Sandbox-First Agent Execution Plane

# Sandbox-First Agent Execution Plane

Blast-radius containment for agentic coding: the agent works in a disposable sandbox, and only verified, operator-approved diffs cross the boundary back to the real repo.

## Overview
Running agent-generated code directly on a host is a security and stability risk. This plane provisions an isolated workspace from a declarative manifest, runs the agent's scripts only inside it, captures candidate changes as diffs, and refuses to let any diff touch the host until an operator approves it. Approved diffs are promoted as workspace edits.

## Architecture (unidirectional security loop)
Host manifest -> declarative-sandbox-provisioning -> isolated SandboxWorkspace. Agent script -> sandboxed-script-execution inside the workspace -> FileDiffs. Each diff is packaged as a tool call intercepted by HITL approval (operator views the unified diff and authorizes). On approval, interactive diff promotion converts the FileDiff into a WorkspaceEdit applied to the host. Nothing crosses back without approval.

## Components
1. declarative-sandbox-provisioning — Manifest -> SandboxWorkspace. Source: openai/openai-agents-python.
2. sandboxed-script-execution — (ScriptCode, InputData) -> OutputData (incl. FileDiff). Source: n8n-io/n8n.
3. in-the-loop-tool-approval — ToolCall -> DeferredToolCall. Sources: agno-agi/agno, pydantic/pydantic-ai.
4. interactive diff promotion — FileDiff -> WorkspaceEdit. Source: ocaml/ocaml-lsp.

## Build
A Python reference (execution_plane.py) provisions an ephemeral workspace, runs the agent script there, computes a unified diff against the host file, prompts the operator for approval, and on "y" writes the approved content back to the host.

## Acceptance Check
A buggy target file (hours - rate) is handed to an agent script that rewrites it to hours * rate inside the sandbox. Denial leaves the host file untouched; approval promotes the fix.

## Honest status — READ BEFORE RELYING ON ISOLATION
The diff-promotion and approval flow is sound, but the "sandbox" in the reference build is NOT real isolation: it is a temp directory plus a subprocess with a changed working directory. A generated script can trivially escape it (absolute paths, parent traversal, network, env). This enhancement does NOT provide containment as built. A production version must run scripts in a real isolated runtime (gVisor, Firecracker microVM, or a locked-down container) with no host filesystem or network access. Treat the current build as a demonstration of the approval/promotion boundary, not as a security control. Star atom: declarative-sandbox-provisioning.