[kortiene]

Summary

• Make scoped Code Mode fail closed on authenticated remote execution by default, with an explicit isolated-process development/test opt-out.
• Add bounded JSON transport, source/result/output/nested-call limits, runtime and memory ceilings, admission control, and atomic callback cleanup.
• Make authorization, accounting, transport, event, output, and result-limit violations terminal even when generated code catches callback errors.
• Add bounded, key-safe nested event sanitization, stable ancestry, originating-turn attribution, and fixed error redaction.
• Preserve generic compatibility defaults: the restricted-agent pool remains pickle-based, sandbox tokens remain optional outside scoped Code Mode, metrics remain 0.0.0.0:8091, and server-owned limits remain unset unless configured.

Testing

• uv run --python 3.12 pytest hyperforge/tests/codemode/test_model.py hyperforge/tests/codemode/test_protocol.py hyperforge/tests/harness_sdk -q (253 passed, 1 skipped)
• make -C hyperforge lint
• make -C agents/restricted lint
• uv run --python 3.12 pytest agents/restricted/tests/test_sandbox.py -q (16 passed)
• uv run --python 3.12 pytest agents/external/tests/test_external.py -q (2 passed)
• git diff --check

Stack

Follow-up to merged foundation PR #139. This internal branch contains only the hardening delta against current main and is tree-identical to the previously reviewed fork branch at 3cc6b605e793591647c788304c1bdbf742ecb75d.

[kortiene]

Internal replacement for kortiene#2 after foundation PR #139 merged. The replacement is a single hardening commit on current main; its tree is identical to fork hardening head 3cc6b605e793591647c788304c1bdbf742ecb75d.

[vangheem]

Restricted-agent backward-compatibility concern: remote child-agent callbacks can no longer return arbitrary Pydantic models.

PythonAgent.handle_queue_item() returns the result of a published child function directly (agents/restricted/src/hyperforge_restricted/agent.py:736-741). On main, the sandbox serializer accepts any BaseModel, so those callback results can cross the remote sandbox boundary as dictionaries. This PR changes serialize() / the protocol encoder to an exact model allowlist (hyperforge/src/hyperforge/codemode/model.py:144-163 and :291-310), causing application-defined Pydantic models, including subclasses of allowed models, to fail serialization. The local process-pool path remains pickle-compatible, so this specifically regresses remote restricted-agent deployments.

Please preserve the previous callback result behavior for the generic restricted agent, for example by converting arbitrary callback BaseModel results to their prior serialized dictionary representation before transport, while retaining the strict allowlist for scoped Code Mode where it is required.