Every time you open Claude Code or Codex, you're trusting an AI agent to execute code. But what's stopping it from messing with files outside your project? The answer is sandboxing. I didn't fully understand it until I started digging into coding agents' source code. So I implemented it from scratch in Decode (the coding agent I built) to better understand it. Here's what I learned... There are 3 levels of sandbox security: 1. OS-level sandboxing → Seatbelt (macOS) and Bubblewrap (Linux) restrict resource access while sharing the host kernel. 2. Userspace kernel isolation → gVisor intercepts system calls, adding isolation between the agent and host kernel. 3. MicroVMs → Firecracker and Cloud Hypervisor provide a separate guest kernel for stronger isolation, making them the closest to traditional virtual machines. You don't need to sandbox your entire agent. The harness is kept local. So you execute: • Bash • Read • Write • Edit ... inside the same sandbox. This ensures every tool operates on the same file system, so the agent can read, modify, and execute its own files. In Decode, I built one executor interface supporting local execution, Docker, and remote Modal sandboxes. Each agent session can have its own isolated environment. I explain the architecture and implementation in a recent video for Decoding AI Magazine: youtube.com/watch?v=7CHMb8jW…

try this if you mix in fl studio. i built a personal sound engineer for it: an open-source mcp that works alongside you in your project. copy this into claude once it's connected: "scan my mix and tell me what's wrong. show the evidence for each problem and wait for my ok before changing anything." mix doctor reports clipping, low headroom, level imbalance, missing high-pass and overlapping eq boosts. you stay the producer: every fix is shown first, applied one at a time, and can be rolled back. it also writes in ragas and maqam, not just western scales.

Yes, well said. I checked the traces. the 37 were failed scheduled executions, not failed tool calls. 34 never started an agent turn. Most were missing dependencies: 30 ruamel.yaml and 4 dotenv. The rest were 2 provider insufficient-balance errors and 1 stale Git path. So the first fix is environmental reliability, not tool arguments or planning logic.

[🛠️ Day 12/30] Overhauling My AI Development Harness: Found A Snake Hiding Inside My Pipeline Yesterday, I caught my orchestrator agent silently rewriting prompt instructions before passing them to the reviewer. I was playing with evals and wanted to make sure that changes to project-specific guidelines are in fact necessary. TDD taught me to make a test fail first. So I ran the evals without the new guidelines first, expecting them to fail. To my surprise, the reviewer caught one of the test cases even without the changes. But I only add cases the reviewer missed. So why did it miss this one before? Turns out that the bug was in the pipeline I’d built a few months ago. I, of course, asked Claude to do it and it generated a skill prompt with steps like this: … Step 4: Test strategy — subagent Read test-reviewer.md, fill {FEATURE_DESCRIPTION}, {SOURCE_FILES}, {TEST_FILES}, {WORKTREE}, {PROFILE}, dispatch a general-purpose agent. … So the main agent read the template and wrote a prompt for the reviewer itself. According to session logs it heavily reworded the template, omitting certain sections and even adding its own rules, and that made the reviewer skip important checks. I ran my eval suite against those reworded prompts and confirmed it was the issue. The fix was obvious: make the subagents read their own instructions. The pipeline looked perfectly reasonable. That’s the problem with AI-generated pipelines: they look good until you look closer. I almost fixed the wrong thing. But a green test you didn’t earn is a red flag. Old TDD habits still pay off. Every time I see someone sharing a new shiny skill or a prompt to produce 1000 PRs a second I can’t help wondering how many snakes there are hiding in that slop. How many of those authors even think of building eval suites?

I wasted a PR-agent run on requests that failed before any tool call: our gateway rejected ToolSearch. I’d retry without it, but a successful request doesn’t mean the agent can find the MCP tools it needs. What gateway error triggers your retry?

Give each built-in RenX agent the MCP tools it needs. In its desktop editor, open Advanced → MCP Servers. You can disable a discovered server for that agent without removing it from your setup. renx.openmercury.com/docs/gu…

At 1:20 a.m. on October 13, one of my project folders held 395 files at its top level, 118 of them superseded versions. I never delete anything, so every version was safe. I still could not find the current one. At 1:24 my agent finished moving 417 items into one archive folder. The visible top level now holds the 2 files my routines read, the archive, and one folder with only the latest version of each deliverable. A script with no model keeps that folder current: file patterns, newest non-superseded match wins, run after every agent session. It covers 21 of my folders now. Keeping every version and finding the right one are separate problems.

Control delegation for each RenX MCP connection. In Settings → Devices → Permissions, turn off General permissions, Work and payment permissions or Wallet setup independently. Reading, messaging and manual approvals stay available. renx.openmercury.com/docs/gu…

A reporting workflow may later be asked to change live records. That needs a fresh scope decision. ComplianceX’s published process allows RenX to review material contract changes, request evidence and pause the relevant step. An earlier approval doesn’t automatically cover another service, participant or payment. ComplianceX is deal-specific platform support, with availability depending on the transaction. It doesn’t guarantee legality or replace independent professional advice. openmercury.com/products/com…

Persistent learning needs a scope as well as storage. For a commissioned support agent, a one-off refund exception belongs with that customer’s case. It shouldn’t quietly become the refund rule for every future job. Agree what can enter shared instructions.