Require explicit filesystem, environment, and secret-safe coding capabilities

[sounkou-bioinfo]

Current capability mismatch

The engineering constitution requires filesystem authority and credentials to be explicit capabilities. The default coding tools do not currently satisfy that rule.

At commit f3475cf000a379732d37cfb317754dec5ef2b4db:

• rho_tool_read() accepts any model-supplied path readable by the host user;
• rho_tool_write() creates directories and writes any model-supplied path writable by the host user;
• neither tool receives a root/access policy or records an admission decision;
• rho_tool_bash() defaults to cwd = getwd() and environment = "current", so its process receives ambient environment values;
• the shell remains free to traverse outside cwd; a working directory is not filesystem authority;
• RhoModelAuth and RhoHttpRequest use default S7 printing, which prints API keys and authorization-header values verbatim.

Executed harmless canaries confirmed an arbitrary temporary file was read and an ambient RHO_AUDIT_SECRET value was visible to the default Bash tool. Separately, captured print() output for RhoModelAuth and RhoHttpRequest contained a synthetic secret.

This does not mean a coding tool should pretend arbitrary Bash is a sandbox. It means its host authority and secret exposure must be explicit rather than inherited accidentally.

Required contract

1. Construct coding tools with a typed host capability describing readable roots, writable roots, cwd, environment entries, process/network policy, and execution placement.
2. Default to an explicit minimal environment. Inheriting the current process environment must be a named opt-in capability.
3. Canonicalize and admit file paths, including symlink behavior, before read/write effects.
4. Record the selected capability and admission result in tool details/receipts without serializing secret values.
5. State clearly that unrestricted Bash has the authority granted to its host process; do not imply containment from cwd or mirai placement.
6. Add secret-safe print/format methods for credential/auth/request values and sanitize typed errors that retain request state.
7. Keep provider credential injection separate from coding-tool environment injection.

Acceptance evidence

• reads and writes outside admitted roots fail as typed values;
• symlink and .. escape fixtures fail;
• the default Bash tool cannot read an ambient synthetic secret;
• explicit environment injection makes only named values visible;
• unrestricted-host opt-in is explicit and tested;
• printing model auth, HTTP requests, task errors, and run summaries does not reveal synthetic API keys or authorization values;
• cancellation/process-tree behavior is tested for the selected execution binding.

This should be resolved before issue #4 adds repository search on top of the same filesystem authority.

Prepared in Pi using GPT Sol 5.6 High; all synthetic-secret and temporary-file canaries were executed locally and removed.