Coder/deepseek-harness
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(notes): update the sandbox note's per-session formula to the header-baseline chain

Browse Source 
Review fix (ds-review-bot on #623): the per-session-modes section still
described first-turn stamping — superseded by the header baseline — and its
formula lacked the middle rung. The formula now reads own post-seed knob
events ?? inherited SessionHeader baseline ?? composition default, and the
paragraph describes the synchronous capture into the creation-time header
with no first-turn timing window. Chinese counterpart updated in the same
commit.
This commit is contained in:
kingwl
2026-07-27 15:30:39 +08:00
parent 2f59db73be
commit 8c106017d9
3 changed files with 11 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
.agents/notes/implemented/feature/2026-07-06-sandbox.i18n.yaml
View File

@@ -1,6 +1,6 @@
# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
# side as of the last confirmed-consistent state. Both languages carry equal authority;
# after editing either side, bring the other along and re-record with:
# pnpm run verify-translation-pairing --write
2026-07-06-sandbox.md: 4409b6a32809c8ff7a02c0684f449143c0891caa
2026-07-06-sandbox.zh.md: 7e5564f17ab791662f5a40ed625b937725293333
# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-06-sandbox.md
2026-07-06-sandbox.md: cd36ae62b60fd61d55d63469ad50234363dbcf86
2026-07-06-sandbox.zh.md: 3930c654d0970c294e135d2e5ec9d530249a902d

6
.agents/notes/implemented/feature/2026-07-06-sandbox.md
View File

@@ -89,10 +89,12 @@ Left open: what a durable grant's scope identity is beyond the sandbox mode —
#### Per-session modes: the session log as the store
```
effective(session) = findLast(the session's own knob events)?.value ?? the composition-config default
effective(session) = findLast(the session's OWN post-seed knob events)?.value
?? the inherited SessionHeader baseline
?? the composition-config default
```
The default is composition config (`cordis.yml`) — operator-owned, process-wide. A runtime switch is a session-scoped override recorded as one log-only event in that session's own log. Restart immunity (resuming a session replays its log, so overrides come back with zero catch-up machinery) and multi-session isolation both fall out by construction, and no external config store exists anywhere. Isolation does not make delegation an escape hatch: the in-process subagent driver stamps a delegating parent's effective override onto each child session inside the child's first turn, so a tightened parent binds spawn children, fork children, and grandchildren ([the subagent policy-inheritance Agent Note](2026-07-25-subagent-policy-inheritance.md)).
The default is composition config (`cordis.yml`) — operator-owned, process-wide. A runtime switch is a session-scoped override recorded as one log-only event in that session's own log; the middle rung is the delegation baseline a subagent child's header carries. Restart immunity (resuming a session replays its log and restores its header, so overrides come back with zero catch-up machinery) and multi-session isolation both fall out by construction, and no external config store exists anywhere. Isolation does not make delegation an escape hatch: the in-process subagent driver captures a delegating parent's effective override synchronously at delegation and carries it into each child's creation-time `SessionHeader` (`sandboxMode`/`approvalPolicy`), so a tightened parent binds spawn children, fork children, and grandchildren with no first-turn timing window ([the subagent policy-inheritance Agent Note](2026-07-25-subagent-policy-inheritance.md)).
**One event per knob, owned by its domain** — the merge-extensible `SessionEventMap` idiom every existing event family already follows (`approval/*` in `dsh-user-approval`, `hook/*` in the hooks packages):

6
.agents/notes/implemented/feature/2026-07-06-sandbox.zh.md
View File

@@ -89,10 +89,12 @@ Landlock launcher 源码和包工作区位于 `native/landlock-run`，与 harnes
#### 按会话模式：会话日志即存储
```
effective(session) = findLast(the session's own knob events)?.value ?? the composition-config default
effective(session) = findLast(the session's OWN post-seed knob events)?.value
?? the inherited SessionHeader baseline
?? the composition-config default
```
默认值是组合配置（`cordis.yml`）——运维人员拥有，进程范围。运行时切换是会话范围的覆盖，记录为该会话自身日志中的一条仅日志事件。重启免疫（恢复会话时回放其日志，覆盖自然恢复，无需追赶机制）和多会话隔离都是构造性的自然结果，且不存在任何外部配置存储。隔离并不使委派成为逃生通道：进程内 subagent 驱动器会在子 agent 的首个轮次内，把发起委派的父级的有效覆盖盖章写入每个子会话，因此收紧后的父级会约束 spawn 子 agent、fork 子 agent 与孙代 agent（[subagent 策略继承 Agent Note](2026-07-25-subagent-policy-inheritance.md)）。
默认值是组合配置（`cordis.yml`）——运维人员拥有，进程范围。运行时切换是会话范围的覆盖，记录为该会话自身日志中的一条仅日志事件；中间层是 subagent 子 agent 的会话头所携带的委派基线。重启免疫（恢复会话时回放其日志并还原其会话头，覆盖自然恢复，无需追赶机制）和多会话隔离都是构造性的自然结果，且不存在任何外部配置存储。隔离并不使委派成为逃生通道：进程内 subagent 驱动器在委派时同步捕获发起委派的父级的有效覆盖，并将其带入每个子 agent 创建时的 `SessionHeader`（`sandboxMode`/`approvalPolicy`），因此收紧后的父级会约束 spawn 子 agent、fork 子 agent 与孙代 agent，且不存在任何第一轮次的时序窗口（[subagent 策略继承 Agent Note](2026-07-25-subagent-policy-inheritance.md)）。
**每个旋钮一种事件，由其领域拥有**——这是每个既有事件族已遵循的可合并扩展 `SessionEventMap` 惯用法（`dsh-user-approval` 中的 `approval/*`、hooks 包中的 `hook/*`）：