Process Fence Repair
Process Fence Contract
Gantry returned its sandbox to a process wrapper and documented where confinement belongs.
2 milestones 7 tasks 15 agents
3 plan 6 execute 9 review
194k peak context
161k median execute
2h 3m total 13m 45s per task
55m 7s execute 33m 14s review
99 edits 678 commands
codex harness
This run unwound a broader sandbox posture and restored the narrower claim Gantry can honestly make. The runtime work made the built-in wrapper a process fence with a writable host view and a main-checkout write guard, while the documentation work moved security confinement out to operator-owned machines, containers, and wrappers.
The decomposition matters because the first milestone rebuilt shared behavior before the second milestone rewrote public language around it. The current tree still carries the process-fence profile, wrapper-state reporting for agents and MCP tools, current documentation, a confined-use guide, and synchronized reference data.
How this walkthrough is structured
Feature
What did the run build and ship?
The live project now describes and implements Gantry's built-in sandbox as a process fence, with stronger confinement assigned to external operator boundaries.
Build
How did Gantry structure the work?
Gantry split the repair into runtime contract and public contract milestones, and each unit crossed review and gate without recovery or replan.
Milestone 1
Restore Process Fence
4 tasks 10 agents 1h 44m wall time 194k peak context
The runtime side is still visible in the engine, MCP action code, domain events, preflight checks, config schema, and tests. Gantry now reports process fence, custom wrapper, disabled, or unavailable states instead of presenting a filesystem confinement boundary. The built-in profile keeps the host writable while binding the canonical checkout read-only and carving Git metadata back writable. Historical write-boundary language remains only in historical material, while current code uses wrapper-state terms.
This milestone carried the implementation half of the posture change. Its brief bundled the risky runtime pieces: default wrapper profile, mode vocabulary, engine launch reporting, MCP parity, generated reference data, and deletion of write-boundary machinery. That was still cut into agent-sized slices by making the first sprint define the shared wrapper contract and making later sprints consume it. The ledger and run facts show the milestone finishing cleanly, with no recovery or replan signal at the boundary.
Process Fence Profile
1 agents 44m 52s wall time 119k peak context
The live configuration still resolves sandbox settings to disabled, built-in bubblewrap, or a custom command. The profile builder still constructs the process-fence argv with the writable host view, private process namespace, parent-death behavior, read-only canonical checkout, and writable Git metadata carve-back. The global config and schema expose the collapsed mode surface and the custom wrapper hook. Tests remain around profile construction, parsing, and the ordering that keeps commits possible from sibling worktrees.
This sprint had to carry the core contract before any launch or documentation layer could rely on it. The brief made the boundary concrete: a built-in bubblewrap profile, custom command passthrough, disabled and required modes, and deletion of exemption and private-home behavior. That was a large but coherent runtime slice because it lived at configuration and profile construction rather than at every caller. It passed through the run without recovery, giving the later sprints one shared policy to consume.
Engine Wrapper Visibility
2 agents 16m 30s wall time 180k peak context
Current startup and run code still carry wrapper visibility as structured sandbox visibility records. Preflight text describes disabled, custom, unavailable, and active process-fence states, and run summaries render those states without claiming lost confinement. Agent launch still wraps harness commands through the shared profile when active. When no built-in fence is active, the escaped-write check remains the independent correctness guard for accidental writes into the main checkout.
This sprint moved the new contract into the ordinary agent launch path. The brief kept it focused on startup probing, degrade events, required-mode failure, run-environment rendering, and the escaped-main-checkout backstop. That scope was suitable for a fresh agent because it changed how the engine names and applies an already-defined wrapper state. It completed without recovery, so the main launch path accepted the contract before MCP work began.
MCP Wrapper State
2 agents 17m 47s wall time 194k peak context
The `run_bash` tool now resolves the engine config, applies the same wrapper profile, and returns structured fields for process fence, custom wrapper, and no wrapper. Its registration text names the wrapper state available on the host, and its result builder carries availability and reason data instead of confinement claims. Commands still run in the resolved worktree and remain bounded by timeout and escaped-write diagnostics. The MCP tool descriptor in generated reference data reflects that same contract.
