Pimp My IDE / garage dispatchBack to the garage
October 9, 2026 / agent execution / observability

A sandbox needs a witness.

Containment can block a process. It cannot tell you, by itself, which policy loaded, what the process tried, what escaped, or how the run ended.

Wire the cage and the recorder as separate systems.
TEST CELL / RUN 001SPEC ONLY
NO EXECUTION EVIDENCE ATTACHED
RouteConfineObserveClose

The cage is one half of the job.

Microsoft's new MXC repository packages several containment backends behind Rust, .NET, and Node SDKs. Its policy model covers read-only, writable, and denied paths. It also covers outbound network rules and user-interface access. The selected backend changes by platform.[1]

That is useful engineering. It is also a warning against treating the word sandbox as one fixed strength. A process sandbox, Bubblewrap profile, Windows Sandbox, and microVM do not create the same boundary. The policy and backend belong in every run record.

A blocked action proves one boundary fired. It does not prove the whole cage.

Read the defaults before the badge.

VS Code 1.141 adds cross-platform terminal sandboxing for Copilot Agent Host sessions. Its documentation says the sandbox is off by default. Outbound network access and requests to run outside the sandbox both default to allowed. The same page says the process still runs under the user's account and that approvals are separate from isolation.[2]

The useful control is the effective policy report. VS Code exposes it through /sandbox policy. That report names the execution host, implementation, file rules, and network rules. Capture it before the test. Then run a harmless denied-file probe and a denied-network probe. Save both failures.

Telemetry is another route.

OpenTelemetry describes logs, traces, metrics, and profiles as separate signals. Its current design guide recommends standard OTLP export with useful context and semantic conventions. It also separates software that users run from platforms that forward telemetry for them.[3]

A trace does not strengthen containment. It tells you what the instrumented path reported. Keep the trace destination, sampling policy, redaction policy, and dropped-signal behavior beside the sandbox policy. A clean dashboard cannot prove that an uninstrumented escape did not happen.

Close the run with a receipt.

Record the revision, backend, effective policy, command, fixture, blocked probes, exit status, output digest, telemetry destination, and cleanup result. Keep the test disposable. MXC's audit mode turns off sandbox security, so its own README says never to use that mode with untrusted code.[1]

The pattern is plain. Confine with one system. Observe with another. Attack both assumptions with a fixture you can throw away.

Interactive makeover / sandbox badge replaced

Wire the test cell.

This replaces one green "sandboxed" lamp with two independent lanes. The containment lane defines the boundary. The witness lane defines what the operator must collect. The component drafts a test specification. It does not run code or collect telemetry.

Name routeSet boundaryAttach witnessWrite receipt

Boundary switches

Select the requirements the test specification should include. Selected means requested for review. It does not mean implemented or passed.

Containment lane
Witness lane
Two-lane manifold / structure only

Test specification

Containment0 / 3
Witness0 / 3
0 of 6 requirements selected
Specification emptySelect the requirements this test should request. No policy, probe result, trace, output, or cleanup evidence is attached.
Sources read / October 9, 2026

Source log

Open the evidence boundary
  1. Microsoft MXC repository at commit a0b66e6, read October 9, 2026. The README documents supported platforms, backends, file, network, and UI policy, lifecycle operations, SDK packages, diagnostics, audit-mode risk, and optional telemetry conditions.
  2. VS Code, "Sandbox Copilot Agent Host sessions", read October 9, 2026. The page documents the boundary, defaults, platform prerequisites, effective-policy report, path precedence, credentials, network controls, and unsandboxed fallback.
  3. OpenTelemetry, "OTel-Native by Design", published and read October 9, 2026. The post defines the four signal types and describes vendor-neutral OTLP export, context preservation, semantic conventions, and the difference between self-hosted and platform-owned export.
  4. Hacker News discussion, "MXC - a sandboxed code execution system", item 50016489, read October 9, 2026. We resolved the exact discussion URL through the Hacker News API. The thread led to the repository. It does not verify MXC's security properties.

Artifact check: the canonical repository's main revision resolved to a0b66e63c329d6dcf5efef0e3fa9920025722199. The npm, crates.io, and NuGet registries each reported MXC SDK version 1.0.0. We read the pinned README. We did not install MXC, run untrusted code, or test a containment backend. The test cell is an original planning component. It executes nothing and records no telemetry.