Boundary receipt #1 — historical inner-sandbox observations
This newly written public summary preserves a scoped, operator-reported negative-test observation from an earlier sandbox context; it is not a live log, current-version claim, or retest of the 2026-10-03 architecture narrative. No private host, address, image digest, or command transcript is included. The observation concerns one inner sandbox. It cannot establish isolation between logical workload groups, containment by the operator-core VM, or recovery success.
Scope
| Item | Value |
|---|---|
| Boundary observed historically | Inner sandbox around an agent runtime (container + kernel filesystem policy + application-layer egress proxy + network namespace) |
| Method | Adversarial negative-test matrix run from inside the sandbox |
| Runtime identity | Non-root process |
| Default policy | Read-write workspace only; system paths read-only; deny-by-default egress |
| Mutating production systems | None |
| Secrets included | None |
| Claim supported | Refusals under the reported probes at one inner sandbox, not current architecture behavior or outer containment |
Negative-test matrix
Each row reports a historical attempt to cross that inner sandbox boundary; results are scoped to those attempts, not universal guarantees.
| Probe | Observed | Verdict |
|---|---|---|
| External HTTPS egress | Connection refused by the application-layer proxy (403 CONNECT-tunnel failure) | Blocked |
| External HTTP egress | Request refused (403) | Blocked |
Cloud-metadata SSRF (link-local 169.254.0.0/16 range), HTTP and HTTPS |
Refused with an explicit policy-denied response | Blocked |
| LAN lateral movement to an internal service | Refused | Blocked |
| Direct-socket egress probe | The attempted direct socket connection was refused | Refused in this probe |
| External DNS resolution | No external resolver available | Blocked |
| Write to a read-only system path | Permission denied by kernel filesystem policy | Denied |
| Write to the designated workspace | Allowed | Expected |
| Provider credentials in process environment | None present | See non-claims |
Reported observation: the historical probes refused application-layer and direct-socket egress attempts, metadata SSRF, lateral movement, and DNS attempts. Filesystem and non-root checks are scoped to the same sandbox. The direct-socket refusal does not identify the enforcing mechanism or prove that all proxy-bypass paths are blocked. These outcomes do not prove the current runtime, every egress route, or realm isolation.
What this receipt does NOT claim
- No outer containment proof. It does not show that an escaped sandbox is contained by an operator-core VM, hypervisor, or host-management boundary.
- No end-to-end credential proof. The historical environment check found no working provider credential in the examined sandbox. Receipt #2 adds placeholder configuration and a stopped misroute, not a successful credential-resolved request.
- No universal or current isolation guarantee. These empirical probes do not exhaust all routes, demonstrate current-version behavior, or prove isolation between logical workload groups.
Other boundary classes
Current realm isolation, outer containment, successful credential resolution, and recovery require separate evidence. Read this against the verification model: it is a historical scoped observation, not a production canary or a bridge from fictional substrate PASS examples to the operator-reported present architecture.
Read alongside boundary receipt #2 — inference boundary, the governed-agent-workload case study, and the substrate validation receipt.