BROKER LANE SANDBOX / EVIDENCE CARD
Public source-first case

Default-deny execution for agent lanes.

Broker Lane Sandbox keeps orchestration separate from the act of running a subprocess or local model. It validates policy before spawn, starts the child with a scrubbed environment, applies resource limits and returns structured JSON or JSONL evidence.

Inspect the public source

Execution contract

Policy before process

broker or operator request
-> validate non-empty argv
-> require allow_exec
-> require a bare command name
-> require command allow-list membership
-> validate working directory
-> construct child environment from empty
-> apply timeout and optional POSIX resource limits
-> execute in a separate process group
-> return ExecResult JSON

Optional local-model path:
manifest + existing weight file + size and sha256 verification
-> offline local runner
-> buffered JSON or additive JSONL streaming
Default denyNo process starts unless policy explicitly allows execution and the bare command name.
Credential boundaryThe child environment begins empty. Secret-shaped variable names are dropped unless explicitly permitted.
Model-artifact boundaryModel weights remain outside Git. Only manifests, URLs, checksums and licence notes are tracked.
Source-first evidence

Why this is a card, not a simulated product

SurfaceEvidenceLimit
Safe execution corePublic Python source, policy schema, CLI, threat model and adversarial-review historyNot a kernel or container isolation boundary
Environment and network postureEmpty child environment, allow-listing, secret-name filtering, proxy removal and offline signallingNetwork isolation is best-effort environment-level neutralisation
Resource controlsWall-clock timeout, process-group cleanup and optional POSIX rlimitsFilesystem access is not jailed and command identity is not hash-pinned
Local inferencebls infer, llama.cpp-family runners, fake runner for CI and additive JSONL streamingWeights are operator-fetched; Ollama and Transformers remain deferred
VerificationREADME receipt records 286 passing tests at implementation head 19091b1; current head contains later documentation cleanupNo test rerun was performed for this static evidence card

Source-first rule: the public repository is the canonical proof. This page only provides recruiter orientation and direct links; it does not replace the README, manual, threat model, CI or test source.

Honest security posture: this is a bounded process guardrail for a trusted caller, not a hostile multi-tenant sandbox. The source explicitly documents the missing filesystem jail, best-effort network posture and unpinned executable identity.