Live end-to-end validation: Agor session executing inside an acq sandbox

[mogul]

Question

Prove the destination: run a live, non-mocked Agor session whose executor
runs inside an acq sandbox via the wrapper, and capture the observed output at
each stage (AGENTS.md §8.3):

• Agor spawns the executor through the executor_command_template wrapper.
• The sandbox is created with the correct mounts + daemon net-rule + USAi secret.
• agor-executor --stdin runs inside the sandbox; the agent SDK connects back to
  the daemon over WebSocket (scoped JWT works through the sandbox network policy).
• A git commit inside the worktree succeeds (.git mounted rw).
• USAi is reachable (OpenCode configured via the usai-provider kit; MITM key
  injection works).
• Cleanup (acq rm) fires on exit.

Requires a sandbox-capable host (cannot run inside an sbx sandbox — no nested
sandboxes, per the isolation area ADR). If no such host is available this session,
record BLOCKED with the reason and the trigger to retry — do NOT fabricate a
pass.

Depends on #253 (wrapper), #254 (README), #256 (CI green). This ticket closing is
what makes the map's destination reached.

Output: the captured stage-by-stage transcript (or a BLOCKED record).

[mogul]

Status: BLOCKED (environmental) — not a pass

Per AGENTS.md §8.3, recording BLOCKED rather than fabricating a pass.

The live end-to-end run requires a sandbox-capable host: a real Agor daemon

• acq with an sbx (Docker Sandboxes) backend, on a host that can create
  sandboxes. It cannot run in this session — the agent environment is itself a
  sandbox and sbx/msb cannot nest (same constraint the isolation area ADR notes for
  acq run verification).

What is ready for the run (all committed on jammy-badger):

• integrations/orchestrators/agor/sandbox-wrapper-acq.sh (+ AGOR_SANDBOX_DRY_RUN=1 preview)
• integrations/isolation/acq-kits/agor-daemon-egress/ (+ scripts/verify)
• README with the setup + dry-run-first flow

Trigger to unblock: access to a KVM/Docker-Sandboxes-capable host with Agor
installed. Steps to capture (live, non-mocked), per §8.3:

1. Wire executor_command_template → the wrapper; start a session.
2. Confirm the sandbox is created with the worktree (+ main .git) mounted, the
   agor-daemon-egress kit applied, and the usai secret set.
3. Confirm agor-executor --stdin runs inside and the SDK connects back to the
   daemon over WebSocket (scoped JWT through the egress allow-list).
4. Confirm a git commit in the worktree succeeds (.git mounted rw).
5. Confirm USAi reachability (OpenCode via usai-provider kit; MITM injection).
6. Confirm acq rm cleanup on exit.
   Capture the observed output at each step and attach it here. Two known
   open runtime questions to answer during the run: (a) does sbx honor the :port
   in the egress allow entry; (b) can the sandbox route to host.docker.internal.

Left OPEN and assigned — this is the map's destination gate; it closes only on a
real captured transcript.

[mogul]

Status: worked example up for review; live validation still BLOCKED

The v1 worked example (wrapper + agor-daemon-egress kit + orchestrators/
area + ADR) is now open as #284 (rebased
cleanly onto current main; the obsolete openchamber commits from the old
branch were dropped, and main's #246/#283 openchamber is authoritative).

This ticket stays OPEN — live end-to-end validation is BLOCKED, per
AGENTS.md §8.3 (recording BLOCKED rather than fabricating a pass).

Why blocked (observed this session):

• The isolation area ADR forbids nested sandboxes; the dev/CI host is itself a
  Docker container (/proc/1/cgroup → 0::/docker/…), so a live acq run
  cannot execute here.
• sbx (the v1 target backend) is not installed — it is the commercial
  CLI (brew install docker/tap/sbx + sbx login).
• msb is absent and there is no /dev/kvm.
• agor / agor-executor are absent — no daemon to spawn the executor or mint
  the scoped JWT; no USAi key provisioned.

What WAS verified live (no sandbox needed):

• Wrapper dry-run against the real acq CLI (quickstart main) emits the
  correct plan
  (acq create shell <worktree> <repo.git> --name … --kit <egress> … | acq exec … -- agor-executor --stdin,
  then acq rm on exit); a non-Agor-managed local repo checkout is correctly
  refused (exit 5).
• CLI-surface re-verify vs current quickstart main (post openchamber kit: msb/ppp parity (neutral port-publish + background vocab) and adopt acq publishedPorts translation #233 parity, Live end-to-end validation: Agor session executing inside an acq sandbox #257
  fail-closed run): acq create positionals + --name + repeatable --kit,
  acq exec … -- CMD stdin passthrough, acq secret set <SANDBOX> usai (stdin,
  positional scope), sbx-v2 caps.network.allow host:port preserved. The v1
  contract still holds.

Trigger to close this ticket: a sandbox-capable, non-nested host with
sbx installed + logged in, a running Agor daemon on :3030, and an
out-of-band USAi key. Then run the wrapper against a real Agor session and
capture the stage-by-stage transcript (executor spawn → sandbox create with
mounts + egress kit + USAi secret → WebSocket callback → git commit in the
worktree → USAi reachable → acq rm on exit).

[mogul]

Scope note: #260 (msb backend mount gap) is now closed — the fixed-guest-path mount gap it described was resolved upstream by quickstart#230 + the #233 parity omnibus (msb now mounts each workspace at its host path, sbx-parity, and supports multiple positional mounts). The only residual from #260 — a live msb create→exec run (msb is NOT LIVE-VERIFIED upstream, no /dev/kvm in the build env) — is folded into this ticket.

So this ticket's live-validation trigger now covers both backends: run the wrapper against a real Agor session on a sandbox-capable, non-nested host — sbx (installed + logged in) and/or msb (on a KVM host) — with a running Agor daemon on :3030 and an out-of-band USAi key, capturing the stage-by-stage transcript.