@aiwg/cockpit 2026.7.23 → 2026.7.25

package/README.md

@@ -275,6 +275,33 @@ QEMU/VM launches. Cockpit does not replace attached sessions when provisioning;
 it refreshes inventory and leaves concurrency and resource admission to
 agentic-sandbox.
 
+For VM rows, Inventory renders provider-aware fast-start actions only when the
+executor advertises the matching instance capability. Cloud Hypervisor rows can
+offer snapshot, restore, fork, and warm-pool handoff. Libvirt rows can offer
+checkpoint, restore, and warm-pool handoff when advertised. Cockpit sends
+restore, fork, and warm-pool requests through the unified sandbox
+`runtime_options` launch intent, polls the async operation resource to terminal
+state, and records request/terminal audit evidence through the Bridge. VFIO
+constraint exclusions keep unsafe fast-start actions disabled with the
+executor-provided reason.
+
+### VM provider and GPU/VFIO posture
+
+The Launch instance modal uses sandbox loadout compatibility metadata instead
+of assuming every VM provider supports every launch mode. Operators can select
+an advertised VM provider and GPU/VFIO posture. Required GPU passthrough sends
+`required_capabilities: ['device.vfio']`, excludes fast-start capabilities, and
+sets `fallback_mode: 'fail'` so Cockpit requests a cold VM launch rather than a
+snapshot/checkpoint path that would be unsafe for assigned devices. Inventory
+then displays assigned VFIO devices and executor-provided incompatibility
+reasons; it does not make VFIO generally available on hosts or loadouts that
+cannot provide it.
+
+The Apple Silicon validation path is preview-only. The sandbox `v2026.7.14`
+macOS artifact is an unsigned, unnotarized developer package, and native macOS
+is expected to lack Linux VM, Cloud Hypervisor, VFIO/GPU, vsock, and systemd
+capabilities unless the executor reports otherwise.
+
 ### Recover stale agents
 
 When a container, Docker, or VM runtime is still running but its agent
@@ -287,18 +314,25 @@ resolve an agent id.
 The Bridge handles recovery through:
 
 1. executor-owned reconnect endpoints when the sandbox exposes one, then
-2. local Docker fallback: `docker exec <container> agent-reconnect`, or
+2. local Docker fallback, only when
+   `AIWG_COCKPIT_LOCAL_DOCKER_FALLBACK=1`: `docker exec <container> agent-reconnect`,
+   or
 3. VM fallback (#1778): the same reconnect SIGHUP delivered through the libvirt
    qemu-guest-agent channel (`virsh qemu-agent-command <domain> guest-exec
-   pkill -HUP -x agent-client`). Sessions survive reconnect on agentic-sandbox
+   pkill -HUP -x agent-client`). The libvirt fallback is automatic on Linux;
+   on non-Linux hosts set `AIWG_COCKPIT_LOCAL_LIBVIRT_FALLBACK=1` for explicit
+   local-development use. Sessions survive reconnect on agentic-sandbox
    2026.7.8+ agents; older agents preserve only detached tmux sessions
    (agentic-sandbox#634).
 
 The Docker fallback requires sandbox images that include the `agent-reconnect`
 helper (agentic-sandbox v2026.7.5+ images); the VM fallback requires virsh
-access to the domain from the Bridge host. If **Reconnect** reports that no
-reconnect path is available, rebuild or repull the sandbox image, then start the
-instance again. For host targets, prefer starting Cockpit with the host daemon:
+access to the domain from the Bridge host. If **Reconnect** reports
+`local_docker_fallback_disabled` or `local_libvirt_fallback_disabled`, either
+let the sandbox handle reconnect through its own endpoint or enable the matching
+local-development fallback intentionally. If no reconnect path is available,
+rebuild or repull the sandbox image, then start the instance again. For host
+targets, prefer starting Cockpit with the host daemon:
 
 ```bash
 AIWG_COCKPIT_START_HOST_DAEMON=1 npm run cockpit:up
@@ -333,6 +367,7 @@ Tests run **at stages** — committed harnesses, never `/tmp` rigs (#1635):
 | **Dev e2e** (full control-plane chain: health→inventory→create session→attach) | `npm run e2e:cockpit-dev` | **real**, safe-skip when absent | non-blocking |
 | **Daily Linux operator gate** (protected auth + host/container + recovery + upgrade/rollback, #1842) | `npm run uat:cockpit-daily` | **real**, required/fail-closed | operator-scheduled |
 | **Release matrix** (host/docker/vm + provider workload, #1621) | `npm run uat:cockpit-live:matrix` | **real**, all three families | release gate |
+| **Provider-aware VM fast start** (#1843) | `npm --prefix apps/cockpit/web run test -- Inventory.test.tsx` · `node apps/cockpit/bridge/src/smoke.mjs` | **mock** plus live executor for release signoff | required before enabling new VM controls |
 
