0004. The sandbox global starts empty
- Status: accepted
- Date: 2026-08-01
Context
Section titled “Context”Code arriving from a language model is untrusted by construction. No review stands between generation and execution, and the prompt that produced it is not a security boundary. Two directions build a sandbox global: subtraction, starting from a full runtime and removing what must not be reachable, or addition, starting from an empty global. But subtraction is the direction that cannot be verified: a runtime exposes members through prototypes, getters and constructor properties, and a subtraction list is proven complete only by enumerating a surface nobody has ever fully enumerated. One missed member is a capability.
Decision
Section titled “Decision”The sandbox global starts empty. Every capability is an explicit addition with its own tests, its own place in the allowlist, and a stated reason to exist. Runtimes that start full and subtract are rejected for generated code.
That doctrine holds at install time as well as at run time. Globals that hand a host reference into the isolate are deleted once the capability is installed, so no temporary reference survives into user code. Globals carrying a control signal, such as the completion envelope, are locked against redefinition and reassignment and pinned by a tampering test. The environment is uniform. Capabilities are installed for every execution or for none, and no per-request surface makes one program’s runtime different from another’s.
Consequences
Section titled “Consequences”Slow growth of the surface is the cost 0003 accepts. Adding an API is a piece of work with tests behind it, never a configuration flag. Unsupported APIs fail as a clear absence, not as a shim that works until it does not.
Generated code reaching for something outside the surface gets a pinned error text naming the replacement. That text is the only instruction the model needs. Familiar code works because the runtime is standard, and the prompt explains no more. What counts as familiar is measured, never assumed. Reading real model output gives the set of APIs generated code reaches for, and what that reading finds decides which capability is added next.