Isolation by default for cloud agents

What it does

An agent sandboxed in the cloud has no reach into the user's credentials, SSH agent or home directory, so the blast radius of a poisoned prompt or a bad tool call is only what the user sent it.

Source

Outside beads: the README's Design section (README.md:23-27).

File and line references in this issue are to main as of 75a7a92.

Against the three criteria

• Direction (README): This is the README's direction (README.md:23-27).
• Today's terminal users: Isolation today is the permission engine's rules plus each backend's own sandbox floor (D560); the README's note says teammates run "with the reach that implies" (README.md:31-34).
• Evidence: Nothing of it is built (README.md:31-34).

Depends on

Blocked by #63. The captain recorded isolation as resting on the cloud execution environment of that idea; it is not split off as a local sandbox that could go first.

Verdict

• Verdict: do
• Size: XL — rests on a new execution environment.
• Exception to the probe rule: no.
• Date: 2026-09-19
• Verdict ticket: #48

Theme: #51

Start with the README Design section at README.md:23-34 and review the cloud execution environment described by blocked issue #63. Define what isolation by default means for the cloud agent and verify that the resulting environment cannot reach user credentials, the SSH agent, or the home directory.