 ```bash
 npm --prefix apps/cockpit run check     # build web + typecheck + render/a11y tests + smokes + PoCs
@@ -349,7 +384,10 @@ host/container working-directory expectations, cleanup boundary, and report
 schema are documented in
 [Cockpit Daily Linux Operator Gate](../../docs/cockpit/daily-operator-gate.md).
 VM and Apple remain reported preview tiers and do not block the first Linux
-supported result.
+supported result. Apple preview evidence is based on the agentic-sandbox
+developer package, `darwin/arm64` host runtime discovery, and Docker Desktop
+runtime posture; production signing/notarization is tracked separately and is
+not required to pass the Cockpit Linux gate.
 
 The React UI is also browser-verified per surface (see `.playwright-mcp/cockpit-*.png`).
 Conformance (`agentic-sandbox-conformance`) was 33 pass / 0 fail / 17 skip; the
@@ -405,7 +443,8 @@ families in inventory. For each target it verifies inventory normalization,
 runtime and transport posture, session backend evidence, session create/list,
 observe attach, and a minimal provider-backed workload through a controller
 session when control is advertised. The selected provider is invoked through the
-attached session (`codex exec -s read-only ...`
+attached session (`codex exec --skip-git-repo-check -s read-only ...`
+for gate-owned non-repository workspaces,
 or `claude --print --permission-mode dontAsk --output-format text ...`) and must
 emit `AIWG_COCKPIT_LIVE_OK` and the expected discovery result (`issue-audit` by
 default). This proves a pre-authenticated agentic framework actually launched in

package/bridge/src/server.mjs

@@ -29,6 +29,12 @@ const ALLOW_MOCK_EXECUTOR = process.env.AIWG_COCKPIT_ALLOW_MOCK_EXECUTOR === '1'
 const AUTOSTART_EXECUTOR = process.env.AIWG_COCKPIT_AUTOSTART_EXECUTOR !== '0';
 const EXECUTOR_COMMAND = process.env.AIWG_COCKPIT_EXECUTOR_COMMAND ?? '';
 const EXECUTOR_TOKEN_FILE = process.env.AIWG_COCKPIT_EXECUTOR_TOKEN_FILE ?? '';
+const MCP_TOKEN_FILE = process.env.AIWG_COCKPIT_MCP_TOKEN_FILE ?? '';
+const LOCAL_DOCKER_FALLBACK = process.env.AIWG_COCKPIT_LOCAL_DOCKER_FALLBACK === '1';
+const REQUIRE_SANDBOX_MTLS = process.env.AIWG_COCKPIT_REQUIRE_SANDBOX_MTLS === '1';
+export function localLibvirtFallbackAllowed(platform = process.platform, envValue = process.env.AIWG_COCKPIT_LOCAL_LIBVIRT_FALLBACK) {
+  return platform === 'linux' || envValue === '1';
+}
 const RUNTIME_DIR = join(homedir(), '.aiwg', 'cockpit', 'runtime');
 const auditDir = () => process.env.AIWG_COCKPIT_AUDIT_DIR || join(homedir(), '.aiwg', 'cockpit', 'audit');
 const auditLog = () => join(auditDir(), 'events.jsonl');
@@ -422,7 +428,11 @@ function isConnectionRefusedError(err) {
 }
 
 function rethrowExecutorSecurityError(err) {
-  if ([401, 403].includes(Number(err?.upstreamStatus)) || String(err?.code ?? '').startsWith('executor_credential_')) throw err;
+  if (
+    [401, 403].includes(Number(err?.upstreamStatus)) ||
+    String(err?.code ?? '').startsWith('executor_credential_') ||
+    String(err?.code ?? '').startsWith('executor_trust_')
+  ) throw err;
 }
 
 export async function fetchJsonFirst(candidates, { method = 'GET', headers, body: requestBodyOption, timeoutMs = 0 } = {}) {
@@ -507,10 +517,19 @@ async function getExecutorCapabilities(executorUrl) {
   const candidates = ['/healthz/deep', '/healthz', '/health'].map((path) => `${executorUrl}${path}`);
   try {
     const { target, body } = await fetchJsonFirst(candidates);
+    const runtimeProviders = await fetchJsonFirst([
+      `${executorUrl}/api/v2/admin/runtime/providers`,
+      `${executorUrl}/api/v2/runtime/providers`,
+      `${executorUrl}/admin/runtime/providers`,
+      `${executorUrl}/runtime/providers`,
+    ])
+      .then((result) => result.body)
+      .catch(() => undefined);
     return {
       status: 'ok',
       source: new URL(target).pathname,
       host_runtime_enabled: body.host_runtime_enabled === true || body.hostRuntimeEnabled === true,
+      runtime_providers: runtimeProviders && Array.isArray(runtimeProviders.providers) ? runtimeProviders : undefined,
       raw_status: body.status ?? body.state ?? 'unknown',
     };
   } catch (err) {
@@ -524,6 +543,120 @@ async function getExecutorCapabilities(executorUrl) {
   }
 }
 
