Plan, launch, inspect
inspect never launches a replacement; bounded wait does not stop the child on
timeout or local cancellation.
Inputs and result bundles
Reviewed inputs bind remote path, byte count, SHA-256, and supported batch manifests. Do not replace files after review or treat caller metadata as proof of a remote write. Observed process success is separate from task quality. Collect declared outputs before sandbox expiry into a new private bundle, retain its manifest, and verify hashes and the actual answer. Partial collection retains failure evidence rather than claiming completion. Saved bundles support offline review after process logs/sandbox disappear. Journals and bundles may contain sensitive project data.Teams and durable orchestration
NodeAgentTeams coordinates reviewed members/concurrency and private team receipts.
Keep the returned team_id; reconcile uncertain dispatch rather than preparing a new team.
The local MultiAgentOrchestrator is a different in-process DAG scheduler and does not
persist its queue through caller restart. Separately durable orchestration uses Temporal
through DurableRunClient, with that service’s own credentials and recovery contract.
Server registry and grants
Opt-in registered teams publish curated metadata before workers start. This needs the Node registry release and migration 067. Registration launches no worker; uncertain registration fences dispatch. Its root UUID coordinates metadata and normally has no process.
Grants cover current/future descendants. Revocation and admission serialize on the root.
Sandbox/process permissions remain independent: family discovery cannot grant execution.
TaskRegistryObserver supports fresh CLI/TUI/MCP observers without launch journals. It
verifies SDK process identity and command hash, pages families, and reports task quality as
not_evaluated. Preserve cursor/filters; a partial page cannot establish family_complete.
Server metadata does not reconstruct private input/control/result receipts.
Evidence scope
The retained October 19 hosted exercise used three prepared Python workers with fresh CLI, stdio MCP and PTY TUI observers, verified results and cleanup. A separate Codex exercise used independently signed-in sandboxes. These do not establish arbitrary fleet scale, provider failure recovery, or correctness of every model answer. Source: SDK guide,docs/SANDBOX_WORKBENCH.md, and docs/releases/2026-10-v2.11.0.md,
checked at 67bc2370 on October 20, 2026. Continue with
the workbench or MCP.