From e8c7aac5191ae0ef89a571be7f51dd61952fef80 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 29 Oct 2026 06:19:23 +0000 Subject: [PATCH] Docs: the README's status names the sandbox, and EVIDENCE says concurrent tool calls are built The README still said Agent provides no sandbox, and docs/EVIDENCE.md still listed concurrent tool calls as a design. Both now match main: bots made with a sandbox run confined (bubblewrap, Seatbelt), and calls in a row run together since #291, with no fleet measurement yet. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_013jkdGEK7HMibaxgHFDtGXA --- README.md | 12 +++++++++--- docs/EVIDENCE.md | 5 ++++- 2 files changed, 13 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 2e64cf0e4..07ddd8ade 100644 --- a/README.md +++ b/README.md @@ -262,7 +262,8 @@ measurements behind every decision. Agent is an experiment with no users yet. It supports the OpenAI Responses and Anthropic Messages APIs, with streamed thinking, usage, and prompt-cache accounting; long conversations are compacted while the full history is kept. -MCP and handing a conversation across providers are not implemented. +The daemon has no MCP client (Sonny reaches MCP servers through its `exec` +tool), and handing a conversation across providers is not implemented. Protocols, CLI defaults, and the store format may change between revisions; stores migrate forward automatically. @@ -270,8 +271,13 @@ Agent runs bots; it doesn't create workspaces, manage Git branches, or choose machines. Those stay with the caller. To run work on another machine, see [Errand](https://github.com/lydakis/errand). -Bots run their tools with your permissions, directly on your machine. Agent -provides no sandbox; run it inside one if you need isolation. +Bots run their tools with your permissions, directly on your machine, unless +they are made with a `sandbox`: `read-only` or `workspace-write` confine their +commands, writes and edits under bubblewrap on Linux and Seatbelt on macOS, +ported from Codex. A call that would leave the sandbox goes to the bot's +approval gate, and is refused when it has none. A bot made without a sandbox +runs unconfined, as `danger-full-access` does. Sonny sandboxes its leads and +tasks by default. See [sandbox](docs/RUST_PROTOTYPE.md#sandbox). ## When you need more diff --git a/docs/EVIDENCE.md b/docs/EVIDENCE.md index b7141ee4c..404103609 100644 --- a/docs/EVIDENCE.md +++ b/docs/EVIDENCE.md @@ -429,4 +429,7 @@ the 10 focused hub tests, Clippy, formatting, and diff checks also passed. - Tool approval at fleet scale on macOS. - How often either judge allows a risky call: the labeled set holds only calls that should run, so it measures false denials, not false allows. -- Multi-daemon operation and concurrent tool calls: designs only. +- Multi-daemon operation: a design only. +- What running tool calls together (#291, up to four at a time) saves on + real tasks: it is implemented, and one test shows two 0.6 s commands + finishing in under 1.1 s, but no run has measured it on a fleet.