D1 — Tier 1: native OS process sandboxing (the portable confinement baseline)

[hartsock]

Tier 1 of ADR 0009 (#77) — the default confinement tier. Per-OS native primitives behind the one Sandbox trait: lightweight, no external runtime, available on a stock host. High priority: this is the baseline L3 boundary on every platform (Tier 2 micro-VM and Tier 3 Wasm-plugins are opt-in tiers above it).

Per-OS backends

• Linux — seccomp + namespaces + Landlock. fs_read/fs_write landed (PR feat(shell): wire the Landlock fs_write L3 boundary into the engine (#35) #53/feat(core): Landlock fs_read axis with loader/system base allow-list (#31) #54). net + exec under:
  • L3 boundary: Landlock as a Linux-only publishable variant (execute+read+write allow-list + netns) #35 — Landlock as a Linux-only publishable variant (execute+read+write allow-list + netns)
  • Landlock exec axis needs tight-read co-confinement (loader trampoline) — held; spec for combined exec+read pass #57 — Landlock exec axis needs tight-read co-confinement (loader trampoline) — held; spec for a combined exec+read pass
• macOS — Seatbelt (sandbox_init) — shell L3: macOS (Seatbelt) sandbox backend for the per-OS toggle #50
• Windows — AppContainer (capability SIDs) — shell L3: Windows (job object / restricted token) sandbox backend #51 (re-scoped from job objects per ADR 0009 D4 — AppContainer is the capability-shaped primitive)

Definition of done

Each OS reports a real, fail-closed SandboxKind (not None) for the axes the platform can enforce, and an honest None only where genuinely unsupported. The CI matrix asserts the reported SandboxKind matches the host's true capability (ADR 0004 D1 / #30).

Refs ADR 0009 (#77). Tracks #35, #57, #50, #51.