Isolate research execution
Keep arbitrary code away from canonical state, cloud administration, and other tenants.
Outcome
An attempt can operate only inside its assigned sandbox and scoped product capabilities; it cannot reach canonical database administration, workflow administration, object administration, compute organization, or another workspace.
Prerequisites
Use the exact pinned runtime image, region, provider class, non-root user, resource limits, ownership labels, and product lease. Local Docker and managed compute must pass the same core provider contract.
Steps
- Persist creation intent and deterministic labels before calling the provider.
- Reconcile ambiguous creation by labels before retry.
- Mount only the accepted workspace snapshot and declared inputs.
- Give the attempt short-lived inference, tool, runtime, and staging capabilities for its generation.
- Keep inbound access private and mediate any preview with a short-lived ticket.
- Revoke capabilities and sweep the provider resource when the lease ends.
Managed and local sandbox execution is not active in Slice 0. Fake sandbox capabilities prove the typed boundary only.
Verify
From the exact image and provider class, run canaries for forbidden credentials, cross-workspace paths, cloud metadata, database endpoints, and provider control APIs. All must fail while approved product routes succeed.
Recover
If isolation fails, stop new sandbox creation, revoke affected capabilities and credentials, preserve incident evidence outside hostile compute, and do not resume sensitive work until the same canary suite passes on the fixed image and class.