Produce a development-ready specification and a working Pi-only proof of concept for agent session sandboxing with gVisor. It must support host-installed and official-Docker Linux daemon topologies and satisfy every acceptance requirement in goals/gvisor-agent-isolation.md, including preserving an active turn across daemon restart.
Notes
Baseline: getpaseo/paseo commit a69dca2 and goals/gvisor-agent-isolation.md.
Canonical term: Agent session sandboxing. Do not overload Isolation, which already names workspace creation intent.
The proof of concept selects sandboxed execution host-wide for Pi. Other providers remain local.
If sandbox prerequisites are unavailable, creation must report the failure and offer an explicit local retry; never fall back silently.
This effort overrides Wayfinder's planning-only default: implementation may graduate into tickets once the relevant decisions are settled.
Consult docs/architecture.md, docs/agent-lifecycle.md, docs/data-model.md, docs/providers.md, docs/docker.md, and SECURITY.md. Use the research, prototype, grilling, and domain-modeling skills as required by ticket type.
Research active-turn reattachment for Pi RPC: Pi cannot reattach directly; active-turn continuity requires a supervisor-owned bridge with sequenced replay, acknowledgments, and writer fencing.
Prove active-turn continuity across daemon restart: a supervisor-owned bridge preserved one Pi/runsc runtime across daemon-client crash with fenced writers, cursor replay, duplicate suppression, post-reattach cancellation, and cleanup.
Define the backend-neutral execution contract: use a lifecycle-oriented process seam with local and OCI adapters; backend-owned identities can attach, inspect, release, and clean up while provider protocol and bridge replay remain outside the generic interface.
Not yet specified
Production implementation slices and sequencing beyond the first proof of concept; these depend on the execution, supervisor, persistence, mount, network, and verification contracts.
Final documentation and upstreaming boundaries after the proof of concept demonstrates which generic abstractions are real.
Out of scope
Claude, Codex, Copilot, OpenCode, OMP, ACP, and custom-provider sandbox integration.
Workspace terminals, PTYs, Node IPC, and terminal profile execution.
Non-Linux platforms and cross-host scheduling.
Production image supply-chain automation, broad credential brokering, and full multi-runtime portability beyond preserving an OCI-oriented seam.
## Destination
Produce a development-ready specification and a working Pi-only proof of concept for agent session sandboxing with gVisor. It must support host-installed and official-Docker Linux daemon topologies and satisfy every acceptance requirement in `goals/gvisor-agent-isolation.md`, including preserving an active turn across daemon restart.
## Notes
- Baseline: `getpaseo/paseo` commit `a69dca2` and `goals/gvisor-agent-isolation.md`.
- Canonical term: **Agent session sandboxing**. Do not overload **Isolation**, which already names workspace creation intent.
- The proof of concept selects sandboxed execution host-wide for Pi. Other providers remain local.
- If sandbox prerequisites are unavailable, creation must report the failure and offer an explicit local retry; never fall back silently.
- This effort overrides Wayfinder's planning-only default: implementation may graduate into tickets once the relevant decisions are settled.
- Consult `docs/architecture.md`, `docs/agent-lifecycle.md`, `docs/data-model.md`, `docs/providers.md`, `docs/docker.md`, and `SECURITY.md`. Use the `research`, `prototype`, `grilling`, and `domain-modeling` skills as required by ticket type.
## Decisions so far
- [Research the gVisor supervisor topology for both Linux deployments](https://git.jb.codes/jb/paseo/issues/2): use one root-owned host supervisor with direct `runsc`; both daemon topologies reach it only through a narrow Unix socket.
- [Research active-turn reattachment for Pi RPC](https://git.jb.codes/jb/paseo/issues/3): Pi cannot reattach directly; active-turn continuity requires a supervisor-owned bridge with sequenced replay, acknowledgments, and writer fencing.
- [Research Pi sandbox state, credentials, MCP, and egress requirements](https://git.jb.codes/jb/paseo/issues/4): use a pinned Pi image, exact-path workspace mounts, narrow persistent state and credentials, a private MCP route, and deny-default provider-specific egress.
- [Prove active-turn continuity across daemon restart](https://git.jb.codes/jb/paseo/issues/5): a supervisor-owned bridge preserved one Pi/runsc runtime across daemon-client crash with fenced writers, cursor replay, duplicate suppression, post-reattach cancellation, and cleanup.
- [Define the backend-neutral execution contract](https://git.jb.codes/jb/paseo/issues/6): use a lifecycle-oriented process seam with local and OCI adapters; backend-owned identities can attach, inspect, release, and clean up while provider protocol and bridge replay remain outside the generic interface.
## Not yet specified
- Production implementation slices and sequencing beyond the first proof of concept; these depend on the execution, supervisor, persistence, mount, network, and verification contracts.
- Final documentation and upstreaming boundaries after the proof of concept demonstrates which generic abstractions are real.
## Out of scope
- Claude, Codex, Copilot, OpenCode, OMP, ACP, and custom-provider sandbox integration.
- Workspace terminals, PTYs, Node IPC, and terminal profile execution.
- Non-Linux platforms and cross-host scheduling.
- Production image supply-chain automation, broad credential brokering, and full multi-runtime portability beyond preserving an OCI-oriented seam.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Destination
Produce a development-ready specification and a working Pi-only proof of concept for agent session sandboxing with gVisor. It must support host-installed and official-Docker Linux daemon topologies and satisfy every acceptance requirement in
goals/gvisor-agent-isolation.md, including preserving an active turn across daemon restart.Notes
getpaseo/paseocommita69dca2andgoals/gvisor-agent-isolation.md.docs/architecture.md,docs/agent-lifecycle.md,docs/data-model.md,docs/providers.md,docs/docker.md, andSECURITY.md. Use theresearch,prototype,grilling, anddomain-modelingskills as required by ticket type.Decisions so far
Research the gVisor supervisor topology for both Linux deployments: use one root-owned host supervisor with direct
runsc; both daemon topologies reach it only through a narrow Unix socket.Research active-turn reattachment for Pi RPC: Pi cannot reattach directly; active-turn continuity requires a supervisor-owned bridge with sequenced replay, acknowledgments, and writer fencing.
Research Pi sandbox state, credentials, MCP, and egress requirements: use a pinned Pi image, exact-path workspace mounts, narrow persistent state and credentials, a private MCP route, and deny-default provider-specific egress.
Prove active-turn continuity across daemon restart: a supervisor-owned bridge preserved one Pi/runsc runtime across daemon-client crash with fenced writers, cursor replay, duplicate suppression, post-reattach cancellation, and cleanup.
Define the backend-neutral execution contract: use a lifecycle-oriented process seam with local and OCI adapters; backend-owned identities can attach, inspect, release, and clean up while provider protocol and bridge replay remain outside the generic interface.
Not yet specified
Out of scope