Phase 4: authenticate admission bridge callers

[johnnygreco]

Objective

Restrict the sandbox-local admission bridge to the operator-launched harness process using a per-exec capability delivered on an inherited file descriptor.

Context

• Tracker: GitHub goal delivery: close Pi attested-admission gaps #50
• The bridge currently accepts any sandbox process. Egress still blocks unattested provider requests, but caller identity is the remaining runtime primitive.

Scope

• OpenShell supervisor exec path: mint/register/revoke 32-byte tokens per exec; pass through a pipe fd; expose only OPENSHELL_AGENT_ADMISSION_TOKEN_FD.
• Bridge: require bearer token when enabled, reject missing/wrong/revoked tokens, allow explicit debug opt-out.
• Runtime launcher: read/close fd once, delete env name, retain token only in closure, send authorization header, fail clearly if descriptor delivery fails.
• Add bridge and lifecycle tests plus demo unauthenticated-bridge negative control.
• Non-goals: environment token, Unix peer-credential approximation, persistent identity service.
• Dependencies: Phase 3 bridge contract stable.

Acceptance Criteria

• Harness call succeeds with its registered token.
• Tool subprocess and raw curl lack the token and receive caller_not_authorized.
• Token is revoked when the exec process exits.
• Debug opt-out is explicit and documented.

Required Validation

OpenShell pre-commit/test/ci, focused sandbox and exec tests, relevant sandbox E2E, Research JS adapter and demo tests.

PR Expectations

Treat this as security-sensitive infrastructure. Review fd ownership, inheritance, revocation, error paths, logging, and residual same-user memory-reading risk.