Skip to main content
Prepared tasks use supervised processes and a caller-owned journal. Planning does not install a model runtime or sign an agent into a provider account; prepare the worker environment and its independently authorized access first.

Plan, launch, inspect

The worker file and authorized input must exist before launch. Retain the private plan and original task ID. Placeholders expand from its contract; upload multiline source as a file. Both original and expanded argv have validated bounds and reject control characters. A fresh parent with the same journal inspects an uncertain launch using exact worker name, workspace and command hash. Missing, ambiguous, mismatched and unavailable workers remain explicit. inspect never launches a replacement; bounded wait does not stop the child on timeout or local cancellation.

Inputs and result bundles

Reviewed inputs bind remote path, byte count, SHA-256, and supported batch manifests. Do not replace files after review or treat caller metadata as proof of a remote write. Observed process success is separate from task quality. Collect declared outputs before sandbox expiry into a new private bundle, retain its manifest, and verify hashes and the actual answer. Partial collection retains failure evidence rather than claiming completion. Saved bundles support offline review after process logs/sandbox disappear. Journals and bundles may contain sensitive project data.

Teams and durable orchestration

Node AgentTeams coordinates reviewed members/concurrency and private team receipts. Keep the returned team_id; reconcile uncertain dispatch rather than preparing a new team. The local MultiAgentOrchestrator is a different in-process DAG scheduler and does not persist its queue through caller restart. Separately durable orchestration uses Temporal through DurableRunClient, with that service’s own credentials and recovery contract.

Server registry and grants

Opt-in registered teams publish curated metadata before workers start. This needs the Node registry release and migration 067. Registration launches no worker; uncertain registration fences dispatch. Its root UUID coordinates metadata and normally has no process. Grants cover current/future descendants. Revocation and admission serialize on the root. Sandbox/process permissions remain independent: family discovery cannot grant execution. TaskRegistryObserver supports fresh CLI/TUI/MCP observers without launch journals. It verifies SDK process identity and command hash, pages families, and reports task quality as not_evaluated. Preserve cursor/filters; a partial page cannot establish family_complete. Server metadata does not reconstruct private input/control/result receipts.

Evidence scope

The retained October 19 hosted exercise used three prepared Python workers with fresh CLI, stdio MCP and PTY TUI observers, verified results and cleanup. A separate Codex exercise used independently signed-in sandboxes. These do not establish arbitrary fleet scale, provider failure recovery, or correctness of every model answer. Source: SDK guide, docs/SANDBOX_WORKBENCH.md, and docs/releases/2026-10-v2.11.0.md, checked at 67bc2370 on October 20, 2026. Continue with the workbench or MCP.
Last modified on October 20, 2026