Runtime sandbox bar for step-3 autonomy

[kyle-sexton]

Isolation today = worktree + GitHub-native perms. Decide the bar for autonomous runs: GitHub-native sufficient / Claude Code sandboxing config (GA) / containerized isolation (runner) — global or per work class (feeds the guardrail matrix). Evidence: explore-plugins-inventory.md gap 2→3 #5; RESEARCH-product-surface.md sandboxing GA; RESEARCH-headless-agents.md isolation-policy seam.

[kyle-sexton]

🔒 claim: wayfind-session-20260717-cont-8acf2066

[kyle-sexton]

Resolved: tool-agnostic isolation-level ladder + uniform unattended floor, fail-closed.

Ladder (contract vocabulary — instances are illustrative and org-supplied via the #241 guided-setup pattern):

• L0 — worktree + VCS permissions only (branch protection, scoped token). Attended interactive work only.
• L1 — per-command OS sandbox (Bash-only; MCP servers, hooks, and built-in file tools remain on the host). Attended-ergonomics tier; not an autonomy tier.
• L2 — whole-process OS-enforced boundary + default-deny egress with domain allowlist + credential deny/mask/scoped short-lived tokens. Minimum for any unattended run. Free paths exist both with Docker (container with default-deny firewall) and without (whole-process sandbox-runtime wrap, currently beta).
• L3 — kernel-separated ephemeral environment (VM/microVM/hosted vendor surface). Required for untrusted repositories and policy-mandated kernel separation.

Axes: attendance × input provenance (who can write to what the agent reads). The trigger-source axis originally proposed was researched and falsified: untrusted content reaches agent-internal runs through repo files, dependencies, and fetched web content — not just external signals — and the vendor primary states a per-command sandbox alone is 'not sufficient for fully unattended runs'. Evidence: .work/ai-adoption-ladder/RESEARCH-sandbox-bar.md.

Fallback where L2 is unavailable (e.g. native Windows without WSL2/Docker): fail closed — autonomous dispatch is blocked for that surface and the guided-setup capability names the compliant paths. No silent degrade (trust-loop leak; mirrors the vendor failIfUnavailable managed pattern; Boris step-3 trap).

Boris alignment: the artifact's 2→3 guardrail is 'agent sandboxing'; L2 implements that guardrail at the vendor-stated unattended bar. Attended multi-tab/multi-worktree workflows are untouched — the floor gates unattended runs only.

Feeds: #243 (now fully unblocked) assigns work classes to levels + L3 escalation rules; #244 runner inherits L2+ as its execution-substrate requirement. Full thread text: design-threads.md T2.

[kyle-sexton]

Source anchors (added for durability — the design threads re-anchor to this artifact):

• Boris Cherny, "Step & your role" (Jul 16, 2026) — Google Doc (reliable copy): https://docs.google.com/document/d/1R91ayvj7uvlxgNi--__2-Bf3w8x5r1nF-xIBN7ds8Ns/edit
• Original claude.ai artifact (intermittently erroring as of 2026-07-17): https://claude.ai/code/artifact/bfdfaef9-bc62-4dfe-ba9e-c58a26c9accf