Tomb — isolated command execution from Graph #27

Planning representation replaced — 6 November 2026. The accepted Isolated commands outcome is retained in #62. Reopen one bounded task when selected. This closure does not mean the capability is complete or cancelled. The original scope and evidence below remain preserved; current selected work starts at #52.

Execute one bounded command from a workflow and return a quarantined result through a narrow supervisor.

Starting point: Current delivery: no Tomb executor or containment integration ships. Tomb has no Agent or provider authority.

First working slice

• Define one typed execution request with literal executable/argv, admitted inputs, disposable workspace, deadline and result limits.
• Implement an isolated rootless boundary with no network, filtered environment, exact mounts and externally enforced resource limits; reject unavailable controls.
• Wire claim, execution, full process-tree cancellation and result adoption through Workers/Graph without giving the child queue, provider or host credentials.
• Record effectful tests for forbidden file/network access, secret absence, timeout and descendant termination on one supported Linux host.

Connections: Integrates #3/#8, #22, #23 and #26. Use current authority checks from #24.

Later: Additional execution profiles, toolchains and broader host compatibility.

References: ADR 09 · ADR 14.

Completion prerequisite: #23 supplies actual result-byte custody. Supervisor and negative-test contributions can proceed against the agreed artifact port.

Contribution entry: Take one supervisor containment or process-tree termination boundary.
Open decision: Pin the first command profile and enforceable host controls.
Verification: Named Linux host; negative filesystem/network/process evidence. Shared contribution and touched-docs rules: #52.