feat(security): workspace sandbox

[cniska]

What would you like?

Acolyte should treat the workspace as a first-class sandbox boundary for all agent tool filesystem access.
Tools should have broad access inside the sandbox and no access outside it.

This boundary should be enforced consistently regardless of workflow or invocation path.

Motivation

Security should be a core product behavior, not an optional mode.
A single sandbox model makes the trust boundary clear for users and maintainers.

It also reduces ambiguity around what agent tools can and cannot touch.

Proposed approach

Introduce a canonical workspace-sandbox boundary concept that defines and validates the active sandbox root per session.
Use resolved-path enforcement so boundary checks are based on the real target path, not only input strings.

When a tool request crosses the boundary, return a structured sandbox violation error.

Scope

• Workspace sandbox boundary definition
• Canonical workspace-sandbox module ownership
• Tool-entry sandbox enforcement across runtime and debug invocations
• Structured sandbox violation error contract
• Documentation updates for sandbox semantics

[polterguy]

Strong direction. Treating the workspace as the primary sandbox boundary makes the trust model much easier to reason about, especially once agents get multiple tools and execution paths.

The two things that matter most in my experience are exactly the ones you mention:

1. resolved path enforcement instead of string checks
2. 2. one canonical boundary model reused everywhere
      If different tools or debug paths can bypass the same boundary semantics, the sandbox stops being a real security boundary and becomes more of a convention.

We have been thinking about similar problems in Hyperlambda, where the runtime capability boundary is enforced at execution time instead of relying on prompt quality or tool discipline. Different implementation, same idea: make the security model explicit and deterministic.

The structured violation error contract also seems important here. Once that exists, both tooling and users get a much clearer signal about why an operation was blocked.

[cniska]

Fixed in #79