01a077f5 - Enforce script-owned model lane execution

AGENTS.md

@@ -11,6 +11,11 @@ GitHub communication. Implementers and reviewers never run tests, spawn agents,
 or access GitHub themselves. See DESIGN.md §§19.1 and 19.7. Distinguish required
 behavior from implemented and verified behavior; never invent evidence.
 
+Model lanes use the static bounded source executor. Explicit native runtime
+pins and compatible selected login files are required; no legacy native-tool
+fallback is allowed. See [docs/lane-boundary.md](docs/lane-boundary.md) for the
+implemented boundary, supported adapters and remaining trust assumptions.
+
 Models never start monitors, poll status, or wait for CI or other events. Return
 results or blockers to the script when there is no more work. The script owns
 monitoring and informs a model when an observed event provides useful work.

DESIGN.md

@@ -658,8 +658,12 @@ the workflow is enabled on a deployment:
   executor. Its existence alone does not establish that model lanes cannot
   access GitHub or execute tests or other agents.
 
-This section defines the required responsibility boundary. It does not claim
-that a sandbox or other technical enforcement has been implemented.
+Model lanes now use the static bounded source executor described in
+[docs/lane-boundary.md](docs/lane-boundary.md), with explicit native runtime
+pins and isolated selected login profiles. That protocol enforces permitted
+source operations; it is not a universal OS sandbox against a malicious CLI
+binary and does not cover the separate interactive session path. No worker
+activation or live deployment is implied.
 
