feat: bidirectional agent handoff with sub-agent lifecycle

.github/workflows/ci.yml

@@ -98,8 +98,11 @@ jobs:
       - name: Build inference router image
         run: docker build --build-arg ROUTER_CACHE_BUST=$(date +%s) -t azureclaw-inference-router:test -f inference-router/Dockerfile .
 
+      - name: Build sandbox base image
+        run: docker build --build-arg OPENCLAW_CACHE_BUST=$(date +%s) -t azureclaw-sandbox-base:test -f sandbox-images/openclaw/Dockerfile.base .
+
       - name: Build sandbox image
-        run: docker build --build-arg OPENCLAW_CACHE_BUST=$(date +%s) --build-arg INFERENCE_ROUTER_IMAGE=azureclaw-inference-router:test -t azureclaw-sandbox:test -f sandbox-images/openclaw/Dockerfile .
+        run: docker build --build-arg SANDBOX_BASE_IMAGE=azureclaw-sandbox-base:test --build-arg INFERENCE_ROUTER_IMAGE=azureclaw-inference-router:test -t azureclaw-sandbox:test -f sandbox-images/openclaw/Dockerfile .
 
       - name: Scan image with Trivy
         uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
@@ -130,6 +133,7 @@ jobs:
           IGNORE="--ignore DL3008 --ignore DL3013 --ignore DL3018 --ignore DL3006 --ignore DL4006 --ignore DL3003 --ignore DL3016 --ignore DL3059 --ignore SC2015 --ignore SC2028"
           hadolint $IGNORE controller/Dockerfile
           hadolint $IGNORE inference-router/Dockerfile
+          hadolint $IGNORE sandbox-images/openclaw/Dockerfile.base
           hadolint $IGNORE sandbox-images/openclaw/Dockerfile
           hadolint $IGNORE vendor/agentmesh-relay/Dockerfile
           hadolint $IGNORE vendor/agentmesh-registry/Dockerfile

.gitignore

@@ -472,3 +472,4 @@ cli/*.test.*
 SECURITY-HARDENING-PLAN.md
 .DS_Store
 docs/demo-script.md
+nohup.out

CHANGELOG.md

@@ -8,6 +8,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Added
+- **Bidirectional Agent Handoff** — live-migrate agents between local Docker and AKS cloud with `azureclaw handoff <name> --to cloud|local`. Supports both CLI-driven (operator) and LLM-driven (webchat) orchestration paths
+- **Sub-Agent Handoff** — sub-agents are snapshotted (workspace + task state), destroyed on source, re-spawned on target, and injected with workspace + resume signal via E2E encrypted mesh
+- **Stale AMID Cache Poisoning Fix** — three-layer defense: identity-based AMID rejection, prekey readiness gate, workspace inject retry with ack verification
+- **Workspace Injection Pipeline** — tarball extraction with path traversal validation, `incoming/` file promotion to workspace root, `HANDOFF_FILES.md` manifest for agent discoverability
+- **Handoff Decommission Cleanup** — reverse handoff deletes all cloud CRDs (parent + sub-agents); forward handoff destroys local sub-agent containers
+- **Mesh Inbox Improvements** — protocol message filtering (hides handoff/ack messages), auto-decode of `file_transfer` base64 content
 - **AGT Governance Sidecar** — Python sidecar wrapping AGT SDK v3.0.0 with PolicyEvaluator, FileTrustStore (0–1000, ±200 clamp), SHA-256 Merkle audit chain, RateLimiter, and AgentBehaviorMonitor
 - **E2E Encrypted Inter-Agent Messaging** — Signal Protocol (X3DH + Double Ratchet) via AgentMesh relay/registry with KNOCK trust handshake
 - **Content Safety Circuit Breaker** — fail-open with 60s auto-reset cooldown (prevents cascading failures when Content Safety endpoint is misconfigured)
@@ -28,6 +34,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - 8 vendor patches for AgentMesh relay, registry, and SDK bugs
 - Foundry Memory Store format — ensureMemoryStore creates full store with chat + embedding models; item format matches Foundry REST API spec
 
+### Changed
+- AGT inference rate limit bumped from 120 → 500 calls/60s (policy) and router token bucket from 100 → 500 global req/s (needed for multi-agent handoff traffic)
+
 ### Security
 - Circuit breaker fails open instead of closed (prevents total service lockout)
 - iptables UID-based egress — agent process restricted to localhost

Makefile

@@ -66,12 +66,19 @@ image-router: ## Build inference router Docker image
 		--label "org.opencontainers.image.revision=$(GIT_SHA)" \
 		-f inference-router/Dockerfile .
 
-image-sandbox: image-router ## Build sandbox Docker image
+image-sandbox-base: ## Build sandbox base image (heavy deps — rebuild when upgrading OpenClaw/Python/Go tools)
 	docker build --platform linux/amd64 \
-		--build-arg AZURELINUX_BASE=mcr.microsoft.com/azurelinux/base/core:3.0 \
+		--build-arg OPENCLAW_CACHE_BUST=$$(date +%s) \
+		-t $(REGISTRY)/azureclaw-sandbox-base:$(IMAGE_TAG) \
+		-t $(REGISTRY)/azureclaw-sandbox-base:latest \
+		-f sandbox-images/openclaw/Dockerfile.base .
+
+image-sandbox: image-router ## Build sandbox Docker image (slim overlay — fast per-commit rebuild)
+	docker build --platform linux/amd64 \
+		--build-arg SANDBOX_BASE_IMAGE=$(REGISTRY)/azureclaw-sandbox-base:latest \
 		--build-arg INFERENCE_ROUTER_IMAGE=$(REGISTRY)/azureclaw-inference-router:latest \
-		-t $(REGISTRY)/azureclaw-sandbox:$(IMAGE_TAG) \
-		-t $(REGISTRY)/azureclaw-sandbox:latest \
+		-t $(REGISTRY)/openclaw-sandbox:$(IMAGE_TAG) \
+		-t $(REGISTRY)/openclaw-sandbox:latest \
 		-f sandbox-images/openclaw/Dockerfile .
 
 image-relay: ## Build AgentMesh relay image
@@ -91,8 +98,10 @@ push: ## Push all images to ACR
 	docker push $(REGISTRY)/azureclaw-controller:latest
 	docker push $(REGISTRY)/azureclaw-inference-router:$(IMAGE_TAG)
 	docker push $(REGISTRY)/azureclaw-inference-router:latest
-	docker push $(REGISTRY)/azureclaw-sandbox:$(IMAGE_TAG)
-	docker push $(REGISTRY)/azureclaw-sandbox:latest
+	docker push $(REGISTRY)/azureclaw-sandbox-base:$(IMAGE_TAG)
+	docker push $(REGISTRY)/azureclaw-sandbox-base:latest
+	docker push $(REGISTRY)/openclaw-sandbox:$(IMAGE_TAG)
+	docker push $(REGISTRY)/openclaw-sandbox:latest
 	docker push $(REGISTRY)/agentmesh-relay:$(IMAGE_TAG)
 	docker push $(REGISTRY)/agentmesh-relay:latest
 	docker push $(REGISTRY)/agentmesh-registry:$(IMAGE_TAG)