fix(runtime): preserve sandbox negotiation across continuations

packages/core/src/backend-types.ts

@@ -39,7 +39,11 @@ import type {
 } from './events.js';
 import type { InteractionClosureReason } from './interaction.js';
 import type { RuntimeEvent } from './runtime-event.js';
-import type { SandboxBoundaryResponse, SandboxBoundarySettlement } from './sandbox-boundary.js';
+import type {
+  SandboxBoundaryNegotiationState,
+  SandboxBoundaryResponse,
+  SandboxBoundarySettlement,
+} from './sandbox-boundary.js';
 import type { StoredMessage, PersistedBackendKind } from './session.js';
 import type { AgentRunHeader } from './agent-run.js';
 import type { UserQuestionResponse } from './user-question.js';
@@ -52,6 +56,8 @@ export interface RuntimeContinuationMetadata {
   sourceRunId: string;
   sourceTurnId: string;
   sourceRuntimeEventHighWater: number;
+  /** Authenticated negotiation projection; never grants execution authority. */
+  sandboxBoundaryNegotiationState: SandboxBoundaryNegotiationState;
 }
 
 export interface BackendSendInput {

packages/core/src/events.ts

@@ -775,7 +775,7 @@ export interface SandboxDenialRecovery extends SandboxDenialSignal {
 }
 
 export interface SandboxBoundaryFailureSignal {
-  reason: 'sandbox_boundary_required' | 'requires_bypass';
+  reason: 'invalid_boundary_declaration' | 'sandbox_boundary_required' | 'requires_bypass';
   requiredExpansion?: SandboxBoundaryExpansion;
   source?: 'client_capability';
 }