sayan-oai f580dd886f Enforce environment network policies for remote execution (#39980) ...

## Why

`EnvironmentConfig.network_policy` could describe attachment-owned traffic
restrictions, but core rejected every configured policy because execution did
not enforce it.

## What changed

- Resolve each remote environment's network policy for the selected command
  and apply it to the execution-scoped proxy.
- Compose owner rules with controller constraints and saved network decisions
  while preserving inherited domain and Unix-socket denials.
- Keep strict allowlists non-expandable, allow reviewable policies to use
  network approvals, and reject sandbox escalation that would bypass an owner
  policy.
- Reject policies for local execution, disabled managed enforcement, or a
  disabled controller proxy.

## Testing

Added coverage for policy composition, scoped remote proxy behavior, approval
and denial flows, offline execution, and unsupported environment authority.

GitOrigin-RevId: d9331f616df24de6cd13ed68196f0ff7b0ca4dd9

2026-08-21 17:29:41 +00:00

..

execution_scope.rs

Enforce environment network policies for remote execution (#39980)

2026-08-21 17:29:41 +00:00