Summary

`SandboxingConfig` exists with `default_backend` and per-category `overrides` (e.g. file_system → subprocess, code_execution → docker), and the `get_backend_for_category()` method resolves the correct backend name. However, the engine does not read this config to actually route tool invocations through the correct sandbox backend.

Design Spec Reference

• §11.1.2 Tool Sandboxing — Default Layered Configuration
• §15.5 Engineering Conventions — "Tool sandboxing" row ("Config-driven per-category backend selection planned for engine wiring")

Scope

• Engine reads `SandboxingConfig` at startup
• Creates appropriate `SandboxBackend` instances (subprocess, docker) per category
• `ToolInvoker` or `AgentEngine` injects the correct sandbox backend into each tool based on its `ToolCategory`
• Fallback to `default_backend` when no override is configured