§12g. Sandbox tier (Phase B)

planarian @ a924e09 · Spec v4.6 · snapshot main · all versions

Agent-speed iteration happens beside the real machine, not on it. Three tiers, cheapest first: dry-run (verify_candidate, risk derivation, and closure diff, with no activation: seconds); sandbox (the candidate generation booted in a Firecracker microVM restored from a snapshot of the settled reference generation, probes run inside, VM discarded; snapshots keyed by generation hash; built with microvm.nix); real (this section’s transaction path). From B, a proposal at tier Tested or above reaches the real path only with a passing sandbox run against the same staged_source, recorded in the journal as evidence. The sandbox pass does not shorten the real settle window. Where KVM is unavailable, the daemon reports sandbox: unavailable and Tested is floored to AskFirst: the machine degrades to a person looking first, never to skipping the check. The sandbox’s verdict is evidence, like a probe; it never promotes anything, and it runs untrusted candidates under Firecracker’s jailer. Firecracker cannot host device-family faults (GPU, Wi-Fi hardware, USB, suspend/resume); those stay on the QEMU or bare-metal gym target.