P0: Diagnose sandbox_not_configured through the actual restricted-user execution path #153

Evidence and scope

Based on a private support handover dated 2026-10-02 and a follow-up report dated 2026-10-06. Customer identities, deployment coordinates, project paths, session identifiers, and raw attachments are deliberately omitted. Code references are pinned to current public master (3f90286), not the reporter's deployed build or uncommitted local changes. Production was not accessed or modified during this triage.

Reported evidence and uncertainty

Earlier restricted-user Sessions, including a continuation Session, returned sandbox_not_configured and outside_allowed_roots. Later direct broker probes succeeded after a separate image repair. Successful direct probes do not demonstrate that the authenticated Frontend → Host → Harness path resolves the same working policy and broker client.

This is a deployment/configuration or integration diagnosis task, not a confirmed defect in one particular module. Distinguish sandbox_not_configured (no usable executor result before execution) from missing-image Docker exit 125 (broker reached, container creation failed). Do not assume all outside_allowed_roots denials are incorrect; the handoff storage denial is tracked in #150.

Code and investigation seams

• Tool execution emits sandbox_not_configured when sandbox execution is required but returns no result.
• Sandbox shell client.
• Host bootstrap and Host construction.
• Existing Host shell tests, Tool tests, and sandbox hosting guide.

Investigation and acceptance

• Pin actual deployed web, broker, and configuration revisions separately; do not infer them from an arbitrary source checkout.
• Using approved test Accounts, reproduce a real authenticated prompt invoking shell in a granted temporary Project with an entitled model.
• Compare actor policy revision, grants, shell capability, executor injection, and broker-client configuration across initial startup, restart, and upgrade.
• Exercise read/write grants, no grants, revoked grants, missing endpoint/token, broker outage, missing image, and missing runtime independently.
• Correctly configured restricted users can execute within grants; denied/out-of-grant operations remain denied.
• UI distinguishes a policy denial, shell not configured, broker unreachable, and runtime/image failure with actionable en/de/es messages.
• Add regression coverage at the actual Host/Harness integration seam, not only a direct owner/broker probe.

Never fix this by disabling path checks, exposing secrets, granting global filesystem access, or falling back to an unrestricted Host shell. Deployment image lifecycle and readiness are tracked in #152.