Why this abstraction matters
The sandbox should be replaceable. Today it is local-only. Later it may be:- a remote container
- a cloud worker
- another isolated executor
provision and execute, that swap stays tractable.
Current implementation
The current implementation is:- local
- workspace-backed
- resource-aware
Relationship to resources
The sandbox does not invent resources. It receivesResourceAttachment[] and provisions them.
That keeps the boundary clear:
- session owns the list of attached resources
- environment defines the reusable execution substrate
- sandbox turns those into an executable runtime context
Relationship to tools
The sandbox is not the tool registry. Tools define:- name
- description
- schema
- ownership
- permission policy
Current non-goals
The current sandbox layer does not yet try to be:- a cloud container runtime
- a full network policy engine
- a secret distribution system
- a multi-tenant production isolation layer