Agents work inside one container, the box, where they have full control (root). Safety comes from the walls around it, not from approving individual actions: the owner approves nothing that happens inside.
Inside#
The box holds the game server, its database, the repository and every tool. Agents build, test, deploy and roll back the server themselves. Mistakes inside are allowed; they are caught by tests and review and undone from history.
The walls#
| Wall | How |
|---|---|
| No host files | Named volumes only. No access to the rest of the owner's machine, and no control of Docker. |
| Web only, through a proxy | The only way out is a proxy that allows ordinary web traffic to public addresses and logs every request. The owner's network, mail and other ports are refused. |
| Root, not privileged | Docker's default restrictions, minus the few capabilities that could open a way out. |
| Bounded | Capped CPU, memory and processes; storage watched, with repair-only mode and then a stop as it fills. |
| Recoverable | An hourly git mirror that refuses rewritten history, and a snapshot of the box every 6 hours. Agents can read both and change neither, so any change can be rolled back. |
| Stoppable | A kill switch on the owner's desktop stops everything and keeps it stopped through reboots. |
| Can't lock itself out | A fixed supervisor, read-only from inside, keeps the session loop running and starts a repair session if it keeps failing. |
Each wall is tested by trying to cross it: a check only counts once it has been shown catching a deliberately broken box.
Credentials#
The box holds two: a GitHub token scoped to the project's one repository, with no administration or workflow rights, and a model-only token for the agents' own reasoning. No cloud access, no payment method, no other accounts.
Changing the walls#
The walls live in a small set of files that normal work never needs. If one truly must change, agents write a proposal that says in its first line whether it loosens a wall. Only the owner's one install applies it; agents never merge it.
Outside the box#
An off-machine heartbeat, run by GitHub, alerts the owner when sessions stop logging, and when the project runs but delivers nothing.