enhancement(runtime): preserve sandbox boundary negotiation across safe continuations

[yihanzhu]

Problem

#3496 bounds invalid, unresolved, and denied sandbox-boundary negotiation while one live active Turn is running. That state is intentionally local to the Turn's ToolRuntime.

A safe-boundary continuation, crash recovery, or Runtime restart creates a new execution segment. The resumed segment must remember an explicit client denial for the same logical Turn so that recovery cannot reopen a denied negotiation.

Invalid/unresolved correction budgets remain local to each execution segment. Recovery may therefore open another bounded correction window. This additional retry/cost risk is an accepted tradeoff for avoiding cross-segment durable accounting and negotiation-history reconstruction.

Desired outcome

Preserve explicit denial across safe continuations and restart recovery without persisting authority in prompt text or trusting model-generated history.

• Restore denial from authoritative Host-owned request-log evidence scoped to the trusted continuation chain.
• Distinguish explicit client decisions from lifecycle cleanup, including host_restarted, turn_stopped, turn_terminal, and embedded abort/end-of-turn cleanup. Do not guess client decisions from ambiguous or legacy records.
• Start each new execution segment with fresh invalid/unresolved counters and no inherited finalization flag, while retaining the existing limits within the segment.
• Keep provider-replay lineage, claim, and digest validation as a separate continuation integrity requirement.
• Cover direct and Code Mode-hidden calls without exposing hidden arguments or results.
• Reset negotiation state for a genuinely new user Turn.
• Never grant or widen sandbox authority from restored control state; the live ExecutionBoundary remains the sole authority.
• Keep CLI/activation outcomes honest if a resumed Turn must end as a permission handoff or ask for a corrected declaration.

Acceptance criteria

1. An explicit client-denied boundary negotiation cannot be reopened by a safe continuation or Runtime restart of the same logical Turn.
2. Invalid and unresolved correction budgets are per execution segment. Each new segment starts with zero correction counts and no inherited finalization flag; the existing segment-local limits remain enforced.
3. Capabilities allowed by the current live ExecutionBoundary remain usable after restoration. Restored denial state never grants or widens authority.
4. Only authoritative evidence attributable to the trusted continuation chain restores denial. Lifecycle closures and ambiguous or legacy records are not inferred to be client decisions. Required authority read failures must not silently become a clean state. Existing provider-replay lineage, claim, and digest checks remain fail-closed.
5. A genuinely new user Turn starts with no inherited denial and a clean negotiation budget.
6. Tests using a real ToolRuntime cover direct tools, Code Mode-hidden calls, denial across continuation and crash/restart recovery, lifecycle cleanup including embedded stop/abort and end-of-turn cleanup, fresh per-segment budgets, live-boundary capability use, and new-Turn reset.

Non-goals

• Preserving invalid/unresolved counters or finalization state across execution segments.
• Reconstructing sandbox negotiation from RuntimeEvent history or introducing a durable cross-segment counter table.
• Adding broad filesystem or Homebrew runtime grants.
• Persisting a stale sandbox diagnostics snapshot.
• Treating model declarations or prompts as execution authority.

Context

• Active-Turn behavior: bug(runtime-host): interactive turns omit sandbox context and can loop on workspace-local Bash #3445 and fix(runtime): restore sandbox context and bound boundary negotiation #3496
• Accepted scope for fix(runtime): preserve sandbox negotiation across continuations #4308: issue-owner confirmation

简体中文

本 issue 现在只要求：明确的客户端拒绝必须跨续跑和重启保留。invalid/unresolved 修正次数每个执行段重新计算，不继承上一段的收尾标记，段内继续执行现有限制。

我们接受恢复后可能多几次尝试和额外成本，以避免跨段持久计数和协商历史重建。系统停止、重启、取消和结束清理不能被当作客户端拒绝，含糊或旧记录不能用于猜测决定。新的用户 Turn 不继承旧拒绝；真实权限仍由当前 ExecutionBoundary 决定；上下文重放的完整性校验继续保留。

AI use

OpenAI Codex assisted with analysis and drafting. I reviewed the proposal and take responsibility for it.

[testikun]

This was generated by AI during triage.

I would like to take the follow-up work for this issue.

To avoid duplicating PR #3496, I will wait for that active-Turn sandbox negotiation fix to merge before starting implementation here. This issue remains a separate follow-up focused on carrying the minimal negotiation control state across safe continuations and Runtime restart recovery for the same logical Turn.

Once #3496 is merged, I plan to start from the updated main and implement only the durable, digest-validated restoration boundary described here. The live ExecutionBoundary will remain the sole authority; restored state will only preserve denial/correction-budget convergence. I will add regression coverage for continuation, crash/restart recovery, tampered lineage, and new-Turn reset.

中文摘要：我认领这个后续问题，但会等 #3496 合并后再从最新 main 开始，避免重复实现 Active Turn 的修复。这里仅负责同一逻辑 Turn 在 safe continuation 和 Runtime 重启后的 negotiation 状态恢复，不会从恢复数据扩大 sandbox 权限。

[yihanzhu]

Thanks for taking this on. #3496 is now merged, and your proposed scope aligns with the intended follow-up. I won’t open a competing implementation PR. I have some prototype findings around Code Mode-hidden events, lineage validation, and new-Turn reset, and I’m happy to share context or review an early draft.