Classifies which per-VM settings belong on the ambient AGENT_OS_* env channel vs the BARE wire / structured request, encodes the rule in CLAUDE.md, and migrates the resource limits and virtualized identity families off env onto typed/structured channels.

Migrated to the wire

• Resource limits — V8 heap, sync-RPC wait, WASM fuel/memory/stack, Python timeout/old-space/output-buffer/vfs-rpc → typed *ExecutionLimits request fields, sourced from CreateVmConfig→VmLimits.
  • Fixes the AGENT_OS_WASM_MAX_STACK_BYTES dead cap (was written to env, never read) and a latent disconnection (wire limit fields were parsed but never plumbed → engine silently used defaults).
• Virtualized identity — process.{pid,ppid,uid,gid} interpolated into the runtime shim; os.{cpus,totalmem,freemem,homedir,userInfo,…} via the __agentOsVirtualOs structured global the shim sets. The AGENT_OS_VIRTUAL_{PROCESS,OS}_* env inserts are removed; os POSIX env (HOME/USER/SHELL) is kept (bucket-2 standard env). The v8-bridge bundle is regenerated from source.

Not migrated (deferred, documented)

Isolation policy (GUEST_PATH_MAPPINGS, EXTRA_FS_*_PATHS, ALLOWED_NODE_BUILTINS, LOOPBACK_EXEMPT_PORTS, WASM_PERMISSION_TIER) stays on env — bucket 3 but not yet moved. PARENT_NODE_ALLOW_* are dead (defined + scrubbed, never read).

Testing

• Per-limit tests assert each limit is enforced from the wire value while a contradictory env value is inert.
• Sidecar-level identity regression test (builtin_conformance::os_resource_limits_are_vm_scoped): a guest's os.cpus/totalmem/freemem reflect the configured VM resource limits, and os.userInfo().username / os.homedir() reflect the configured VM identity (distinct from the loader's root//root defaults) — exercising the real guestOs/import os path through the sidecar.
• cargo check --workspace --all-targets clean; full cargo test -p secure-exec-execution green; sidecar suites green except 3 pre-existing/environmental failures (TLS-over-loopback, a child-process SIGABRT signal test, a pyodide asset-resolution test) — each verified to fail identically on main.