Rollback is not isolation.

A good abort button can still touch the real tree

DeltaBox Lite v0.1.1 offers agent sessions with three file modes. In cbcow-through, pending changes appear in the host project at once. Commit accepts that state and retires the undo history. Abort replays the undo records into the same host-visible tree.^[2]

That is a useful transaction model. It is not pre-commit isolation. A watcher, editor, test process, or indexer outside the session can observe a pending write before review. The project documentation says outside host writes are unsupported while a through-mode session owns the project.^[2]

Ask two questions: can I undo the write, and who can see it before I decide?

Private mode moves the review boundary

cbcow-private keeps the host project unchanged while the agent works in a private LIVE tree. Commit checks touched host paths for conflicts before publishing them. Abort restores the private working state. copy-private keeps the same host-visibility rule as a compatibility fallback, but uses a private working copy instead of the DeltaFS path.^[2]

The docs say Linux requests cbcow-through when DeltaFS FUSE is ready. macOS requests its APFS and FSEvents through-mode provider. If that provider is unavailable, the tool reports the reason and falls back to copy-private. The --require-fs-mode option turns that fallback into an error.

This requested-versus-resolved split belongs in every run receipt. The mode you asked for is policy. The resolved mode and its host-visibility field describe what started.

File rollback and process confinement do different work

The project says Linux combines its file engine with Sandlock, Landlock, and seccomp. The Linux kernel documentation describes Landlock as a stackable security module that lets a process restrict its own filesystem and network rights. It also tells applications to detect the available Landlock ABI because older kernels support smaller sets of access rights.^[4]

That means a review record needs the active isolation provider and any degraded protections. A successful file abort does not prove that network access was denied. A denied network request does not prove that pending file changes stayed hidden from the host.

DeltaBox's policy guide makes one default worth calling out. Its allow_audit network mode permits unrestricted networking while recording audit information. Use deny_all or an allowlist when the task requires a network boundary.^[3]

The release exists, but we did not run its sandbox

GitHub lists v0.1.1 as a release published on October 14, 2026. We fetched the versioned deltabox-lite-0.1.1.tgz archive without installing it. The file measured 3,985 bytes, contained five entries, and had SHA-256 bd001387bdf8c09b4867ce256dc872239ed0d37732fac16d6226a8ca0c4bb9a8.^[1]

That archive inventory proves the publisher distributed a launcher package under that version. It does not prove that native binaries load, rollback works, or the advertised isolation holds on a real host. Those claims need disposable-host tests with blocked file and network actions, resolved-mode readback, diff review, commit, abort, and crash recovery.