Sandbox Agent

The deciding trait is that swapping agents is configuration. Six of them answer the same calls, so the choice you agonised over in January becomes a line you edit in March when something better appears. Anyone who has hard-coded one vendor's session behaviour into a product knows what that is worth.

What you should not expect is a tool you use directly. This is scaffolding for something you are building, and the day-to-day experience is your own product's. Pick it if you are integrating. Pick Warren if you want the runs supervised for you.

A pre-1.0 version number on a foundational layer is a promise that something will move. The published commands pin a minor series rather than a major one, which is prudent and also an admission: upgrades in this range are permitted to break, and the thing being upgraded sits between your product and every agent it drives.

What it does right is putting the version in the instructions rather than telling you to install the latest and discover the change during an incident.

1. A durable ordered event log is the difference between an agent run you can study and one you can only remember. Replay from a database makes a past run reproducible as an object, which is the precondition for any serious analysis of failures. 2. Naming two analytic stores rather than one proprietary sink keeps the data in systems that already have query tools.

2. A machine-readable specification means the contract can be validated automatically instead of being trusted, which is rare on this board.

This is a good example of a component released to create demand somewhere else. The sponsor sells infrastructure; a free daemon that makes agent workloads portable across sandbox providers is exactly the thing that grows the market it sells into. That alignment is honest and it is also conditional on the sponsor's strategy not changing.

Moat: becoming the default interface, which is winner-takes-most if it happens. Likely acquirer: a cloud sandbox vendor buying the standard. Position: adopt the interface, and keep your own abstraction thin enough to survive a sponsor pivot.

Finally something built for operators. Runs happen behind an interface my platform team controls, it executes without a human present so it becomes a pipeline step we can gate on, and the spend is metered infrastructure rather than sixty seats, which my finance team already knows how to forecast.

What is missing is the identity layer: no directory integration and no user model, so access control is whatever we build in front of it. Approved with conditions: it sits behind our own gateway, and no engineer reaches it directly.

A single static binary is the most portable thing anyone can ship me. There is no interpreter to match, no dependency tree to resolve inside a container image, and the same artefact runs in a hosted sandbox or on a box under my desk without a second build path.

The licence keeps a fork viable and the CLI wrapper means I can drive it from a shell script before writing any code against it. My reservation is that the agents it drives are still theirs, not mine, so ownership stops at this layer.