Sandboxing — Reference Edition

Edition R — the complete mechanism. Every canonical fact from SKELETON.md, elaborated as readable prose with mechanism, file:line, its diagram, and its honest ceiling. This is the projection closest to the skeleton; the developers, researchers, and everyone editions link into here for depth. ✅ = implemented & enforced in code/tests · ⚙ = design/operator-action.

Contents

• Part I — What it is & why — the confinement problem, the in-scope adversary, design-time-not-runtime, and the opt-in default (SB1–SB3). Carries the pipeline graph G1.
• Part II — The request — profiles, tokens, and the manifest (SB4–SB6).
• Part III — The decision — the capability matrix, the three advisories, fail-closed-by-default (SB7–SB9). Carries the decision graph G2.
• Part IV — The mechanisms — the three emitters and what each denies (SB10–SB13). Carries the mechanisms graph G3.
• Part V — Wiring & runtime enforcement — inert-until-wired, verification, the fail-open/closed hook (SB14–SB17), and the orchestrator-only write policy + agentteams_runner MCP server (SB24). Carries the hook graph G4.
• Part VI — Integrity, provenance & drift — tamper-tracking and the cross-repo source of truth (SB18–SB19). Carries the drift graph G5.
• Part VII — Honest ceilings & red-team — what is verified, and what is not closed (SB20–SB21).
• Part VIII — Synthesis & reference matter — the end-to-end flow and the quick-reference tables (SB22–SB23). Carries the synthesis graph G6.

The four load-bearing ceilings (carried in every part they touch)

1. Confined by default, advisory-emitted — the confined default (2026-W39) emits an OS write-confinement boundary (opt out with cooperative); the hook still stays fail-open unless an explicit confined/exclusive flips it.
2. Inert until wired — an emitted boundary confines nothing until the operator activates/wraps it.
3. Verified only on Linux — the launcher's bwrap branch is live-kernel deny-tested; the newer macOS build_macos branch is emittable but enforcement-unverified (as are the native macOS Seatbelt paths); Windows has no emittable boundary.
4. Closes nothing absolutely — a same-host operator/key-holder (T6) and host-as-TCB stay bounded; seccomp/Landlock is a further layer not yet added.