Sandboxed Execution, Isolation, and Publication Boundaries
An implementation agent executes untrusted generated actions against valuable source code. A worktree prevents branch collision, but it does not contain process, credential, network, resource, or host risk. Conversely, a disposable virtual
A rapid review of the chapter’s existing Quick Read, principles, definitions, lessons, and review material.
Reconstruct and defend this chapter’s architecture.
Reconstruct the architecture, name each boundary, and defend the tradeoffs.
Open the source exercise
Draw local worktree, container, and remote-VM variants. Mark credentials, network, lease, receipts, quarantine, independent validation, publication, and teardown. Add a worker crash after VM allocation and before journal update.
3. Enduring Principle
Isolation is layered containment
Use several independent boundaries:
- Attempt-specific branch and worktree;
- unprivileged process or user;
- filesystem and path allowlist;
- network and egress policy;
- short-lived WorkOrder-scoped credentials;
- CPU, memory, runtime, and spend limits;
- lease, heartbeat, cancellation, and teardown;
- quarantined result bundle; and
- independent validation before publication.
No single sandbox property proves the others.
The sandbox is a resource, not an authority record
A local process, container, VM, or remote environment is attached to one Attempt. Mission Control still owns policy, claim, lifecycle, evidence, acceptance, and publication. The sandbox may execute the frozen manifest and report facts; it may not change scope, validate itself, merge, deploy, or retain credentials after termination.
Separate execution identity from publication identity
The agent runtime should not hold GitHub write or deployment credentials. After validation, a trusted outer control-plane component mints the shortest lived repository-scoped credential required to push and open one PR. Human merge remains a separate decision.
Make teardown and orphan recovery first-class
Record allocation identity before creating an external resource. Lifecycle states should include provisioning, ready, running, result-ready, teardown, terminated, failed, and orphaned. Reconciliation finds resources that exist in the provider but lack active factory authority. Cleanup uses exact provider IDs, never broad patterns.
Treat sandbox output as untrusted
Receipt spools, logs, diffs, test results, and bundles require integrity checks, redaction, scope validation, and independent verification. A compromised sandbox must not be able to forge acceptance by controlling both artifact and evidence.
8. Notes and lessons learned
Disposable is not synonymous with safe. The decisive boundary is that the untrusted executor cannot publish its own result or certify its own evidence.
9. Interview and discussion questions
- What does a worktree isolate, and what does it not isolate?
- Why should the sandbox lack GitHub write credentials?
- How do you recover an orphaned remote VM?
- What makes a result bundle trustworthy enough to inspect—but not accept?
- When would a container be sufficient instead of a VM?
Review this chapter.
Challenge a claim, boundary, missing failure mode, unclear term, or unsupported evidence statement.
- Claim
- Boundary
- Failure
- Evidence