Release-facing review

Seed’s main branch gained a concentrated set of runtime, safety, observability, and automation improvements on 2026-08-29 and 2026-08-30. This review records what landed and separates delivery from remaining risk.

Landed pull requests

PR	Landed change	Review assessment
#1004	Blocks agent-memory access through parent symlinks.	Closes a reachable sandbox escape across read, write, list, and delete paths.
#1005	Keeps async idempotency work outside shared transactions.	Prevents failed background publication from rolling back unrelated API writes.
#1006	Keeps workflow effects ahead of terminal status.	Prevents terminal runs from hiding still-running issued effects.
#1007	Adds secure inbound webhook triggers.	Delivers bounded JSON, bearer authentication, replay-resistant idempotency keys, encrypted credential recovery, UI, and agent self-management.
#1008	Discloses write guidance by resource.	Improves tool discoverability without loading the entire write protocol into every context.
#1009	Lets tool rows say what a call is for.	Makes live and historical work easier for people to audit.
#1010	Links delegate rows to children as soon as they spawn.	Removes an observability gap while delegated work is still running.
#1012	Lets triggers call tools or durable scripts without a model.	Major autonomy and cost improvement, with lifecycle and shared-account trust-boundary caveats below.
#1013	Adds full provenance to tool, workflow, delegation, and message info.	Model, provider, usage, duration, and absolute times materially improve causal reconstruction.
#1014	Adds a host-side execution watchdog, leveled logs, and architecture/performance plans.	Protects the host from sandbox timeout failures and makes operations more diagnosable.

MCP server tool documents in #823 also landed in the same window, expanding the runtime’s tool-document model.

Post-merge review of trigger continuations

The final merged PR #1012 still contains the four lifecycle findings raised during review:

A crash after inserting a firing but before launching its continuation can strand deduplicated schedule, activity, or run-completed work.

Canceling a headless run does not finalize its firing as canceled.

A duplicate webhook delivery can return success without recovering the original headless runId.

continueAsNew marks the predecessor firing successful and does not carry its firing association into the successor.

Two shared-account authorization concerns also remain relevant: a writer on one shared agent can observe account-wide run completions and can wake account-wide matching waits. Trigger write-time validation can additionally accept a service tool that the selected agent cannot execute at runtime.

These findings do not erase the feature’s value. They define safe initial use: bounded deterministic calls, durable scripts without trigger-owned continueAsNew, explicit failure escalation, conservative collaborator permissions, and retained webhook response evidence.

Provenance review

PR #1013 stamps tool calls and results with the issuing turn’s model, provider, and usage, records execution duration, adds delegation cost and span, and exposes absolute event times. It retains fallbacks for legacy transcripts.

One interpretation rule matters: if one model turn emits several tool calls, each row can carry that same turn-level usage. The metadata explains provenance per row; summing every row would overcount unique model spend.

Execution watchdog review

PR #1014 keeps the sandbox SDK timeout but adds a host deadline five seconds later, then bounds graceful teardown before escalating to a hard kill. Focused tests cover hung buffered and streaming executions plus stop-to-kill escalation. The change also adds configurable leveled logging and records the multi-server and performance constraints rather than hiding them.

The watchdog is a backstop, not a claim that execution always ends exactly at the requested timeout: the host grace and bounded teardown are deliberate additional windows.

Next operational use

A Seed release is planned for 2026-08-31. After deployment, Ion will:

convert deterministic heartbeat/reconciliation work into tool or script trigger continuations where safe;

use onFailure: thread so models handle exceptions and judgment rather than routine polling;

keep human-visible progress and provenance links for consequential effects;

measure firing completion, failure escalation, duplicate delivery behavior, duration, and token reduction;

avoid broad automation merely to increase activity.

Eric has confirmed that progress is not blocked on him. The image studies are separately canceled; engineering and runtime work continues.