@dsh-enhanced/assistant-isolation

Configuration

stateRoot: /absolute/private/assistant-isolation
image: sha256:
dockerPath: /usr/bin/docker
maxConcurrentJobs: 2
maxReservedMemoryMiB: 2048
maxReservedWorkspaceInodes: 32768
grants:
  - id: offline-maintenance
    revision: 1
    principalDigest: 
    principalRecordId: 
    principalVersion: 1
    workspace: /absolute/canonical/project
    agentPreset: primary
    expiresAt: 
    maxRuns: 20
    maxTotalDurationMs: 1200000
limits:
  maxDurationMs: 60000
  maxInputBytes: 1048576
  maxOutputBytes: 65536
  maxArtifactBytes: 262144
  maxFiles: 32
  memoryMiB: 256
  workspaceMiB: 64
  workspaceInodes: 4096
  pidsLimit: 64
  cpus: 1

Replace the placeholders with the operator's current owner record and runtime configuration. isolationPrincipalDigest() is exported for trusted Host configuration tooling. Model arguments cannot supply an owner or create/extend a grant. Policy must allow execute on both tool:isolation_run and tool:isolation: for the exact scope. Matching finite-grant preauthorization can skip the redundant risk prompt; native Policy denials, call budgets and other guards remain in force (details below).

The workspace value identifies the authorized task; the project directory is not mounted. The tool accepts grant_id, idempotency_key, command, optional files: [{ path, content }], artifacts: [relativePath] and timeout_ms. Paths must be canonical relative paths. Inputs and requested artifacts have finite count/byte limits, including path text and staged parent inode counts. Inputs are copied into a fresh quota volume; no Host directory is mounted in either container. After the execution container is removed, a separate keeper container retains the volume while the trusted supervisor checks each artifact with absolute-path BusyBox commands. Only regular UTF-8 files without symlink parents or hard links can be exported within one total byte budget. The keeper and volume must then be removed before the result reports quiescence. Binary/invalid UTF-8 console data is omitted; decoded output never expands past the configured byte limit.

Within a configured workspace/preset, the model sees only the same named surface that the Host routing guard accepts: isolation_run, isolation_grants, goal_context, goal_checkpoint, and the fixed preauthorized goal or GitHub broker tools when installed. It does not see Host filesystem, shell, run_code, or subagent tools. This presentation applies only after the live Agent resolves to the current Delivery owner lineage and exact workspace/preset; ordinary or unbound Agents keep their normal tool surface. A scoped model-facing system section states that each isolation_run gets a fresh scratch workspace, accepts starting material only as inline files, and has no Host project mount or network. It contains no Host path, credential, task answer, or tool-call sequence. Revocation or expiry does not release the configured scope restriction while the bundle remains loaded. This is trusted Host routing around the OS-isolated worker; a trusted operator can change or remove the plugin configuration.