[wxai-space]

Summary

• Keep safe_expression available by default and preserve trusted direct utility calls.
• Block legacy Python executors in model, dispatcher, and tool-provider invocation, including aliases and wrapped built-ins.
• Remove the registration-only sandbox gate and document the required isolation boundary.
• Keep issue Responsible Disclosure: Sandbox Escape in the Built-in Python Executor #100 open for private disclosure and version/configuration scoping.

Testing

• Targeted security regression suite: 73 passed.
• Full tracked suite on latest main plus this patch: 341 passed, 1 skipped.
• The skipped test requires an explicitly configured disposable Mem0 Graph backend.
• git diff --check passed.

Refs #100