Skip to content

Docs: the README's status names the sandbox, and EVIDENCE says concurrent tool calls are built #360

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lydakis merged 1 commit into from
Oct 29, 2026
Merged

Docs: the README's status names the sandbox, and EVIDENCE says concurrent tool calls are built #360

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 9 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -262,16 +262,22 @@ measurements behind every decision.
Agent is an experiment with no users yet. It supports the OpenAI Responses and
Anthropic Messages APIs, with streamed thinking, usage, and prompt-cache
accounting; long conversations are compacted while the full history is kept.
MCP and handing a conversation across providers are not implemented.
The daemon has no MCP client (Sonny reaches MCP servers through its `exec`
tool), and handing a conversation across providers is not implemented.
Protocols, CLI defaults, and the store format may change between revisions;
stores migrate forward automatically.

Agent runs bots; it doesn't create workspaces, manage Git branches, or choose
machines. Those stay with the caller. To run work on another machine, see
[Errand](https://github.com/lydakis/errand).

Bots run their tools with your permissions, directly on your machine. Agent
provides no sandbox; run it inside one if you need isolation.
Bots run their tools with your permissions, directly on your machine, unless
they are made with a `sandbox`: `read-only` or `workspace-write` confine their
commands, writes and edits under bubblewrap on Linux and Seatbelt on macOS,
ported from Codex. A call that would leave the sandbox goes to the bot's
approval gate, and is refused when it has none. A bot made without a sandbox
runs unconfined, as `danger-full-access` does. Sonny sandboxes its leads and
tasks by default. See [sandbox](docs/RUST_PROTOTYPE.md#sandbox).

## When you need more

Expand Down
5 changes: 4 additions & 1 deletion docs/EVIDENCE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -429,4 +429,7 @@ the 10 focused hub tests, Clippy, formatting, and diff checks also passed.
- Tool approval at fleet scale on macOS.
- How often either judge allows a risky call: the labeled set holds only
calls that should run, so it measures false denials, not false allows.
- Multi-daemon operation and concurrent tool calls: designs only.
- Multi-daemon operation: a design only.
- What running tool calls together (#291, up to four at a time) saves on
real tasks: it is implemented, and one test shows two 0.6 s commands
finishing in under 1.1 s, but no run has measured it on a fleet.
Loading