Fail Closed on Side Effects: A Blast-Radius Gate for Agent Patches

An agent patch can pass all unit tests but still write outside the designated workspace, call an undeclared tool, or read an environment key that was not specified. Prioritize containing the blast radius before assessing the prose. This article is a proposed method, not a field report. It introduces a fail-closed boundary around file systems, tools, environment keys, and network hosts.

Side-effect violations are not halted; they only freeze if there is a disagreement between two runners regarding a property outside the envelope, and even then, only if a hashed evidence bundle confirms the violation. The key takeaway is to treat an agent patch as a capability change. If the run touches anything not listed in the declared envelope, the gate fails closed.

Factors like ranking inconsistencies, wording variations, or latency differences do not affect this rule. Merely generating code quickly does not make side effects inexpensive to reverse. A green test suite without monitoring /tmp, os.environ, or outbound sockets is not a verification result; it is a missing observer. This gate is not a golden-file of model text, a mutation score, or a full-suite rerun after every modification.

It only answers four questions: Did the run write or delete outside of allowed roots? Did it invoke a tool name not on the allowlist? Did it read an environment key not on the allowlist? Did it open a network host not on the allowlist? If any answer is affirmative, the gate fails. Do not freeze or retry for luck. The artifact consists of a locked envelope and an observer log.

Pin the envelope as a fixture and hash it. Refute the run if the hash changes without a review note. The envelope ID is 'agent-patch-envelope-v3'. It allows access to '/work/repo' and '/tmp/agent-scratch' directories, the tools 'read_file', 'apply_patch', and 'run_tests', environment keys 'CI', 'RUN_ID', and 'ENVELOPE_HASH', and denies network access.

The SHA256 hash of the envelope.json file is recorded in 'envelope.json.sha256'. The CI process must compare this digest before initiating the agent process. Label the subsequent block as a proposed harness, not a production sandbox. User-space tracing may overlook kernel-level tricks; use it as a preliminary tripwire, then implement a full jail when the threat model demands one.