Compatibility: Pactmark 0.1.x. unsafe_local_development is a capability label, not a sandbox guarantee — see Sandbox boundary.

​
Run it

​
What it demonstrates

This is the example that spends most of its energy on things going wrong, which makes it the most educational one in the repository.

Allowlisted roots

The agent can read and write inside declared roots and nowhere else.

Path traversal denial

../, encoded variants and repeated decoding are all normalized before comparison.

Symlink denial

Physical symlink resolution, so a link out of the root is refused rather than followed.

Draft artifacts

Intermediate output becomes a content-addressed draft before it becomes a result.

Command, output and time limits

Bounded and enforced by the executor, not by the tool’s good behaviour.

Cancellation

The AbortSignal reaches the tool and the run reaches cancelled cleanly.

Redaction

Workspace bodies do not leak into events, telemetry or evidence.

​
Why path normalization is its own discipline

These must all resolve to one value before any comparison happens:
The repository covers this with property-based canonicalization tests plus traversal and symlink probes — threat model row TM-09. A single missed decoding pass is a workspace escape.
If you build a UI that displays or accepts workspace paths, canonicalize with the same function the policy uses. Two different normalizations is how a path that “looks fine” resolves somewhere else.

​
The container contract fixture

The example ships a container contract fixture describing a minimum adapter boundary: non-root user, no network, read-only root, tmpfs workspace, no mounts or Docker socket, dropped capabilities, no-new-privileges, and process, memory, CPU, time and output limits.
It describes a boundary. It does not claim arbitrary-code isolation or production hardening. Production arbitrary-code execution requires a separately selected, independently assessed isolation system.

​
The denial paths are the tests

The last one is a redaction canary. It fails the build if workspace bodies ever appear in a surface that is supposed to carry only digests and metadata.

​
What it does not prove

The capability label unsafe_local_development is exactly what it says. This example demonstrates that path and resource bounds behave correctly. It does not demonstrate isolation of the code that runs inside those bounds, and it is not evidence about kernel, container-runtime, side-channel or multi-tenant attacks.

​
Adapting it

1

Replace the virtual filesystem with a real one

Keep the same denial tests. If any of them stop failing, you have lost a control.
2

Declare your roots narrowly

One root per purpose beats one root with subdirectory conventions.
3

Add a real SandboxAdapter before untrusted content

If the files came from users or a model, the fixture is not enough.
4

Keep the redaction canary

It is the cheapest test in the suite and it catches the most embarrassing bug.

Sandbox boundary

Why the container fixture is a fixture.

Defining tools

Declaring scopes, limits and egress for your own tools.