Watch

Transaction Science e526133f21 Sandbox + JCP: long-horizon agent execution

Add a coherent set of long-running-agent capabilities, each as a spec
section + reference implementation + conformance class, every one metered,
attested, and receipt-chained.

Sandbox:
- §13 Durable run records (C6): the receipt chain IS the resumable run;
  execute/suspend/resume segments hash-chained; idle energy metered across
  parks. (sandbox-attest::runrecord)
- §14 Environment manifest (C7): devcontainer.json declarative-subset
  ingestion -> canonical, content-addressed, signed manifest;
  command/widening and unknown fields refused. (sandbox-attest::manifest)
- §5.5 Content-addressed process control (C8): exec allow/deny by BLAKE3 of
  the binary; denylist absolute, survives rename/move/wrapper.
- §15 Warm pools (C9): a claim attributes accrued idle energy to the run
  (a fast start has a visible joule price); evictions record overhead, not
  zero. (sandbox-attest::warmpool)
- §16 Fleet records (C10): merkle aggregate receipt over per-item runs;
  log-size membership proofs. (sandbox-attest::fleet)
- durable.json cross-impl wire vectors + file-backed verify.

JCP:
- §4.6 Standing grants (C20): a signed mint policy turns a held grant into
  bounded, rate-limited, event-triggered children via the attenuation path.
  (jcp-grant::standing)
- §4.7 Checkpoints + amendments (C21): mid-run steering under separation of
  duties — the agent checkpoints its own state, only the issuer (a distinct
  principal) may amend, and only to tighten. (jcp-grant::checkpoint)
- standing.json cross-impl vectors.

Both workspaces green; conformance harnesses pass with no skips; clippy clean.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

2026-06-12 23:14:59 -04:00

3.6 KiB

Raw Permalink Blame History

Durable run records

Agent work is no longer minutes long. The valuable runs span hours or days, outlive the machine that started them, pause for review, and resume elsewhere. Most platforms make the process the unit of survival and keep it alive in a cloud sandbox. This standard takes the stronger position: the record is the run. An execution is a chain of sealed segments; the sandbox that hosted any one segment is disposable, and what survives — what can be suspended for a week, restored on different hardware, and handed to an auditor afterwards — is the run record.

The record

A run record is an append-only, hash-chained sequence of segments belonging to one unit under one grant set. The genesis head binds both:

head₀ = BLAKE3("sandbox.runrecord/1" ‖ unit_id ‖ grants_id)
headₙ = BLAKE3(headₙ₋₁ ‖ segmentₙ)

Two records can never be spliced — not across units, and not across grant sets. A continuation that wants different grants is a new run.

Three segment kinds:

Executed — one active interval, recorded by the content address of its attestation (§7), which already binds the interval's energy receipt (§6), replay-journal root (§8) and outcome. Nothing is re-stated; the record points at sealed objects.
Suspended — the run parked. Records a snapshot reference: the content addresses of the retained filesystem root, the memory image if the executor retains resident state (S5 snapshots), and the environment manifest the run was created from.
Resumed — the run un-parked. Records the snapshot reference restored and the idle energy the retained state drew while parked.

Resumption preconditions

A host MUST refuse to resume unless:

the offered snapshot is content-identical (by address) to the one recorded at suspension — a forked or tampered snapshot breaks the chain rather than silently continuing it;
the resuming environment satisfies the recorded manifest address — "same toolchain" is checked by hash, not by trust;
the record verifies from genesis: head recomputation, strict execute/suspend/resume phase alternation, and snapshot identity at every resume.

A record may be closed at any point, including while parked — abandonment is an honest outcome and leaves an auditable stub.

Energy honesty across suspends

A parked run is not free. Retained volumes, snapshot storage and warm-pool residency draw power continuously. Each Resumed segment carries idle_uj — the microjoules attributed to the retained state for the parked interval, under the same provenance discipline as live metering (§6.2): measured where the host can measure, estimated and labelled where it cannot. The total cost of a run is the sum over its receipts plus its idle energy; a host that reports only active-interval joules for a week-long run does not conform.

Relation to the audit chain

The S7 audit chain (§7.7) orders runs within a steward's domain; the run record orders segments within one run. They compose: each executed segment's attestation may itself carry audit_prev, and a continuation attestation SHOULD cite the run record's current head, mirroring that convention.

Conformance

Class C6 (§10): chain advance and verification across execute → suspend → resume → execute; refusal of forked snapshots (SnapshotMismatch); refusal of phase violations (execution while parked); idle-energy accumulation; tamper-evidence through the wire form (a modified recorded snapshot must fail verification); refusal of appends after close.

The reference implementation is sandbox_attest::runrecord.

3.6 KiB Raw Permalink Blame History