+async function getMcpDiscovery(executorUrl) {
+  try {
+    const { target, body } = await fetchJsonFirst([
+      `${executorUrl}/api/v2/admin/mcp/discovery`,
+      `${executorUrl}/admin/mcp/discovery`,
+    ]);
+    return {
+      source: executorUrl,
+      discovery_path: new URL(target).pathname,
+      fetched_at: new Date().toISOString(),
+      ...normalizeMcpDiscovery(body, executorUrl),
+    };
+  } catch (err) {
+    rethrowExecutorSecurityError(err);
+    return normalizeMcpDiscovery({
+      enabled: false,
+      status: 'disabled',
+      reason_code: 'mcp.discovery_unavailable',
+      error: String(err?.message ?? err),
+    }, executorUrl);
+  }
+}
+
+function normalizeMcpDiscovery(body, source) {
+  const endpoint = body?.endpoint && typeof body.endpoint === 'object' ? body.endpoint : {};
+  const auth = body?.auth && typeof body.auth === 'object' ? body.auth : {};
+  return {
+    source: source ?? body?.source,
+    enabled: body?.enabled === true,
+    status: body?.status ?? (body?.enabled === true ? 'enabled' : 'disabled'),
+    reason_code: body?.reason_code ?? body?.reasonCode ?? null,
+    error: body?.error,
+    endpoint: {
+      path: endpoint.path ?? '/mcp',
+      methods: Array.isArray(endpoint.methods) ? endpoint.methods : ['POST'],
+      transport: endpoint.transport ?? 'streamable-http',
+      stateless: endpoint.stateless !== false,
+      get_behavior: endpoint.get_behavior ?? endpoint.getBehavior ?? '405_method_not_allowed',
+      mcp_session_id: endpoint.mcp_session_id ?? endpoint.mcpSessionId ?? false,
+    },
+    protocol: body?.protocol ?? { latest: '2025-11-25', supported: [] },
+    auth: {
+      scheme: auth.scheme ?? 'bearer',
+      required: auth.required !== false,
+      principal_config: auth.principal_config ?? auth.principalConfig ?? 'mcp-principals.toml',
+      principals: Array.isArray(auth.principals) ? auth.principals.map((principal) => ({
+        client_id: principal.client_id ?? principal.clientId ?? '',
+        scopes: Array.isArray(principal.scopes) ? principal.scopes : [],
+      })).filter((principal) => principal.client_id) : [],
+      scopes: Array.isArray(auth.scopes) ? auth.scopes : [],
+    },
+    capabilities: body?.capabilities ?? {},
+    tools: Array.isArray(body?.tools) ? body.tools : [],
+    resources: Array.isArray(body?.resources) ? body.resources : [],
+    resource_templates: Array.isArray(body?.resource_templates)
+      ? body.resource_templates
+      : Array.isArray(body?.resourceTemplates) ? body.resourceTemplates : [],
+    errors: Array.isArray(body?.errors) ? body.errors : [],
+    notes: Array.isArray(body?.notes) ? body.notes : [],
+  };
+}
+
+async function proxyMcpRequest(req, res, executorUrl, mcpTokenFile) {
+  if (!mcpTokenFile) {
+    await appendAudit('sandbox.mcp.proxy', {
+      result: 'blocked',
+      reason: 'mcp_token_file_unconfigured',
+    });
+    return json(res, 503, {
+      error: 'mcp_token_file_unconfigured',
+      message: 'Bridge MCP proxy requires AIWG_COCKPIT_MCP_TOKEN_FILE.',
+    });
+  }
+  const parsed = await readJsonBody(req);
+  if (parsed.error) return json(res, 400, { error: parsed.error });
+  const body = parsed.body || {};
+  const rpcMethod = typeof body.method === 'string' ? body.method : 'unknown';
+  const target = `${executorUrl}/mcp`;
+  let status = 502;
+  try {
+    const token = await resolveExecutorBearer(mcpTokenFile);
+    const headers = {
+      authorization: `Bearer ${token}`,
+      'content-type': 'application/json',
+      accept: 'application/json, text/event-stream',
+    };
+    const protocolVersion = req.headers['mcp-protocol-version'];
+    if (typeof protocolVersion === 'string' && protocolVersion.trim()) {
+      headers['mcp-protocol-version'] = protocolVersion.trim();
+    }
+    const response = await fetch(target, {
+      method: 'POST',
+      headers,
+      body: JSON.stringify(body),
+    });
+    status = response.status;
+    const responseBody = await response.json().catch(() => ({}));
+    await appendAudit('sandbox.mcp.proxy', {
+      result: response.ok ? 'ok' : 'error',
+      method: rpcMethod,
+      status,
+    });
+    return json(res, status, responseBody);
+  } catch (err) {
+    await appendAudit('sandbox.mcp.proxy', {
+      result: 'error',
+      method: rpcMethod,
+      status,
+      error: String(err?.code ?? err?.message ?? err),
+    });
+    throw err;
+  }
+}
+
 function defaultExecutorCommand() {
   if (EXECUTOR_COMMAND) return EXECUTOR_COMMAND.split(/\s+/).filter(Boolean);
   const candidates = [
@@ -580,6 +713,110 @@ async function proxyFirst(res, candidates, options) {
   }
 }
 
