Sandboxed execution
Agent execution and file mutations run inside a sandbox. Under the fail-closed policy, every file mutation either lands inside the realm or fails closed. The default advisory mode warns and allows host write and edit calls while disconnected, so containment requires opting into fail-closed.