[JacobStephens2]

Summary

Adds section 10 to docs/research/eval-sandboxes.md, with #1009's live checks as far as they go without real logins. They ran on the thirdshift host with test processes, fake credentials and fresh homes. No real login was bound or read, and nothing was installed.

• Isolation: inside bwrap, a process sees its own 5 PIDs and only lo. It can't reach the Console on loopback, or see /home/jacob.
• Interruption: thirdshift's stop path reaches a Harness inside the PID namespace with SIGTERM and SIGINT, with or without --new-session. Killing the outer bwrap leaves nothing running.
• The proxy relay reaches allowed hosts, and refuses GitHub and names that resolve to loopback. A direct connection without it has no route. Unix-socket paths are capped at 108 bytes, so the launcher needs a short socket path.
• HTTPS_PROXY: all six Harnesses honour it, and the note gives each one's hosts. Codex syncs plugins from GitHub at startup, and carries on when that's refused. OpenCode needs NO_PROXY for loopback, and must be given a provider, or it falls back to a free model.
• Web search off: the switches for Claude, Codex, Grok, Muse and OpenCode, which production sessions don't pass today. agy's is still open.
• Memory: every Harness keeps its state under its home, so a fresh home per Trial turns memory off.
• Footprint: a snapshot of the sessions running at the time.

Still open, for a session with the real logins:

• each Harness's login and refresh inside bwrap, and Claude with a setup token;
• the hosts used with a real subscription login;
• agy's web search;
• a Trial's memory beside two building Runs.

Part of #1009. No code changes.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BnFUcJ51dAFoj97E8FSXQF