Why: EXT-16 abstracts the interpreter launch point into an ExecBackend port (direct = byte-identical status quo; sandbox = bwrap isolation: ro root, tmpfs /home+/tmp, session/skills-only writable mounts, no network, ulimit -u fork cap, timeout kills the namespace) with config key execBackend, env AGENT_SYSTEM_EXEC_BACKEND, CLI --exec-backend and extension.Options.ExecBackend (SurfaceVersion 2.6.0-experimental). DisableExecTools stays the top-priority fail-closed switch; RDM keeps DisableExecTools=true until G3-7. Evidence: Backend #119 head 4badecb vet-and-test CI success, merged as 1a55089; local escape negatives all blocked (home secret, sibling session, network, 400-proc spawn storm, 60s-sleep timeout kill, orphan die-with-namespace) recorded in the task card evidence rows; full make test at this head recorded on the card. Impact: umbrella gitlink only; no source edits outside modules/backend. Refs: proposal modules/documents docs/proposals/2026-10-09-ext-g1-b1-b3 (EXT-16); Backend #119; Backend #110 (DisableExecTools).
ui
@ 76d6633736