Phase 7: Agent Sandboxes (Factory In A Box) - #13
Conversation
…t and integration plan, extending Phase 6
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 827a8d084c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ### Task 6: Update the SUBAGENT-FRAMEWORK Orchestrator | ||
| Outer orchestrator provisions one sandbox per subagent/task. In-sandbox orchestrator runs the request → plan → build → test → review → document chain, matching the source framework's pipeline. |
There was a problem hiding this comment.
When the in-sandbox orchestrator invokes Claude or accesses private source control, it must authenticate, but the plan simultaneously forbids credentials from entering the VM and specifies no host-side credential broker, authenticated proxy, or artifact-transfer protocol. As written, the pipeline cannot perform authenticated work without violating its core security contract; define and verify the credential-mediation and repository/output data flow before implementation.
Useful? React with 👍 / 👎.
| ### Task 4: Wire In Session-Lifecycle Hooks | ||
| ``` | ||
| .claude/hooks/sandbox-session-start.md # provision + connect before work begins | ||
| .claude/hooks/sandbox-session-stop.md # teardown + verify no credentials were copied in | ||
| ``` |
There was a problem hiding this comment.
Adding these Markdown files will not wire lifecycle behavior: the inspected .claude/settings.json registers SessionStart and Stop as explicit command hooks, while the existing .claude/hooks/*.md files are only specifications. Because Task 4 includes neither executable handlers nor settings registration, provisioning and teardown will never be invoked as described, leaving created VMs running; include the commands and .claude/settings.json changes required to register them.
Useful? React with 👍 / 👎.
1 participant
Summary
Adds
PLANNING/boris-methodology-upgrade/PHASE-7-AGENT-SANDBOXES.md, extending Phase 6 (parallel cloud sessions) with real isolation.Source: exe.dev / IndyDevDan, "Engineers... Your Software Factory NEEDS Agent Sandboxes to SCALE" — indexed and queried via TwelveLabs Jockey.
What the framework actually is
host → sandbox → factory → app("Factory In A Box")Fit against this repo
The closest existing infrastructure precedent is Clawbox (
openclaw-agents:clawbox-deploy) — already VM-based, Tailscale-meshed, SSH-managed. This plan retargets Clawbox's provisioning pattern from persistent-per-client to throwaway-per-task, and formalizes the "keys never enter" boundary Clawbox doesn't currently document.Git worktrees (what Phase 6 gestures toward) stay the lightweight tier for same-machine parallel sessions; VM sandboxes become the isolated/untrusted-work tier.
Contents
SUBAGENT-FRAMEWORK/, Phase 6, Clawbox, and.claude/hooks/SUBAGENT-FRAMEWORK/sandboxes/, new hooks, new skill)No code changes — planning doc only. Implementation is a follow-up PR once this plan is reviewed.