Unified Sandbox Layer
Sandbox Boundaries
A run that made every harness enter the same wrapper and pointed agents at the disposable worktree.
0 milestones 2 tasks
33m 29s total 11m 27s per task
15.4M tokens in 84.5k tokens out
$14.87 nominal cost
This run closed a real isolation failure in two steps. First it made Gantry's own wrapper the filesystem boundary for every harness that runs under it, instead of letting some harnesses turn off their native sandbox and then skip Gantry's wrapper too.
Then it dealt with the quieter companion bug: an agent can be confined and still write to the wrong checkout if the prompt and subprocess working directory point away from the disposable worktree. The result is a pair of small cuts that separate prevention from orientation.
How this walkthrough is structured
Feature
What did the run build and ship?
The current tree still carries a uniform wrapper path for harness spawns and a worker prompt that frames the disposable worktree as the only place to edit.
Build
How did Gantry structure the work?
The run split the incident into a confinement invariant and a worktree-targeting guardrail, and both pieces stayed within their sprint boundaries without repair.
Unified Sandbox Wrapper
0 agents 14m 40s wall time 44k tokens out $7.61 nominal cost
The current engine still exposes that invariant. AgentSpec carries gantry_will_sandbox, wrapped_argv prepends the sandbox prefix without a harness exception, Codex and Gemini disable their native sandbox only when Gantry will wrap, and main_bound_readonly is a Bwrap predicate. The original build-side module has since moved, but the behavior and tests remain in the runner and harness modules.
This unit carried the core deletion: remove the capability flag, make the runner wrap every harness when Gantry has a sandbox, and rework tests around behavior. That was a compact cut because the runner decision, harness invocations, and read-only-main predicate had to compile together. The fact record shows it passed execute, gate, and review without repair, so the boundary held around a single invariant rather than spilling into the path-targeting bug left for the next unit.
Worktree Path Targeting
0 agents 8m 13s wall time 17.9k tokens out $3.80 nominal cost
The shipped worker preamble now tells every build worker that its current directory is the root of a git worktree and that absolute paths to the canonical repository belong to a different checkout. Codex invocation construction still passes spec.cwd through its --cd argument, and the prompt tests keep the rendered worker discipline composable. The exact original prompt file was later renamed into the agent-prompts directory, but the guardrail text is still present.
This unit was scoped to orientation and cwd after confinement was handled. The brief asked it to prove that subprocesses start in the run worktree and to amend the shared preamble so an agent is told not to edit the canonical checkout. It also stayed green through execution, gate, and review, which matches a narrow change: prompt text and cwd assertions rather than another sandbox redesign.