Define and characterize the cross-backend workload contract #10339

Goal

Define the observable and security contract shared by Docker, NVX, and Cloud Hypervisor before extracting or extending implementations. Part of #10335, step 1.

Scope

• Define primary-agent, script-enclave, and agent-enclave roles and the primary-only, script-only, agent-only, and primary-plus-both execution combinations.
• Characterize existing behavior and acceptance restrictions from code and tests; do not assume reference implementation support implies general availability.
• Specify primary-agent workspace/environment/proxy/workdir/exit-status/cancellation behavior; script no-network behavior; agent dedicated-proxy and authorized-GitHub-only behavior.
• Specify immutable seeds, invocation-private state, non-root identity, aggregate writable-storage and resource enforcement, canonical bounded results, cleanup-before-result release, recovery, and private-output handling.
• Record disclosure, invocation, tool-call, model-budget, and dynamic-delegation semantics.
• Build an explicit capability inventory for static/dynamic repositories, GitHub tools, engines, custom images, host requirements, and artifact provenance. Preserve existing Docker capabilities.
• Retain one workload backend per run and no silent fallback. Document that functional/policy parity does not make containers and VMs equivalent isolation boundaries.

Starting points

• /home/runner/work/gh-aw-firewall/gh-aw-firewall/src/enclave/run-backend.ts
• /home/runner/work/gh-aw-firewall/gh-aw-firewall/src/cloud-hypervisor/workload-profile.ts
• /home/runner/work/gh-aw-firewall/gh-aw-firewall/src/nvx/runtime-validation.ts
• /home/runner/work/gh-aw-firewall/gh-aw-firewall/docs/filesystem-sharing-contract.md

Acceptance criteria

• A reviewed role/capability matrix identifies implemented, gated, unsupported, and unverified behavior.
• Characterization tests pin existing externally observable behavior and fail-closed configuration rules.
• Each shared invariant has an identified deterministic or real-backend verification strategy.
• Resource-limit semantics distinguish aggregate enforcement from per-file limits or nominal image sizes.
• Intentional backend differences and missing acceptance evidence are explicit.

Dependencies

First delivery step; feeds the shared-core extraction and shared conformance suite.