 ### 19.8 Configuration starts empty
 

docs/ai-accounts.md

@@ -18,7 +18,11 @@ The following is an **operator-supplied example**, never an installed default:
   "accounts": {
     "provider-profile": {
       "provider": "grok",
-      "config_dir": "/operator/path"
+      "config_dir": "/operator/path",
+      "lane_runtime": {
+        "binary": "/operator/path/to/grok-1.0.13",
+        "sha256": "0000000000000000000000000000000000000000000000000000000000000000"
+      }
     }
   },
   "roles": {
@@ -39,6 +43,13 @@ The following is an **operator-supplied example**, never an installed default:
 }
 ```
 
+The `lane_runtime.binary` and `lane_runtime.sha256` values above are placeholders only,
+never a verified binary or hash and never installed defaults. Before lane execution,
+the operator must select a supported actual native binary and replace the digest with
+the actual SHA256 measured by the static script. Accounts may leave `lane_runtime`
+null/unconfigured for interactive-only use; lane execution still requires a configured
+runtime.
+
 Add as many named accounts, roles, and session bindings as needed. No fixed
 account list, role list, or count is built in. Configurable role names are
 chosen by the operator; they are distinct from the fixed workflow kinds
@@ -55,6 +66,12 @@ Each account requires:
 - `config_dir`: absolute path to that profile's provider CLI configuration
   directory (no NUL, newline, CR, or parent traversal)
 
+`lane_runtime` is optional/null for stored accounts, but mandatory for lane
+execution: an absolute native `binary` path and its lowercase `sha256` digest.
+See [bounded model lanes](lane-boundary.md) for supported adapters, selected
+login-file handling, migration and verification limits. Installation supplies
+no runtime selection.
+
 Each role requires:
 
 - `account`: name of a configured account
@@ -82,7 +99,7 @@ account or role references are rejected. Credentials and API tokens must not
 appear in this manifest; they belong only inside each `config_dir`. Error text
 from the loader does not echo credential contents.
 
-## Process isolation prefix
+## Interactive process isolation prefix
 
 `AIRole.env_prefix()` returns an `env` argv prefix for child processes. It
 removes ambient `XAI_API_KEY`, `GROK_API_KEY`, `OPENAI_API_KEY`, `CODEX_API_KEY`,
@@ -93,6 +110,9 @@ variables are left for the child to inherit. This is process configuration
 isolation, not a sandbox and not a claim that the provider CLI is already
 authenticated for that profile.
 
+Bounded lanes use their separate minimal environment and isolated temporary
+profile instead of this interactive prefix; see [lane-boundary.md](lane-boundary.md).
+
 ## Interactive selection
 
 `AIAccounts.for_session(session_id)` resolves `sessions[session_id].interactive`
@@ -111,11 +131,15 @@ vendor/role lists and built-in model choices in code. After adopting
 `ai-accounts.json`:
 
 1. Create one account entry per provider CLI profile directory you intend to use.
-2. Define roles with explicit `account`, `model`, and `access` (no omitted
+2. For accounts used by lanes, select a supported native binary and its SHA256
+   digest for `lane_runtime` (see [lane-boundary.md](lane-boundary.md) for
+   supported adapter limitations). Interactive-only accounts may leave
+   `lane_runtime` null/unconfigured.
+3. Define roles with explicit `account`, `model`, and `access` (no omitted
    fields).
-3. Bind each session that should run lanes or an interactive runner: set
+4. Bind each session that should run lanes or an interactive runner: set
    `lanes` keys such as `grok:implementer` and, when needed, `interactive`.
-4. Existing sessions are unconfigured until those bindings are added. An empty
+5. Existing sessions are unconfigured until those bindings are added. An empty
    or missing file does not authorize a fallback identity.
 
 Configure sessions explicitly before enabling launch paths after upgrading.

docs/issue-coordinator.md

@@ -14,7 +14,7 @@ and bounded model lanes on the execution device. It never merges.
 | CLI / daemon | `agent coordinate --session ID` advances one worker; `--follow` is the script loop. The daemon starts explicitly configured workers on startup. Changes to existing workers are read each tick; changes to the daemon worker set require restart. Legacy assignment dispatch and `supervise` refuse these sessions. |
 | Operator accounts, roles, `check_argv`, `readiness_argv`, workspace roots | **Never installed automatically.** Operators add them explicitly. |
 | End-to-end deployment on a named host | Not claimed. Deployment hostnames stay out of this public repository. |
-| Universal sandbox / forced model isolation | **Not claimed.** Grok implementer argv denies Bash/subagents/web-search; that is process argv hardening only. |
+| Model lane boundary | Bounded source protocol with explicitly pinned native runtimes and isolated profiles; see [lane-boundary.md](lane-boundary.md). No universal hostile-binary OS sandbox claim. |
 
 Distinguish a requirement (DESIGN §19.7), an implemented module, and a verified
 deployment. This document does not invent evidence that a device is running the
@@ -108,12 +108,13 @@ for worker in workers.values():
 - `runner` executes `gh`/`git` trusted calls and returns
   `Completed(returncode, stdout, stderr)`. GitHub-scoped calls go through
   `Account.runner` (explicit `GH_CONFIG_DIR`), never an ambient login.
-- `lane_runner(argv, stdin)` is optional. When omitted, lanes and trusted
-  argv lists run via a Python bounded subprocess (process-group kill on
-  timeout), preserving stdin and cwd. External `timeout(1)` is **not** used
-  (absent on stock macOS). Tests inject fakes. Grok implementer argv is
-  hardened with `--deny Bash`, `--no-subagents`, and `--disable-web-search`.
-  This is process argv hardening, **not** universal sandbox enforcement.
+- `lane_runner(selected_role, *, cwd, manifest, spec, timeout)` is an optional
+  trusted static dependency implementing the bounded source executor contract.
+  The default is the shared [bounded executor](lane-boundary.md); tests can
+  supply source-executor results. There is no native argv fallback. Runtime
+  configuration is required for each lane slot before a worker starts work.
+  The script's subprocess owner kills process groups on timeout without
+  depending on external `timeout(1)`.
 - Environment context for trusted `check_argv` / `readiness_argv` (set in the
   child environment, with cwd = worktree):
   `AGENT_COORDINATOR_HEAD`, `AGENT_COORDINATOR_BASE`, `AGENT_COORDINATOR_REPO`,
@@ -384,3 +385,10 @@ No silent failure.
 | `coordinator_exec.py` | Bounded subprocess helper |
 | `coordinator_common.py` | Shared helpers / constants |
 | `coordinator_config.py` | Parent-owned configuration loaders |
+## Model execution boundary
+
+Coordinator model lanes require explicitly pinned native runtimes and use
+the static [bounded source executor](lane-boundary.md). Models receive source
+and full review diffs as data; they cannot invoke GitHub, tests, other lanes
+or monitors through this protocol. The script remains responsible for every
+start and event wait. Installation activates no worker.