This sprint closed the split between coding-agent launches and MCP shell execution. The brief asked the MCP action to resolve the same wrapper contract, run only from the run worktree, report process-fence state, and remove boundary-era guard language unless it still served a correctness purpose. That was a natural follow-on because the engine path had already defined the vocabulary and failure behavior. The sprint stayed green, so no later replan was needed to reconcile MCP with the engine.
Config Reference Sync
2 agents 14m 7s wall time 161k peak context
Current configuration docs and schema rows describe the managed process fence, require and disable spellings, and the custom wrapper command. The root reference data and the web copy include the same sandbox environment variables and MCP tool wording. Harness and operator-facing docs no longer present exemption lists or read-mostly host boundaries as live configuration. This sprint's contribution survives as agreement between implementation-owned reference data and the user-facing configuration surface.
This sprint was the runtime milestone's vocabulary sweep. The brief limited it to configuration schema, operator config docs, generated data, and MCP reference text so it would not absorb the broader confinement guidance planned for the next milestone. That made the task a consistency pass over surfaces that should all mirror the implementation already built. It finished cleanly and left the documentation milestone with a coherent implemented vocabulary.
Milestone 2
Document Confinement Contract
3 tasks 9 agents 41m 48s wall time 181k peak context
The documentation now gives users one consistent answer. The sandbox page describes the disposable worktree and process fence, then points security-minded operators to confined-use guidance. The Rails docs catalog exposes that confined-use page, and the rendered partial carries the same boundary contract. Current docs, prompt references, harness references, and generated datasets all use wrapper-state language instead of write-boundary claims.
This milestone turned the restored behavior into the public contract. Its brief depended on the runtime milestone and asked documentation to be explicit about what Gantry isolates for correctness and what it does not isolate for security. The sprints were cut by audience and source type: new confinement guidance, current prose vocabulary, then generated reference refresh and stale-wording cleanup. The run facts show the milestone completing without recovery or replan, which fits a cleanup pass built on an already-working runtime.
Confined Use Guidance
2 agents 9m 13s wall time 142k peak context
The current tree contains `docs/agents/confined-use.md` and a matching Rails docs partial. The page states that Gantry does not provide a security boundary around agents, then names repositories, sibling worktrees, run artifacts, config locations, harness auth, temporary storage, commands, tokens, and network egress as boundary concerns. It includes dedicated-machine, container, and custom-wrapper recipes. The sandbox documentation links to that page as the confinement answer.
This sprint established the user-facing confinement contract before the rest of the docs were rewritten around it. The brief asked for a shorter sandbox page and a new guidance page that named the external boundary contents, authentication approach, and practical recipes. That was a self-contained documentation cut because it created the target language instead of sweeping every reference at once. It completed without recovery, giving later documentation work a stable page to link and mirror.
Current Docs Vocabulary
2 agents 13m 45s wall time 146k peak context
Current docs now describe the built-in profile as a writable-host process fence with a main-checkout correctness guard. Harness documentation explains how each CLI should interact with Gantry's wrapper state, and MCP documentation describes `run_bash` execution in that same vocabulary. Prompt documentation says workers receive wrapper-state facts rather than sandbox-confinement claims. Status, packaging, lifecycle, and configuration pages all point readers toward external boundaries for stronger confinement.
This sprint applied the confinement guidance contract across the current prose docs. The brief explicitly excluded historical rewrites and focused on configuration, status, harness, MCP, development, packaging, and reference-maintenance language. That kept the job editorial but verifiable: current pages either used process-fence and wrapper-state terms or still advertised removed behavior. The sprint stayed green, so the final sweep could concentrate on generated data rather than resolving prose contradictions.
Reference Data Sweep
2 agents 10m 42s wall time 181k peak context
The root reference dataset and the web-served copy now contain process-fence descriptions for sandbox settings, sandbox environment variables, wrapper visibility events, and the MCP shell tool. The archived plan file remains historical, while live plan indexes and remaining-work docs no longer treat this work as pending. The MCP tool reference and config schema still agree on wrapper-state language. The surviving feature is a reference site whose generated rows tell the same story as the current docs.
This sprint finished the run by regenerating machine-rendered reference surfaces and removing stale live wording. The brief made the source-of-truth boundary clear: generated root data and the website copy had to be refreshed from the exporter and kept in sync, not hand-edited. It also carried the final hand-back rule that post-merge real-run verification remained an operator step. The sprint completed without recovery, closing the plan with generated and prose surfaces aligned.