sandboxed.sh

Least privilege: README recommends enabling privileged: true for Docker container workspaces, which substantially abandons container isolation — heavy deduction despite systemd-nspawn design. User confirmation: missions can open PRs, SSH into home GPUs, and run unattended for days with no visible mandatory human-confirmation gate. Data flow transparency: architecture diagram and control-plane doc give a fairly clear project/mission/receipt/evidence model (2). Sensitive data: Cargo.toml shows AES-GCM/PBKDF2 and README emphasizes local inference and isolation, but the crypto implementation is not visible in the sample (2). Dependency security: conventional version ranges, no lockfile/audit strategy evidence (2). External effects: large blast radius (PRs, SSH) partially mitigated by the autonomy-grant concept. Rollback: only a zip backup/restore dependency hints at recovery; no explicit rollback flow (1). Source attribution: 'sandboxed.sh Contributors', unverified publisher, though the upstream fork relationship is documented via FORK.md (1).

Self-consistency: README and Cargo.toml align (v1.3.0, MCP binaries, Hermes coordinator), no contradictions (2). Dependency availability: mainstream maintained deps, but rust-version 1.91 conflicts with the in-file MSRV 1.75 comment (deduction). Failure messages: tests rely on waitForTimeout and broad catch-and-ignore; no evidence of structured error messaging documentation (1).

Audience and scenarios: self-hosted dev automation scenarios (hand off dev cycles, GPU training, local data analysis) are concrete (2). Capability boundaries: clear coordinator/sandbox split and rules for when to dispatch missions vs. in-conversation subagents (2). Trigger precision: controller cron triggering is described only conceptually, no config examples in sample (1). Environment fit: dual Docker/native paths with Xvfb/X11 desktop automation notes (2).

Information architecture: excellent README organization with a full docs index (3). Install notes: dual install guides exist, but the ordering that defaults Docker to non-privileged while recommending uncommenting privileged is a worrying footgun. Naming stability: renamed from 'Open Agent'; residual naming risk (1). Examples/FAQ: no FAQ; examples limited to install commands (1). Known limitations: 'Work in Progress' stated (2). License: README declares MIT but no LICENSE file appears in the sample and metadata is 'unknown' (2). Versioning/changelog: version 1.3.0 present, no CHANGELOG; release notes auto-generated (1). Maintenance responsibility: 'active development' without named maintainers or update path (1).

Output usability: structured receipts/evidence and SSE streaming with consistent roster across web/desktop/iOS (2). Marginal value: genuine differentiation combining multi-runtime sandboxed orchestration with a project control plane, but ecosystem coupling to a self-maintained Hermes fork (deduction, 2). Cost-benefit: deployment cost (privileged Docker, Ubuntu 24.04) vs. autonomy benefit is unquantified; only setup-time estimates given (1).

Claim traceability: README claims (isolation, encryption, health-check routing) cite docs not verifiable in the provided sample (1). Cross-source corroboration: CI workflows and dashboard tests partially corroborate README features, but core security claims cannot be cross-verified from these files (1). Fact/inference separation: vision section is clearly framed as aspiration; 'Work in Progress' is distinct from the feature list (2).