MOC - Agentic Containment and Sandbox Boundaries
● Evergreen
Techniques for integrating autonomous AI task runners and batch refactoring scripts without granting unrestricted read/write access to host operating systems or private note vaults.
Containment Invariants
- POSIX Boundary Enforcement: Agents execute inside restricted user namespaces (
CLONE_NEWNS,CLONE_NEWPID) with read-only root filesystems. - Deny-by-Default Egress: Script runners have external network access severed at the kernel layer, preventing unauthorized token or document exfiltration.
- Ephemeral Writable Scratchpads: File mutations occur within isolated staging directories; writes apply to primary vaults only after passing invariant lint suites.
Connected Dispatches & Notes
- [OUT-1001 - Verifying Autonomous Agent Bounds with Pure Standard Library](OUT-1001 - Verifying Autonomous Agent Bounds with Pure Standard Library)
- OUT-1002 - The Task Manifest Protocol – Explicit Authority in CI
- [OUT-1003 - Additive Data Contracts - Evolving Note Schemas Without Breaking Legacy Vaults](OUT-1003 - Additive Data Contracts - Evolving Note Schemas Without Breaking Legacy Vaults)
- [BSN-1007 - Sandboxing AST Extensions with Outrigger](BSN-1007 - Sandboxing AST Extensions with Outrigger)
- [BSN-1016 - Containing the Agentic Workspace](BSN-1016 - Containing the Agentic Workspace)
- [MOC - Outrigger Protocol](MOC - Outrigger Protocol)
- [MOC - Adversarial Agent Containment](MOC - Adversarial Agent Containment)