Sandbox Private Home

This sprint created the interface later agents would consume instead of asking them to rediscover sandbox argv assembly. Its brief was narrow for a fresh worker: gather mode, main checkout, worktree, operator binds, and future run-owned locations into one profile request, then return already split arguments. The contract was explicitly injection-safe, so path handling could be proven at construction time. The sprint passed without a recorded repair, giving the next profile change one place to land.

This sprint held the core policy change: make the host readable first, then carve back only declared writable paths. That was the hardest profile slice in the first milestone because bind ordering became the product contract. The brief made that complexity testable without bubblewrap by pinning root masking, worktree writability, shared Git storage, hook protection, device support, and argument safety. It completed cleanly, so the configuration sprint could treat the policy as already present.

This sprint connected the new profile to operator configuration. Its scope was small enough for one agent because it dealt with parsing, default selection, explicit legacy opt-out, custom wrapper passthrough, and effective configuration snapshots. The brief also made malformed inputs and flag-shaped paths part of the testable boundary. It crossed the gate without recovery, leaving later runtime work with a coherent settings object.

This sprint reopened the profile boundary with the full runtime contract in view. The brief asked it to represent worktree writes, readable checkout, Git metadata, temporary storage, runtime sockets, private home, credential exemptions, operator binds, legacy host mode, and custom wrapper mode. That is a large contract, but still one coherent place for a fresh agent because it stayed at profile request construction. It completed without unit-local recovery.

This sprint supplied the lifecycle objects the profile needed: a run home, temporary storage, runtime socket reachability, and cleanup or reclamation behavior. The brief was structurally risky because it touched the environment agents actually run inside, but the requested proof was still framed as hermetic lifecycle and input assembly tests. The sprint crossed its recorded gates, yet later analysis shows this was the design point the automated pipeline could not truly validate. The real failure appeared only when an authenticated harness had to launch through the new home mount.

This sprint tried to keep authentication working after the private home hid the real one. Its brief divided the problem by harness, requiring the smallest ambient credential path each command needed and excluding token authentication because environment injection already handled it. That made the work declarative and testable without real credentials. It finished without recorded recovery, but its premise depended on the private-home policy that later failed in real use.

This sprint was the point where the shared profile stopped being an abstract builder and became the launch path. The brief asked normal agent stages and MCP shell execution to consume the same profile inputs, including worktree, private home, temporary storage, credentials, and runtime sockets. That cut was right-sized because earlier sprints had already named those inputs. The run facts show the unit stages passed, though the finish record is incomplete compared with the milestone ledger.

This sprint made degraded or bypassed confinement visible instead of leaving it on stderr or implicit tool results. Its brief was a vocabulary contract for run history, MCP registration, MCP results, startup warnings, and the post-agent escaped-write backstop. That kind of observability slice is agent-sized because it can be tested as serialization and metadata without running bubblewrap. It stayed green and gave later documentation precise terms to use.

This sprint separated real mount proof from the default gate. The brief asked for opt-in checks covering home writes, hidden secrets, worktree writes, cache writes, credential refresh, sibling path protection, and a smoke path for authenticated execution. That split matched the test policy, but it also exposed a limitation: the automated worker could add probes more readily than it could prove a real operator machine. The sprint finished green, while later analysis showed fixture mount probes had not validated the true home boundary.

This sprint converted the completed milestone into operator-facing prose and generated reference data. The brief waited until runtime behavior and visibility vocabulary existed, then asked for sandbox docs, credential tables, MCP language, harness guidance, stale wording cleanup, and reference refresh. It was a broad editorial sweep, but bounded by already-built behavior. It completed without recovery and closed the milestone before final integration.

This sprint turned the final mount contract into an opt-in exercise rather than a default gate. The brief named concrete behaviors for real home masking, private-home writes, cache writes, worktree writes, sibling protection, and credential refresh. That made the proof precise, but still depended on a development host and stored credentials that the worker could not assume. It passed its recorded checks, while later analysis found the proof did not cover the real harness-launch failure.

This sprint focused on the externally advertised MCP shell contract. The brief asked the tool description and generated reference data to say exactly what wrapper state was active and what metadata callers would receive. That was a small, checkable surface because the MCP action behavior had already been built. It crossed the gate cleanly and gave documentation a generated source of truth.

This sprint rewrote the main sandbox guide around the intended final read and write boundary. The brief was documentation-heavy but precise: state what stayed readable, where writes were allowed, how the private home worked, what configuration meant, and which security claims remained out of scope. It was agent-sized because the implementation was supposed to be done. The run did not record a repair here, but later history shows the underlying behavior changed after publication.

This sprint was supposed to align related harness and assistant docs and prove the default profile with a real authenticated run. The documentation part fit a fresh agent, but the smoke proof required standing outside the very environment being changed. The sprint closed with prose and docs rather than an operator-verified real run. Later analysis identifies that as the missed check that would have caught the private-home breakage quickly.