+function normalizedInstanceName(value, fallback = 'cockpit-fast-start') {
+  const cleaned = String(value || fallback)
+    .toLowerCase()
+    .replace(/[^a-z0-9-]/g, '-')
+    .replace(/-+$/g, '')
+    .slice(0, 63);
+  const prefixed = /^[a-z]/.test(cleaned) ? cleaned : `a-${cleaned.replace(/^-+/, '')}`;
+  return prefixed && prefixed.length >= 2 ? prefixed.slice(0, 63) : fallback;
+}
+
+function instanceVmName(instance, instanceId) {
+  return instance?.launch_context?.name
+    ?? instance?.launchContext?.name
+    ?? instance?.name
+    ?? instance?.id
+    ?? instanceId;
+}
+
+function defaultAssetRef(instanceId, action) {
+  return `${normalizedInstanceName(instanceId, 'cockpit-vm')}-${action}-${Date.now().toString(36)}`.slice(0, 96);
+}
+
+function upstreamBridgeError(err) {
+  rethrowExecutorSecurityError(err);
+  return { status: 502, body: { error: 'bridge_upstream_error', message: String(err?.message ?? err) } };
+}
+
+async function providerFastStartAction(upstreamUrl, instanceId, action, body = {}) {
+  let inventory;
+  try { inventory = await getInventory(upstreamUrl); }
+  catch (err) { rethrowExecutorSecurityError(err); inventory = { instances: [] }; }
+  const inst = inventory.instances.find((i) => String(i.id) === String(instanceId));
+  if (!inst) return { status: 404, body: { error: 'instance_not_found', instance_id: instanceId } };
+  const runtime = String(inst.runtime_posture?.kind ?? inst.runtime ?? '').toLowerCase();
+  if (!['vm', 'qemu', 'kvm'].includes(runtime)) {
+    return { status: 422, body: { error: 'unsupported_runtime', message: 'fast-start actions are valid only for VM instances' } };
+  }
+  const provider = String(inst.provider ?? '').trim();
+  if (!provider) return { status: 422, body: { error: 'provider_required', message: 'executor inventory did not report an effective VM provider' } };
+
+  const vmName = instanceVmName(inst, instanceId);
+  const rawAsset = body.asset_ref ?? body.assetRef ?? body.snapshot_id ?? body.snapshotId ?? body.checkpoint_id ?? body.checkpointId ?? body.pool;
+  const assetRef = String(rawAsset ?? '').trim();
+  const restoreMode = String(body.restore_mode ?? body.restoreMode ?? 'ondemand').trim() || 'ondemand';
+  const childName = normalizedInstanceName(
+    body.name ?? body.child_name ?? body.childName,
+    `${normalizedInstanceName(vmName, 'cockpit-vm')}-${action === 'warm-pool' ? 'warm' : action}`,
+  );
+
+  if (action === 'snapshot' || action === 'checkpoint') {
+    const newAssetRef = assetRef || defaultAssetRef(vmName, provider === 'libvirt' ? 'checkpoint' : 'snapshot');
+    if (provider === 'cloud-hypervisor') {
+      return fetchJsonFirst([{
+        target: `${upstreamUrl}/api/v2/admin/cloud-hypervisor/snapshots`,
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+          vm: vmName,
+          snapshot_id: newAssetRef,
+          pre_enrollment: body.pre_enrollment ?? body.preEnrollment ?? true,
+        }),
+      }]).catch(upstreamBridgeError);
+    }
+    if (provider === 'libvirt') {
+      return fetchJsonFirst([{
+        target: `${upstreamUrl}/api/v2/admin/libvirt/checkpoints`,
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+          vm: vmName,
+          checkpoint_id: newAssetRef,
+          pre_enrollment: true,
+        }),
+      }]).catch(upstreamBridgeError);
+    }
+    return { status: 422, body: { error: 'unsupported_provider_action', provider, action } };
+  }
+
+  if (!assetRef) {
+    return { status: 400, body: { error: 'asset_ref_required', message: 'restore, fork, and warm-pool actions require an opaque asset_ref' } };
+  }
+  const mode = action === 'warm-pool' ? 'warm_pool' : action;
+  return fetchJsonFirst([{
+    target: `${upstreamUrl}/api/v2/admin/instances`,
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({
+      name: childName,
+      runtime: 'qemu',
+      provider,
+      runtime_options: {
+        kind: 'vm',
+        provider,
+        launch_strategy: {
+          mode,
+          prefer_fast_start: true,
+          asset_ref: assetRef,
+          ...(provider === 'cloud-hypervisor' ? { restore_mode: restoreMode } : {}),
+        },
+      },
+    }),
+  }]).catch(upstreamBridgeError);
+}
+
 async function destroyInstance(upstreamUrl, instanceId) {
   let inventory;
   try { inventory = await getInventory(upstreamUrl); }
@@ -596,7 +833,7 @@ async function destroyInstance(upstreamUrl, instanceId) {
   try {
     const result = await fetchJsonFirst(candidates);
     if (result.status < 400) {
-      if (['docker', 'container'].includes(runtime) && dockerName) {
+      if (LOCAL_DOCKER_FALLBACK && ['docker', 'container'].includes(runtime) && dockerName) {
         try {
           await spawnCollect('docker', ['rm', '-f', dockerName]);
           return {
@@ -648,6 +885,18 @@ async function destroyInstance(upstreamUrl, instanceId) {
       body: { error: 'instance_not_destroyable', message: `No destroyable runtime record for ${instanceId}` },
     };
   }
+  if (!LOCAL_DOCKER_FALLBACK) {
+    return {
+      target: `${upstreamUrl}/api/v2/admin/instances/${encodeURIComponent(instanceId)}/destroy`,
+      status: 409,
+      body: {
+        error: 'local_docker_fallback_disabled',
+        message: 'Sandbox management did not accept this destroy request. Local docker rm fallback is disabled unless AIWG_COCKPIT_LOCAL_DOCKER_FALLBACK=1 is set for local development.',
+        runtime,
+        docker_name: dockerName,
+      },
+    };
+  }
 
