Module subprocess_sandbox 

B2 — subprocess spawn sandbox registry.

Tools that declare Sandbox::Subprocess launch external processes through wm_core::sandbox::SpawnPolicy, which the dispatcher injects into the wm_core::Context before the call. This module owns the process-wide runner resolution, the dispatch counters, and the loud-degrade bookkeeping:

• confined: a declared tool dispatched with a runner attached — counted, and the active policy disclosed on the response.
• degraded: a declared tool dispatched with no runner resolvable — counted, warned (once per tool), and the command still runs unconfined. Availability first, drift never silent.
• unconfined spawns: a tool that declares spawns but not Sandbox::Subprocess — counted and warned once per tool, because a declared spawn site that bypasses the policy is exactly the drift this seam exists to surface. It does not fail the call.

Runner discovery lives in wm_core::sandbox::detect_runner (WM_SANDBOX_RUNNER env → PATH lookup). The dispatcher attaches a registry explicitly via DispatchPipeline::with_subprocess_sandbox; without one the declarations are inert (same doctrine as the Landlock v1 executor).

Structs

SandboxEvent

A sandbox drift incident surfaced for the Yama v0 bridge.

SubprocessSandbox

Process-wide subprocess sandbox registry.

Enums

SandboxEventKind

Drift incident kind (snake_case on the wire).