Problem
#3496 bounds invalid, unresolved, and denied sandbox-boundary negotiation while one live active Turn is running. That state is intentionally local to the Turn's ToolRuntime.
A safe-boundary continuation, crash recovery, or Runtime restart creates a new execution segment. Today it cannot reconstruct whether the same logical Turn already received a denial or exhausted its correction budget. The resumed segment can therefore repeat boundary negotiation that had already converged before the interruption.
This is separate from the active-Turn fix in #3496: the execution boundary itself remains durable and authoritative, but the small amount of negotiation control state is not.
Desired outcome
The same logical Turn should preserve its sandbox-boundary negotiation outcome across safe continuations and restart recovery without persisting authority in prompt text or trusting model-generated history.
- Restore only the minimal control facts needed for convergence: denial, bounded invalid/unresolved correction counts, and terminal finalization state.
- Derive those facts from digest-validated immutable Runtime lineage or another equally authoritative source.
- Include model-hidden Code Mode tool activity without exposing hidden arguments or results.
- Reset the state for a genuinely new user Turn.
- Never grant or widen sandbox authority from the restored control state; the live
ExecutionBoundary remains the sole authority.
- Keep CLI/activation outcomes honest if a resumed Turn must end as a permission handoff or ask for a corrected declaration.
Acceptance criteria
- A denied boundary request cannot be reopened by a safe continuation or Runtime restart of the same logical Turn.
- Invalid and unresolved correction budgets cannot be reset by splitting work across continuation segments.
- Already-approved capabilities remain usable after restoration.
- Tampered, incomplete, or non-canonical lineage fails closed and does not restore guessed state.
- A new user Turn starts with a clean negotiation budget.
- Tests cover direct tools, Code Mode-hidden calls, crash/restart recovery, and a new-Turn reset.
Non-goals
- Adding broad filesystem or Homebrew runtime grants.
- Persisting a stale sandbox diagnostics snapshot.
- Treating model declarations or prompts as execution authority.
Context
AI use
OpenAI Codex assisted with analysis and drafting. I reviewed the proposal and take responsibility for it.
Problem
#3496 bounds invalid, unresolved, and denied sandbox-boundary negotiation while one live active Turn is running. That state is intentionally local to the Turn's
ToolRuntime.A safe-boundary continuation, crash recovery, or Runtime restart creates a new execution segment. Today it cannot reconstruct whether the same logical Turn already received a denial or exhausted its correction budget. The resumed segment can therefore repeat boundary negotiation that had already converged before the interruption.
This is separate from the active-Turn fix in #3496: the execution boundary itself remains durable and authoritative, but the small amount of negotiation control state is not.
Desired outcome
The same logical Turn should preserve its sandbox-boundary negotiation outcome across safe continuations and restart recovery without persisting authority in prompt text or trusting model-generated history.
ExecutionBoundaryremains the sole authority.Acceptance criteria
Non-goals
Context
AI use
OpenAI Codex assisted with analysis and drafting. I reviewed the proposal and take responsibility for it.