Skip to main content
Last updated on
Tags:
Options
Open in ChatGPTAsk ChatGPT about this pageOpen in ClaudeAsk Claude about this page

Console Evidence

The sandbox_execution span records the bounded result of one admitted sandbox dispatch.

1. Open the span​

  1. Open the agent and select the Verify tab. Pick the session in the selector, then switch the view to Tree.
  2. Select the governed session.
  3. Expand the sandbox_execution child span under the governed Activity.

For the Quick Start example, confirm these two facts first:

  • The Activity did not complete through its host path.
  • openbox.sandbox.disposition is executed_in_sandbox.

2. Check the evidence​

Evidence groupFields to check
DispatchThe native provider, profile post-batch, stable dispatch identity, and openbox.sandbox.disposition=executed_in_sandbox
Processopenbox.sandbox.exit_code, timeout status, cleanup status, and bounded stdout and stderr byte counts and hashes
Networkopenbox.sandbox.egress.count, and openbox.sandbox.egress.<n>.decision, openbox.sandbox.egress.<n>.host, and openbox.sandbox.egress.<n>.port for each request
Violationsopenbox.sandbox.violations.count and openbox.sandbox.violations.categories when macOS Seatbelt records denials

The span carries no typed result values. Core admits only the allowlisted openbox.sandbox.* attributes above. Typed values reach the bounded Activity result instead.

The network destination for the example is example.com:443.

The bounded Activity result contains these values:

  • The admitted profile
  • The disposition
  • The exit code
  • The timeout status
  • The cleanup status
  • The byte counts for standard output and standard error
  • The values accepted by an optional schema for typed results

Raw command output and credentials do not enter Workflow history.

Interpret the evidence​

Authorization and execution provide separate evidence:

  • The started-hook CONSTRAIN verdict explains why the integration replaced the host action.
  • The child sandbox_execution span records the bounded runtime outcome.
  • A completed-hook event records the execution after completion. It must not dispatch the command again.

The span is correlated operational evidence. It is not a portable signed execution receipt. It is not a kernel teardown attestation.

Treat the command as indeterminate when cleanup or terminal absence is uncertain. Reconcile the external state without another dispatch.