AgentPod 076: Prototype Windows AppContainer workspace mode

[EfeDurmaz16]

Objective

Complete issue 76 from the AgentPod productization plan: Prototype Windows AppContainer workspace mode.

Why This Matters

AgentPod is the primary product surface. This work moves Agentbox from a collection of runtime/control features toward a credible governed execution product with honest provider boundaries.

Scope

• Epic: Epic 8: Windows Native Path
• Area: security/windows
• Priority: P2
• Expected PR boundary: gated AppContainer prototype

Out of scope: fake provider support, broad rewrites unrelated to this issue, or claims not backed by the verification gate.

Acceptance Criteria

• Behavior, documentation, or contract described by the issue exists.
• Tests, smoke checks, or docs validation cover the change where practical.
• Verification gate passes: workspace access follows explicit allowlist fixture.
• Provider/support level remains honest; descriptor-only and prototype surfaces are not presented as shipped.

Verification

workspace access follows explicit allowlist fixture.

Suggested PR Boundary

gated AppContainer prototype

Source

Derived from docs/agentpod-productization-100-issues.md at commit 33d44f8.