Include backend filesystem requirements before approving sandbox policy #5108

User Story

I use OpenShell with isolation backends whose filesystem layout differs from a Linux container. I need the policy approved by the gateway to include the paths the selected backend requires, before startup begins.

Problem Statement

Supervisor proxy setup can add Linux paths after the gateway has composed the effective policy. Backends cannot provide their own filesystem baseline through a shared agreement or explicitly select an empty baseline to suppress those defaults.

The policy used at startup can therefore differ from the one the gateway approved. Checking the gateway host's filesystem does not solve this: the workload may run on another operating system.

Impact / Why This Matters

A backend can correctly refuse to attach because its runtime policy differs from the approved policy. Configuration and status can also disagree about which effective policy is in use.

Including backend requirements before approval lets OpenShell describe one consistent policy while respecting explicit empty baselines and read-only permissions.

Proposed Design

Let a compute driver advertise trusted workload-namespace prerequisites and compose them into the effective policy before admission and identity calculation. The selected supervisor BackendSetup supplies the same baseline. An explicit empty baseline suppresses legacy defaults; explicit read-only grants stay read-only. Keep the legacy Linux behavior for drivers that do not negotiate the contract.

Example workflow for review: Create a sandbox on a Darwin backend that advertises Darwin filesystem prerequisites rather than Linux defaults. Configuration and endpoint-status inspection must show the same admitted effective-policy identity, including after Loaded acknowledgement, without widening explicit read-only grants.

Acceptance Criteria

• Endpoint-status reports use the same effective-policy hash and provider revision as delivered configuration, before and after Loaded acknowledgement.
• Create and current effective configuration include the advertised prerequisites before admission and hashing.
• Advertised paths are independent of the gateway host filesystem.
• Explicit read-only grants and an explicit empty baseline are respected.
• Policy ownership, provider environment composition and legacy Linux behavior remain consistent.

Alternatives Considered

Hardcoding every platform in the supervisor couples policy to implementation details and still risks late widening. Authored policy workarounds cannot suppress supervisor additions. Providers, middleware and interceptors do not own backend filesystem prerequisites.

Agent Investigation

No response

Checklist

• I've reviewed existing issues and the published docs
• This is a design proposal, not a "please build this" request