dsf-deploy/investigate WASM + TensorLake tool_runner door

[rita-aga]

Shared Deep Sci-Fi computer tools for Howl and TemperPaw.

• dsf-deploy and dsf-investigate as IOA + WASM
• Named sandbox connect (TEMPER_SANDBOX_NAME / TEMPER_SANDBOX_URL)
• tool_runner TensorLake process/file APIs when host is *.sandbox.tensorlake.ai

Does not bounce Railway OpenPaw. Apps install via Genesis App.Install.
Does not publish Galley. Does not dump secrets.

Source: rita-aga#3

Greptile Summary

The PR adds shared Deep Sci-Fi deployment and investigation OS apps and extends Temper Agent with named-sandbox and TensorLake process/file support.

• Adds deploy and investigation workflows, policies, models, documentation, and bundled WASM modules.
• Adds named-sandbox environment overlays and provisioning behavior.
• Adds TensorLake execution and filesystem transport to tool_runner.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains.

No blocking failure remains.

Important Files Changed

Filename	Overview
crates/temper-server/src/secrets/env_overlay.rs	Adds declared-key credential overlays and named-sandbox configuration injection.
crates/temper-server/src/state/dispatch/wasm.rs	Applies environment overlays after tenant secret-template resolution and before guest invocation.
os-apps/temper-agent/wasm/tool_runner/src/tensorlake.rs	Implements TensorLake process polling and filesystem transport for named sandboxes.
os-apps/temper-agent/wasm/sandbox_provisioner/src/lib.rs	Extends provisioning to select explicitly configured named sandboxes before ephemeral E2B creation.
os-apps/dsf-deploy/deploy_run.ioa.toml	Defines the new deployment workflow and its WASM callback transitions.
os-apps/dsf-investigate/investigation.ioa.toml	Defines the new Datadog investigation workflow and callback transitions.
os-apps/dsf-deploy/policies/deploy_run.cedar	Restricts deployment mutations and module capabilities to Agent principals.
os-apps/dsf-investigate/policies/investigation.cedar	Restricts investigation mutations and module capabilities to Agent principals.

Sequence Diagram

sequenceDiagram
    participant A as Temper Agent
    participant D as WASM Dispatcher
    participant T as tool_runner
    participant S as TensorLake Sandbox
    A->>D: Run tools integration
    D->>D: Resolve config and declared environment overlays
    D->>T: Invoke guest with sandbox configuration
    T->>S: Create and poll process
    S-->>T: Process status and output
    T->>S: Read or write workspace files
    S-->>T: File response
    T-->>D: Tool results
    D-->>A: Workflow callback

Loading

_{Reviews (2): Last reviewed commit: "fix(authz): stop leaking TensorLake bear..." | Re-trigger Greptile}

[greptile-apps]

TensorLake bearer reaches every guest

When TENSORLAKE_API_KEY is configured, this unconditional overlay inserts the process-wide bearer into every specification-driven WASM invocation, including tenant-uploaded modules whose integrations never declared it, allowing those guests to read and exfiltrate the credential. How this was verified: The overlay inserts the key even when absent, and the complete integration config is serialized into the context exposed to guest code.

Knowledge Base Used: WebAssembly capability system

Prompt To Fix With AI

This is a comment left during a code review.
Path: crates/temper-server/src/state/dispatch/wasm.rs
Line: 653

Comment:
**TensorLake bearer reaches every guest**

When `TENSORLAKE_API_KEY` is configured, this unconditional overlay inserts the process-wide bearer into every specification-driven WASM invocation, including tenant-uploaded modules whose integrations never declared it, allowing those guests to read and exfiltrate the credential. **How this was verified:** The overlay inserts the key even when absent, and the complete integration config is serialized into the context exposed to guest code.

**Knowledge Base Used:** [WebAssembly capability system](https://app.greptile.com/arni-labs/-/custom-context/knowledge-base/nerdsane/temper/-/docs/wasm-capability-system.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.