Permissions
A worker should not receive a tool, credential, or execution target merely because it has been asked to write code.
Private internal project. Features described here are evidence-limited and are not offered as a public execution service.
Default child authority
Spawned workers are intentionally narrower than interactive root sessions. Root sessions can use host-level capabilities; child workflows do not automatically inherit those capabilities. Treat this as an execution-scope difference, not proof that all host software is sandboxed.
Operator-granted work
For an explicitly approved restricted coding job, authorization specifies one frozen task, bounded source files, permitted tests, budget, and worker identity. The child cannot choose arbitrary host commands or mint its own authorization.
Immutable source and independent checks
Generated candidates run against a copied source snapshot, separate from the original checkout. Producing a candidate is not permission to apply it. Test evidence and signed receipts must be examined before any subsequent change.
What remains prohibited
Unattended grants, automatic protected-branch updates, remote machine execution, and expanded privileged access are not authorized by the tested experimental workflow.
Known limitations
Local signatures and restricted guest probes protect specified surfaces under defined assumptions. They do not establish universal container isolation or resistance to a compromised same-user host process.