The agent's code runs in a sandbox with one tool and one logged door; every effect is checked, executed and logged, and the log replays bit-exact; the door opens onto everything the local server trusts.

It is the architecture behind "an agent you can audit", and its honest limit.

The agent's code runs in a glass box. Python, compiled to run inside a sandbox. No sockets. No filesystem. A virtual clock. A budget of steps.

The model has one tool. It writes code. Changing ten documents is one cell, not ten calls.

The only way out of the box is a named effect. A query. A model call. A web request. Each one is checked, executed, and written to a log.

That log replays a run bit-exact. Why did bao do that? Replay it and watch.

The box confines the code. It does not shrink the door. The door opens onto the local server, and the server trusts every process on your machine.

Check yourself. What is the only way code in the box can reach the outside?