A sandbox is a bounded place where the agent runs. Only named tools, files, and network paths are visible inside.
Anything outside is unreachable by construction. An action that needs more must ask for a wider sandbox first.
Boundary | Inside | Outside |
|---|---|---|
Files | The task sources plus one scratch directory | Home directories, secrets, and other checkouts. |
Tools | Named lint and simulation commands | Shell wildcards, package installers, and remote copy. |
Effects | Scratch writes and draft text | Repo writes and job starts without a gate pass. |
A gate pauses the run before a risky action. A person reviews the exact diff or command, then approves or denies.
The approval names the action, its target, and its reason. Reused approvals across different actions are not valid.
Action | Gate reviews | After approval |
|---|---|---|
Repo write | Unified diff of the exact files | The checker applies that diff only. |
Job start | Job name, inputs, and cost bound | Only that job starts once. |
Sandbox widening | New paths or tools requested | The run continues in the wider box. |
Small diffs pass review faster than large ones. The run splits edits per file so each gate stays readable.
Denied actions stop that branch only. The run may propose a narrower action instead of retrying the same one.
A person decides. The new paths, the reason, and the decision are recorded in the log.
rtl/alu.sv. The agent then edits rtl/top.sv. What should the checker do?Deny the second edit. The approval names one target, so a different file needs its own gate.