[JacobStephens2]

Summary

Adds a research note on whether Matt Pocock's Sandcastle could replace thirdshift, or sit under it. It uses the same criteria, in the same order, as openhands-fit.md: subscription auth, then open source and self-hosted, then buy over build.

 docs/research/
 ├── openhands-fit.md
+├── sandcastle-fit.md   # Sandcastle: subscription auth, sandboxes on this host, §1 coverage, conventions
 └── warp-factories-and-alternatives.md

Conclusions:

• Borrow ideas only. Sandcastle is an MIT TypeScript library that runs one claude or codex session in a sandbox on a branch. It isn't a factory: it has no Claims, PR handling, Repair loop, Self-merge, Spec runs, Passes, Security work or notifications.
• Subscription auth works. Claude runs through the unmodified claude -p, with a claude setup-token token inside containers. Codex uses the ChatGPT login when it runs on the host; inside a container you mount the login yourself.
• Its isolation needs Docker or Podman, which this host lacks. Its no-sandbox mode matches thirdshift's trust model, but it passes --dangerously-skip-permissions by default, writes ~/.gitconfig on every run, and leaves the agent running after an abort. The container mode has an open .git escape (Worktree sandboxes mount the host .git read-write, so hooks and config written in the container run on the host mattpocock/sandcastle#1010).
• Not a primitive now. Building on it would add Node, a container runtime and a pre-1.0 dependency, against ADR-0001 and ADR-0003. Its src/ hasn't changed since v0.12.0 on 2026-06-29.
• Worth borrowing:
  • an agent with no credentials, followed by a step that checks and applies its plan (Decide enforced credential isolation for Security fix publishing #691, Decide how to stop a disobedient publishing session from leaking unvalidated public issues #637);
  • Sandcastle's sandbox-provider interface, as a model for a sandboxed Run (A sandboxed mode for Codex sessions #398);
  • schema-checked output with a bounded Resume.

Evidence

Docs only, with no code or tests. Claims cite Sandcastle's source pinned to 7a4e7f7 (still the head of upstream main), gh api, npm view, vendor docs or this repo. Anything else is tagged [unverified], [interpretation] or [needs live check]. A script confirmed every link resolves.

A claim-by-claim check of §2 (subscription auth) and §3 (sandboxes) refuted nothing the verdict rests on. It found wording to tighten, which this PR doesn't include. For example, the permission flag is settled from the code, so it doesn't need a live check.

Merge Danger

Door: two-way

Blast Radius: none

Adds one Markdown file under docs/research/. Nothing reads it at runtime.

🤖 Generated with Claude Code