   let alreadyGone = false;
   try {
@@ -730,6 +979,18 @@ async function reconnectInstance(upstreamUrl, instanceId) {
   }
 
   if (['docker', 'container'].includes(runtime) && dockerName) {
+    if (!LOCAL_DOCKER_FALLBACK) {
+      return {
+        target: `${upstreamUrl}/api/v2/admin/instances/${encodeURIComponent(instanceId)}/reconnect`,
+        status: 409,
+        body: {
+          error: 'local_docker_fallback_disabled',
+          message: 'Sandbox management did not accept this reconnect request. Local docker exec fallback is disabled unless AIWG_COCKPIT_LOCAL_DOCKER_FALLBACK=1 is set for local development.',
+          runtime,
+          docker_name: dockerName,
+        },
+      };
+    }
     try {
       const output = await spawnCollect('docker', ['exec', dockerName, 'agent-reconnect']);
       return {
@@ -759,6 +1020,19 @@ async function reconnectInstance(upstreamUrl, instanceId) {
   }
 
   if (VM_RUNTIME_KINDS.includes(runtime)) {
+    if (!localLibvirtFallbackAllowed()) {
+      return {
+        target: `${upstreamUrl}/api/v2/admin/instances/${encodeURIComponent(instanceId)}/reconnect`,
+        status: 409,
+        body: {
+          error: 'local_libvirt_fallback_disabled',
+          message: 'Sandbox management did not accept this reconnect request. Local virsh fallback is only automatic on Linux; set AIWG_COCKPIT_LOCAL_LIBVIRT_FALLBACK=1 for explicit local development on this host.',
+          runtime,
+          platform: process.platform,
+          arch: process.arch,
+        },
+      };
+    }
     // For VM instances the agent_id doubles as the libvirt domain name
     // (agentic-sandbox provision-vm.sh registers agent_id = $vm_name).
     const domain = dockerName ?? inst?.name ?? String(instanceId);
@@ -933,6 +1207,109 @@ function normalizeTransport(posture) {
   };
 }
 
