Advanced Sandboxing & Capability Model (Native Rust, No Python Dependency)

[micahstubbs]

Goal: Strengthen the security model for executing dynamically generated target agent code without relying on the Python/Docker bridge as the primary mechanism.

This becomes more important after the Python bridge deprecation decision (#137).

Current State

• Basic capability allow-list exists in Rust.
• Docker + Python subprocess is still used for target execution.
• Full production-grade isolation is documented in SECURITY.md but not fully implemented.

Recommended Path

• Layered defense-in-depth:
  • Landlock (filesystem)
  • seccomp (syscalls)
  • wasmtime + WASI (if we go WebAssembly route for target agents — see Native Rust Target Agent Execution Strategy (Replace Python Bridge) #138)
  • Application-level capability checks
• Expose security events (violations, capability requests) into the trajectory so the Feedback Agent can potentially learn to write safer agents over generations.

Related: #90 (formal capability model), #138 (native target execution), #137 (deprecation).