[schlessera]

Refs #1677

What changed

Strict capability notes now tell the agent that its worker shares the server's uid and server-state protection is mask-only. Both ordinary profiles use the same disclosure, including the limit of read-only brain mounts. The governed note no longer implies that installing an as-yet-unimplemented identity helper changes the current boundary. The hosting guide describes the actual delivered state.

New native qualification covers both profiles with a configured database directory outside /tmp and the default masks. A same-uid, mode-0600 unmasked control remains readable while database bytes are hidden; the original governed/strict write rules remain. The fixed Python payload runs through the actual worker argv in an explicitly denied network namespace. This qualifies existing no-helper masking, not native storage or a second-uid broker.

Why this shape

This is the independently useful no-helper disclosure/qualification slice of #1677. Runtime status already reports shared_uid, and operational-state masking already exists; strict agent capabilities omitted that exposure. No new UI, identity-helper variable, protocol frame or status-schema input is introduced. All broker implementation and integrated second-uid/lifecycle criteria stay on the open issue.

Proof

• Failing-first: the strict capability regression fails at SHARED_UID_DISCLOSED on the original note; it executes the real note renderer and reports the missing sentence.
• Disclosure mutation: remove the strict branch's shared warning; the named strict regression fails at SHARED_UID_DISCLOSED. Restored source passes.
• Native guard mutation: drop profile maskPaths at the common launcher boundary; both cases fail exactly CONFIGURED_DATABASE_BYTES_UNREADABLE after their positive control/ownership checks pass. Restored source passes. No product mask change is included.
• Focused restored proof: 26 tests / 164 assertions, including actual bubblewrap/unshare subprocesses and the strict snapshot; zero failures.
• bun scripts/check-citations.ts: all 1,083 citations pass; moved note anchors are updated.
• bun scripts/check-changeset-packages.ts and full bunx --no-install changeset status: valid manifests and pending plan, no major bump.
• bun run check:pr --base origin/main: 626 tests / 3,724 assertions pass with lint and affected fast gates.
• Automatic PR CI 38797842191, attempt 1: all 14 selected jobs passed, including types, packaging, all four unit shards, both browser/layout shards, captures, native runtime and aggregate. Every actual job checkout log identifies 827f730739269e81a92546efd1827f6851678d6f, with immutable parents base 838f05d2ff611c72bdea8405c46f2504dccb6f24 and head 673cf1e687ee110df239206f30466039c3750b88, tree cc736dee0bceb909790da03237985df81a7ca502.
• Unit artifact 4 confirms both new native mask cases executed with 12 assertions each (2,506 tests, zero failures/skips in that shard). Unit artifact 2 confirms both capability disclosure cases executed (2,415 tests, zero failures/skips in that shard). This is no-helper qualification only.
• Earlier run 38795265019 was automatically cancelled when the branch incorporated the relevant native event-log harness repair from main. No failed test was retried. The refreshed run above supplies the final PR proof.
• Main subsequently advanced to 1cc1b34a802f0894391b9bb445fed39fed610230 through test(ui-react): await completion before snapshot assertions #1961: reconnect test/fixture acknowledgement changes and test-wait evidence only, with no worker identity/mask/native-harness change. This unrelated advancement does not require another base refresh; the PR receipts retain their actual older base/tree. The eventual main combined tree requires its own verification.

Checklist

• Complete selected current-head hosted proof passed; actual checkout receipts recorded.
• The completed slice and every remaining ui-sdk: run governed workers under their own uid, through a host-supplied identity helper in front of bwrap #1677 criterion are explicit below.
• PR and advanced issue have release milestone 0.44.0 verified before merge.
• SDK patch changeset; no dependency or version edits.
• Public text/tree leakage gates pass.
• No public machine surface or integration-contract component changes.
• Hosting guidance and moved decision citations reflect the change.

Anything left open

Refs #1677. The external supervisor/descriptor broker, optional host identity-helper input, narrow-helper authorization, genuinely different worker uid, retained private mounts/reader, lifecycle/signalling/death handling, private-file recovery, full negative controls and integrated mutation proof remain unimplemented and required on the issue. This PR does not deliver or enable them, qualify native storage, change masks or policies, or complete the parent issue. Production helper packaging remains downstream in the public hosting template. No package publication or deployment is part of this PR.