+function safeRef(value) {
+  const ref = typeof value === 'string' ? value.trim() : '';
+  if (!ref) return undefined;
+  if (/-----BEGIN|PRIVATE KEY|TOKEN|SECRET|PASSWORD|[\r\n]/i.test(ref)) return '[redacted]';
+  return ref.slice(0, 160);
+}
+
+function normalizeBootstrapTrustReadiness(body, executorUrl, { available = true } = {}) {
+  const ca = body?.ca_provider && typeof body.ca_provider === 'object' ? body.ca_provider : {};
+  const bootstrap = body?.bootstrap && typeof body.bootstrap === 'object' ? body.bootstrap : {};
+  const status = String(body?.status ?? (available ? 'unknown' : 'disabled')).toLowerCase();
+  const normalizedStatus = ['secure', 'degraded', 'disabled'].includes(status)
+    ? status
+    : (ca.configured === true || ca.available === true ? 'degraded' : 'disabled');
+  const trustFresh = ca.trust_bundle_fresh ?? ca.trustBundleFresh ?? ca.fresh;
+  const tokenStoreConfigured = bootstrap.token_store_configured ?? bootstrap.tokenStoreConfigured;
+  const caConfigured = ca.configured ?? ca.available;
+  const missing = [];
+  if (caConfigured === false) missing.push('ca_provider');
+  if (tokenStoreConfigured === false) missing.push('bootstrap_token_store');
+  if (trustFresh === false) missing.push('fresh_trust_bundle');
+  const plaintextDev = new URL(executorUrl).protocol === 'http:' && isLocalHostName(new URL(executorUrl).hostname);
+  const recovery = normalizedStatus === 'secure'
+    ? 'Sandbox CA and bootstrap trust are ready.'
+    : normalizedStatus === 'degraded'
+      ? 'Refresh sandbox CA/bootstrap readiness, rotate stale trust material, then reload Cockpit.'
+      : plaintextDev
+        ? 'Plaintext local development mode only; enable sandbox mTLS before using remote or shared executors.'
+        : 'Configure sandbox CA provider and client trust refs before connecting Cockpit.';
+  return {
+    status: normalizedStatus,
+    mode: normalizedStatus === 'secure' ? 'mtls' : (plaintextDev ? 'plaintext-dev' : 'disabled'),
+    label: normalizedStatus === 'secure'
+      ? 'Sandbox mTLS ready'
+      : normalizedStatus === 'degraded'
+        ? 'Sandbox trust degraded'
+        : (plaintextDev ? 'Plaintext dev mode' : 'Sandbox trust disabled'),
+    source: body?.source ?? '/api/v2/admin/bootstrap/readiness',
+    ca_provider_ref: safeRef(ca.provider_ref ?? ca.providerRef ?? ca.provider ?? ca.id ?? ca.name),
+    trust_bundle_ref: safeRef(ca.trust_bundle_ref ?? ca.trustBundleRef ?? ca.bundle_ref ?? ca.bundleRef),
+    client_identity_ref: safeRef(ca.client_identity_ref ?? ca.clientIdentityRef ?? ca.identity_ref ?? ca.identityRef),
+    rotation_state: safeRef(ca.rotation_state ?? ca.rotationState ?? ca.state),
+    expires_at: safeRef(ca.expires_at ?? ca.expiresAt ?? ca.not_after ?? ca.notAfter),
+    trust_bundle_fresh: trustFresh === undefined ? undefined : Boolean(trustFresh),
+    token_store_configured: tokenStoreConfigured === undefined ? undefined : Boolean(tokenStoreConfigured),
+    missing_required_material: missing,
+    recovery,
+  };
+}
+
+function assertRequiredBootstrapTrust(posture) {
+  if (posture.status === 'secure' && posture.missing_required_material.length === 0) return;
+  const err = executorAuthError(
+    'executor_trust_required',
+    `sandbox mTLS is required but bootstrap trust is ${posture.status}: ${posture.recovery}`,
+  );
+  err.upstreamStatus = 503;
+  err.recovery = posture.recovery;
+  throw err;
+}
+
+async function getBootstrapTrustPosture(executorUrl, { requireSandboxMtls = false } = {}) {
+  try {
+    const { target, body } = await fetchJsonFirst([
+      `${executorUrl}/api/v2/admin/bootstrap/readiness`,
+      `${executorUrl}/admin/bootstrap/readiness`,
+    ]);
+    const posture = normalizeBootstrapTrustReadiness({ ...body, source: new URL(target).pathname }, executorUrl);
+    if (requireSandboxMtls) assertRequiredBootstrapTrust(posture);
+    return posture;
+  } catch (err) {
+    rethrowExecutorSecurityError(err);
+    const posture = normalizeBootstrapTrustReadiness({
+      status: 'disabled',
+      source: '/api/v2/admin/bootstrap/readiness',
+      ca_provider: { configured: false },
+      bootstrap: { token_store_configured: false },
+    }, executorUrl, { available: false });
+    if (requireSandboxMtls) assertRequiredBootstrapTrust(posture);
+    return posture;
+  }
+}
+
+function normalizeStoragePosture(posture) {
+  const raw = posture && typeof posture === 'object' ? posture : {};
+  return {
+    persistent: Boolean(raw.persistent ?? raw.persists ?? raw.persistence === 'persistent'),
+    delete_on_destroy: Boolean(raw.delete_on_destroy ?? raw.deleteOnDestroy),
+    scope: raw.scope ?? raw.storage_scope ?? raw.storageScope,
+    reason: raw.reason ?? raw.detail,
+  };
+}
+
+function normalizeLifecycle(lifecycle) {
+  const raw = lifecycle && typeof lifecycle === 'object' ? lifecycle : {};
+  return {
+    destroy: raw.destroy ?? raw.delete ?? raw.remove,
+    reconnect: raw.reconnect,
+    start: raw.start,
+    stop: raw.stop,
+  };
+}
+
 function normalizeSessionBackends(backends, runtimeKind, state = 'unknown', agentReady = false) {
   const list = Array.isArray(backends) ? backends : [];
   if (!list.length && runtimeKind === 'host') {
@@ -984,6 +1361,10 @@ function normalizeInstance(executorUrl, i) {
   return {
     id,
     runtime,
+    provider: i.provider ?? i.runtime_provider ?? i.runtimeProvider ?? i.runtime?.provider,
+    capabilities: Array.isArray(i.capabilities) ? i.capabilities : i.runtime?.capabilities,
+    capability_constraints: i.capability_constraints ?? i.capabilityConstraints ?? i.runtime?.capability_constraints ?? i.runtime?.capabilityConstraints,
+    gpu: i.gpu ?? i.gpu_posture ?? i.gpuPosture ?? i.runtime?.gpu,
     loadout,
     state: i.state ?? i.status ?? 'unknown',
     tenant: i.tenant_id ?? i.tenant ?? i.tenantId ?? 'default',
@@ -1005,6 +1386,8 @@ function normalizeInstance(executorUrl, i) {
       image_ref: i.image_ref ?? i.imageRef ?? i.runtime_extension?.image_ref ?? i.runtimeExtension?.imageRef,
       source: i.runtime_extension ? 'agent-card runtime extension' : i.launch_context?.source ?? i.launchContext?.source,
     },
+    storage: normalizeStoragePosture(i.storage ?? i.storage_posture ?? i.storagePosture ?? i.lifecycle?.storage),
+    lifecycle: normalizeLifecycle(i.lifecycle ?? i.lifecycle_support ?? i.lifecycleSupport),
     agent_ready: agentReady,
     registered_agent_id: i.registered_agent_id ?? i.registeredAgentId,
     session_backends: normalizeSessionBackends(i.session_backends ?? i.sessionBackends ?? i.session_host?.backends ?? i.sessionHost?.backends ?? i.capabilities?.session_backends ?? i.capabilities?.sessionBackends, runtimePosture.kind, i.state ?? i.status, agentReady),
@@ -1026,7 +1409,11 @@ function defaultSessionLaunch(instance) {
     };
   }
   if (runtime === 'container' || runtime === 'docker' || runtime === 'vm' || runtime === 'qemu' || runtime === 'kvm') {
-    const home = runtime === 'container' || runtime === 'docker' ? '/root' : '/home/agent';
+    // Prefer the executor-reported target-local cwd. Current agentic-sandbox
+    // container and VM contracts report `/home/agent`; retain that value as a
+    // compatibility fallback for older inventory responses. `/root` is not
+    // readable by the mandatory uid 10001 container identity.
+    const home = instance?.launch_context?.cwd ?? '/home/agent';
     return {
       command: '/bin/bash',
       args: ['-lc', `cd ${shellSingleQuote(home)} && exec /bin/bash -l`],
@@ -1154,7 +1541,8 @@ async function getAgentBackedHostInventory(executorUrl, degradedDetail) {
 }
 
