The zones run under microsandbox, with no account

[ALLiDoizCode]

Stacked on #78. Part of #57.

Docker Sandboxes (sbx) refuses every command until the person signs in to a Docker account, so the one-line install still ended in a browser sign-in. Both zones now run under microsandbox (msb 0.7.8, Apache-2.0, KVM through libkrun): no account, no root, no service. sbx is replaced, not kept beside it. ADR 0004 records the decision.

What changes

• install.sh puts a pinned microsandbox in ~/.local/share/spaceturtle/msb, checked against its checksum. That home is spaceturtle's alone. The next steps it prints are start, key, session.
• The connector's zone is made with the wallet's storage mounted as toon's home, a disk of its own for the container engine, /run in memory, the public internet out, and the two ports in from the machine's loopback.
• The agent's zone has a wall: name resolution, the two ports, the model provider's host, the network's connector, and api.github.com and codeload.github.com for the skills. Everything else is refused. Under sbx the machine's policy also let it reach about 190 hosts.
• A wall and the ports are fixed when a zone is made. A session that needs another wall (a model of another provider) makes the agent's zone again and carries the agent key across in memory. What the agent keeps is now in mounted directories, so it outlasts the zone, and upgrade no longer loses it.
• One session at a time, and the agent's zone is stopped when its session ends.
• The unit no longer holds a session open to keep the zone alive. It starts the zone after a restart and starts the supervisor again when it ends.
• The image drops the proxy line for the overlay client and finds the zone's own address differently.

Run for real

On devnet, on this machine, signed out of Docker, beside the existing Install:

Check	Result
install.sh's microsandbox step: download, checksum, layout	Yes
spaceturtle start, a whole Install	39 s
Unattended sessions, skills loaded through the wall	Yes, about 17 s each
A session on a terminal	docker-agent starts; I did not drive a conversation
The wall: 6 allowed targets answer, 6 others are refused (machine port 22, LAN, other hosts)	Yes
Model of another provider: zone made again, key carried	Yes, 8 times
stop and start, 4 times	Relay reachable as soon as start returns
upgrade	Passphrase carried, wallet files unchanged, apps back
Untrusted app by the agent key: waits, approved, runs under runsc	Yes
The unit under real systemd (systemd-run --user): stopped zone, ended supervisor	Back in 9 to 15 s
A zone image pulled from ghcr with no account	Yes

Two bugs the run found are fixed here: the container engine did not start after a zone restart (stale files in /run), and start returned before the node answered.

Not verified

• A real restart of the machine.
• A host user whose uid is not 1000. The mounts are shown to the zone's user with uid=1000,gid=1000, which I could not test with another uid.
• The released images under upgrade's --pull always.
• microsandbox over days, and whether msb sends telemetry.

Known limits

• A host in the wall is held to the addresses its name resolves to, not to the name. Holding it to the name needs microsandbox to open the zone's TLS (--tls-intercept), which worked in one probe and is not used.
• A provider the launcher does not know needs SPACETURTLE_MODEL_HOST, which the timer's unit does not carry.
• An Install made under sbx is not moved: its passphrase is inside the sbx zone. No release shipped a working sbx launcher, so there is no migration.

Added after the first review

• microsandbox's home must be 54 characters or less (its socket paths). The default is now ~/.local/share/spaceturtle/msb, with ~/.spaceturtle-msb when that is too long; the installer and the launcher say the limit.

• The README presents an agent and its harness, not a panel. The GIF is removed from the README and the watching guide.

• The chat opens on the README's banner, moving. docker-agent draws its own name on an empty conversation and takes nothing animated in its place, so the agent's zone image builds docker-agent 1.150.0 again with one patch, --banner-file, and holds a film of frames made from docs/assets/spaceturtle-banner-dark.svg (ADR 0005). The patch is offered upstream as feat(tui): --banner-file replaces the startup banner, with animated frames docker/docker-agent#4578. The agent image build takes about four minutes longer.

• A zone without its ports is refused. microsandbox opens a zone's published ports when the zone starts; if another program holds one then, the zone runs and nothing listens. This happened on a real Install (the old sbx zone still held 47100), and the agent found no node. start and session now check both ports and say to stop and start.

• spaceturtle alone is the conversation. With nothing after it, the launcher starts a session; spaceturtle session is the same.

• The stars fill the chat. The film is a field 240 characters wide and 64 high with the turtle in its middle, and the patch crops it to the chat area.

• The sidebar lists the node's apps. The patch gains a second flag, --sidebar-section, offered upstream as feat(tui): --sidebar-section shows a command's output in the sidebar docker/docker-agent#4585. The launcher gives it spaceturtle-apps, which asks toon status with the session's agent key.

Not in this PR: with an agent key, toon status does not say an app's ILP address, so the agent guessed g.whoami and was rejected. That is toon-protocol/toon_cli#252, fixed in toon-protocol/toon_cli#253; the pin here moves when a toon release holds it.

Run for real since: the banner plays in a real session and stops on exit; an unattended session on the rebuilt image reaches the node and works.

Gate: tests/run, 509 checks.

🤖 Generated with Claude Code