtension`. Every dispatch
+rechecks the current declarations and complete project source against that
+generation. The hosted loader never executes tenant base code to establish
+authority: it hashes a private snapshot and accepts only the exact reviewed,
+host-pinned Software Factory source and identity. The runner then verifies the
+complete lock-backed set, actual base compatibility, route uniqueness, and
+the exact reviewed Babysitter ref/digest/manifest before the artifact is imported inside a
+bubblewrap mount/PID/network/user namespace with an empty credential
+environment and a context exposing only
+`capabilities.cloud.babysitterTurn.queue` plus `done`. This is a prerequisite,
+not enablement: the generic executor refusal remains until the Cloud adapter,
+Relay route, end-to-end canary, and independent security review are complete.
+A handler's
+trigger is therefore a requirement, but the handler cannot execute through the
+generic executor yet. The deploy body carries
 the same list as `requirements` for Cloud to cross-check, and a declared harness Cloud cannot run yet (`gemini`)
 refuses the deploy unless `--agents` overrides it.
 

evidence/babysitter-gate8-isolation/README.md

@@ -0,0 +1,74 @@
+# Native Babysitter gate-8 isolation evidence
+
+This slice adds a Linux-only, capability-only execution primitive for the
+immutable native Babysitter extension. It does not wire hosted dispatch, change
+the generic executor refusal introduced by #549, publish a package, or enable a
+deployment.
+
+The enforced boundary is:
+
+- require the exact reviewed Software Factory base source hash without
+  importing tenant base code, and resolve the complete
+  installation as one opaque generation without importing extension
+  JavaScript; cross-project and same-path cross-redeploy pairing refuse, and
+  every dispatch rechecks the current declarations plus complete project
+  source; base stdout, globals, process termination, relative/package imports,
+  and an earlier module cache cannot forge the parent-pinned identity; source
+  directory entries are streamed beneath a shared entry bound; `flows.json`
+  and `flows.lock.json` plus source files use nonblocking no-follow descriptors
+  and explicitly bounded reads before contents are buffered or parsed;
+- reverify every content-addressed artifact, lock metadata, manifest hash,
+  base/runtime compatibility, and route uniqueness using bounded descriptor
+  reads that enforce the fetched plugin's 500-file, 256-KB-per-file, and 2-MB
+  total limits before allocation, then require the exact
+  immutable native ref/digest/manifest and narrow permission profile; copy the
+  selected bytes into a private snapshot, recompute its digest, and mount only
+  that snapshot so later store replacement cannot change executed code;
+- clone the delivery descriptor into behavior-free, frozen JSON with captured
+  parent intrinsics before validation or serialization, rejecting proxies,
+  accessors, inherited `toJSON`, cycles, holes, and extra JSON-visible fields
+  while stripping symbol and non-enumerable metadata; enforce depth,
+  property/node-count, and encoded-byte limits incrementally while traversing
+  (including repeatedly shared subtrees), count string escaping without
+  materializing an unbounded encoded copy, and enumerate JSON-visible keys
+  without first allocating an attacker-sized key array or using ambient array
+  methods; then validate that snapshot against the
+  symbol-branded verified dispatch before import;
+- import and execute the matching handler only inside a bubblewrap namespace
+  plus Node's permission model, with no network, writable filesystem, inherited
+  environment, child process, workspace mount, MCP, helpers, harnesses, or base
+  flow context; a generated facade mounts only `flow`, `github`,
+  `getFlowDefinition`, and private copies of six SHA-256-pinned Surface runtime
+  files, followed by one final runtime-generation check before launch; an
+  inherited hard limits of 16 GiB address space and 3 GiB data/anonymous
+  memory cover heap, Buffer/native memory, mappings, and descendants in
+  addition to the 64 MiB V8 old-space setting; the wider address-space ceiling
+  admits Node's virtual V8/Wasm reservations while the tighter data limit
+  refuses two hostile 2 GiB Buffers;
+- expose one `capabilities.cloud.babysitterTurn.queue({ delivery })` call and
+  `done`, validate the exact request and `{ receiptId, status }` response in the
+  parent, and pass the original non-serializable authority to the host adapter;
+- treat descriptor 3 as hostile transport: clone and validate every frame and
+  both boundary payloads with captured parent intrinsics, so direct writes can
+  consume only the same exact one-shot delivery capability already granted and
+  cannot claim premature success;
+- fail closed on unknown frames, repeated/omitted calls, premature completion,
+  timeouts, adapter rejection, incompatible bytes, route ambiguity, forged
+  loader results, an unverified/composed base, and broader permissions.
+
+The parent validations are the security boundary. Child-side handler routing,
+the context proxy, its once-only counter, and `done('success')` are correctness
+checks only: hostile code may bypass all of them by writing descriptor 3. The
+parent therefore enforces the exact delivery, one-call limit, terminal ordering,
+and authoritative adapter outcome independently, including when a child emits
+an error immediately after its request or hangs after a typed adapter rejection.
+
+Cloud PR #3942 remains responsible for persisted dispatch context, live PR and
+label/head revalidation, authorized existing-session resolution, lineage-based
+deduplication, and Relay native-turn delivery. The broader per-step permission
+enforcement requested by #442 is not implemented here and remains a separate
+gate. The committed extension declares SDK/Surface `^2.0.26`; an injected
+2.0.25 runtime is refused before import, while the exact published 2.0.26 bytes
+are exercised inside the sandbox.
+
+See `verification.txt` for the final local verification record.