feat(sandbox): track exec processes

[drew]

Summary

Track processes launched through sandbox exec with stable identities and observable lifecycle state owned by the sandbox supervisor. This draft is the third PR in the issue #2710 stack.

The implementation will cover lifecycle metadata and list/get inspection. Reconnectable exec I/O, output replay, process control, descendant enumeration, and exec restart policies remain out of scope.

Related Issue

Relates to #2710.

Depends on #2726 and #2798.

Changes

• Add a supervisor-owned registry for direct public exec processes.
• Assign each exec a gateway-issued stable ID.
• Reconcile exec start/exit state over the persistent supervisor session.
• Persist bounded lifecycle records with supervisor-instance fencing.
• Add authorized process list/get APIs and CLI commands.
• Preserve existing sandbox main and restart-policy semantics.

Implementation is pending; the detailed editable plan is kept locally under architecture/plans/2710-exec-process-tracking.md.

Testing

• Unit and API contract tests
• Supervisor reconnect and snapshot reconciliation tests
• Docker E2E for TTY and non-TTY exec lifecycle tracking
• mise run pre-commit for the initial stack branch

Checklist

• Linked to accepted issue feat: define a canonical sandbox main process and reconnectable session #2710
• Stacked above the canonical-main and restart-policy PRs
• Implementation complete
• User-facing documentation updated
• Full relevant test suite passes

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.