 /** Normalize the executor's admin inventory into the Bridge's UI shape. */
-async function getInventory(executorUrl) {
+async function getInventory(executorUrl, { requireSandboxMtls = false } = {}) {
+  const bootstrapTrust = await getBootstrapTrustPosture(executorUrl, { requireSandboxMtls });
   const { target, status, body } = await fetchJsonFirst([
     `${executorUrl}/admin/instances`,
     `${executorUrl}/api/v2/admin/instances`,
@@ -1176,6 +1564,7 @@ async function getInventory(executorUrl) {
         count: 0,
         degraded_admin_inventory: detail,
         admin_error: body,
+        bootstrap_trust: bootstrapTrust,
         instances: [],
       };
     }
@@ -1190,6 +1579,8 @@ async function getInventory(executorUrl) {
     admin_path: new URL(target).pathname,
     fetched_at: new Date().toISOString(),
     count: normalized.length,
+    bootstrap_trust: bootstrapTrust,
+    degraded_providers: body?.degraded_providers,
     instances: normalized,
   };
 }
@@ -1240,6 +1631,8 @@ async function getLoadouts(executorUrl) {
       label: l.label ?? l.display_name ?? l.displayName ?? id,
       description: l.description ?? l.summary,
       runtimes: l.runtimes ?? l.runtime_kinds ?? l.supported_runtimes,
+      runtime_options: l.runtime_options ?? l.runtimeOptions,
+      compatibility: l.compatibility,
     };
   }).filter((l) => l.id);
   return { source: executorUrl, loadouts_path: new URL(target).pathname, count: loadouts.length, loadouts };
@@ -1854,6 +2247,7 @@ export function createBridge({
   allowMockExecutor = ALLOW_MOCK_EXECUTOR,
   token,
   executorTokenFile = EXECUTOR_TOKEN_FILE,
+  requireSandboxMtls = REQUIRE_SANDBOX_MTLS,
 } = {}) {
   const upstreamUrl = executorUrl;
   const TOKEN = token ?? randomBytes(24).toString('hex');
@@ -1891,8 +2285,11 @@ export function createBridge({
       if (url.pathname.startsWith('/api/')) {
         try {
           await assertRealExecutor(upstreamUrl, allowMockExecutor);
+          if (requireSandboxMtls) {
+            await getBootstrapTrustPosture(upstreamUrl, { requireSandboxMtls: true });
+          }
         } catch (err) {
-          return json(res, 502, { error: err.code ?? 'executor_refused', message: String(err?.message ?? err) });
+          return json(res, Number(err?.upstreamStatus) || 502, { error: err.code ?? 'executor_refused', message: String(err?.message ?? err), recovery: err?.recovery });
         }
       }
       if (url.pathname === '/api/events' && req.method === 'GET') {
@@ -1910,8 +2307,13 @@ export function createBridge({
         req.on('close', () => clearInterval(timer));
         return;
       }
-      if (url.pathname === '/api/inventory') return json(res, 200, await getInventory(upstreamUrl));
+      if (url.pathname === '/api/inventory') return json(res, 200, await getInventory(upstreamUrl, { requireSandboxMtls }));
       if (url.pathname === '/api/executor/capabilities') return json(res, 200, await getExecutorCapabilities(upstreamUrl));
+      if (url.pathname === '/api/bootstrap/readiness' && req.method === 'GET') {
+        return json(res, 200, await getBootstrapTrustPosture(upstreamUrl, { requireSandboxMtls }));
+      }
+      if (url.pathname === '/api/mcp/discovery' && req.method === 'GET') return json(res, 200, await getMcpDiscovery(upstreamUrl));
+      if (url.pathname === '/api/mcp' && req.method === 'POST') return proxyMcpRequest(req, res, upstreamUrl, MCP_TOKEN_FILE);
       if (url.pathname === '/api/running') return json(res, 200, await getRunning(upstreamUrl));
       if (url.pathname === '/api/missions') return json(res, 200, await getMissions(upstreamUrl));
       if (url.pathname === '/api/events/snapshot') return json(res, 200, await getEventSnapshot(upstreamUrl));
@@ -2175,6 +2577,29 @@ export function createBridge({
       }
 
