[dshakes]

GA next-gen: audit-driven hardening plus sandbox lifecycle. The full plan and findings table are in docs/roadmap/2026-10-nextgen-sandbox-and-harness.md.

Wave 1: correctness and security

• Helm. JWT_SECRET is now wired from a secretKeyRef, and LANTERN_ENV defaults to production, so the prod guards are on. Added values-prod.yaml.
• Spawn contract. AgentSpec limits, egress and secrets now reach the guest through spawn.json on the cert drive (ADR 0025). Workloads drop privileges to LANTERN_WORKLOAD_UID.
• runtime-manager authz. Each call is checked as either a VM cert or the service token. ExecTool is tenant-scoped (proto field 8).
• model-router. Service-token auth, fail-closed in prod.
• API keys. A key can no longer grant itself scopes it doesn't have, and more mutating routes carry WithScope.
• Startup guards. Slack, Twilio and claude-code settings are now checked at startup.
• Scheduler. Quota slots are released, idempotency is tenant-scoped, and the run-path idempotency key now includes the attempt.
• Harness. Tool and exec output is capped. The exec bearer token is compared in constant time.

Cost

• Workflow ai-step calls, confidence votes and web_search are now metered and budget-checked.
• Prompt caching now covers the streaming and no-tools paths.
• LLM idempotency keys include a body hash.
• New tenant-wide budget cap at /v1/budgets/tenant.

Wave 2: pause, resume, fork

• New endpoints:
  • POST /v1/runtime/vms/{id}/pause
  • POST /v1/runtime/vms/{id}/resume
  • POST /v1/runtime/vms/{id}/fork with body {"count":N}, N from 1 to 10
• Exposed through the TS, Python and Go SDKs, the CLI, and the dashboard VM detail page.
• Identity on restore.
  • A restored VM gets its identity from the wire vm_id and re-identifies itself.
  • Each incarnation gets its own exec token.
  • Each fork child gets a fresh agent identity.
  • A bare fork of a live source is refused (fail-closed).
• Resume and snapshots. A resumed VM gets a grace window before heartbeat reconcile can terminate it. A snapshot no VM references any more is logged as orphaned; a DeleteSnapshot RPC is listed as a follow-up in ADR 0025.

Bridges

• New LLM-judged commitments ledger. An entry closes only on verbatim evidence.
• New encrypted sent-log and an alarm when the introspect audit goes stale.
• New parity gate test between the two bridges.
• Fixed the WhatsApp tests that broke when group replies became default-off.

Deps

• Next 15.5.28 plus postcss and sharp overrides in web, docs and landing. npm audit --omit=dev reports 0.

Verification (run locally on the integrated branch)

• Go: gofmt, vet and test pass in every module that uses gen/go (control-plane with DATABASE_URL). runtime-scheduler also passes with -race.
• Rust: fmt, clippy -D warnings and test pass for runtime-manager (398), harness (186) and model-router.
• TypeScript: tsc and tests pass for bridge-core, the WhatsApp bridge, the iMessage bridge and sdk-ts.
• Python: sdk-python pytest passes.
• Web and docs: apps/web tsc, eslint and build pass. The docs build with PAGES_BASE_PATH=/lantern passes.
• Helm: helm template renders with the default, dev, staging and prod values.
• Browser: checked against an isolated control-plane (HTTP_ADDR=:8090, its own DB, stub scheduler). On the dashboard VM detail page, Pause → Resume → Fork ×3 all completed, with no console errors.

Needs a human

• Firecracker/KVM end-to-end on a Linux host. Re-identify and the guest ioctls are compiled and unit-tested only.
• Live bridge validation in real logs after deploy.
• helm install on a real cluster.
• Deploy order: deploy the scheduler before or together with the control-plane. An older scheduler ignores the per-fork identities.