       // --- management surface (UC-012): lifecycle + task cancel ---
+      if ((m = url.pathname.match(/^\/api\/instances\/([^/]+)\/(snapshot|checkpoint|restore|fork|warm-pool)$/)) && req.method === 'POST') {
+        const parsed = await readJsonBody(req);
+        if (parsed.error) return json(res, 400, { error: parsed.error });
+        const instanceId = decodeURIComponent(m[1]);
+        const action = m[2];
+        const body = parsed.body || {};
+        const before = await appendAudit('instance.fast_start.requested', {
+          instance_id: instanceId,
+          action,
+          asset_ref: body.asset_ref ?? body.assetRef ?? body.snapshot_id ?? body.snapshotId ?? body.checkpoint_id ?? body.checkpointId ?? body.pool,
+          name: body.name ?? body.child_name ?? body.childName,
+        });
+        const result = await providerFastStartAction(upstreamUrl, instanceId, action, body);
+        await appendAudit('instance.fast_start.accepted', {
+          request_ts: before.ts,
+          instance_id: instanceId,
+          action,
+          status: result.status,
+          operation_id: result.body?.id ?? result.body?.operation?.id,
+          result: result.body,
+        });
+        return json(res, result.status, result.body);
+      }
       if ((m = url.pathname.match(/^\/api\/instances\/([^/]+)\/(start|stop)$/)) && req.method === 'POST') {
         const result = await fetchJsonFirst([
           `${upstreamUrl}/admin/instances/${encodeURIComponent(m[1])}/${m[2]}`,