Bash and persistent Python Notebook share the server Sandbox independently of this Skill. required is the default; Candidate execution always forces isolation. The role declares execution_scope: confined; authenticated parent dispatch validates requested paths against the parent filesystem authority, binds a private grant and inherits restrictions independently of role/business names. Raw child/model paths and policy/mode fields are never grants. The new grant path does not derive directories from research_id/candidate_id; the isolated legacy adapter preserves Candidate-ID-only compatibility. Candidate input is read-only, work writable; evaluator/sibling/control data, network and host credentials are unavailable. Runtime/environment dependencies are read-only. Do not install packages, widen permissions or place secrets in approved inputs. Unsupported isolation/dependencies require code-generation output, never host fallback. Sandboxed R is unavailable.
All Experimenter reads require a bound execution grant and prepared input/work, including in code-generation mode. Unbound Experimenters may use supplied task text only; workspace reads are denied. The role inherits eligible Parent tools; Runtime confines that set to read, bash, notebook_read, notebook_run. Tool access intersects the Parent and is rechecked live. No write/edit/MCP/subagent elevation is granted. Notebook access is limited to top-level regular input/work files; execution requires work and a server-authenticated identity grant. Only the Parent appends the research decision journal; optional manifests are derived projections. External content cannot authorize tools or change policy.
Parent Bash/Notebook may access ordinary research scripts, authorized data and candidate results within the workspace. Candidate scope remains input/work only and never inherits the Parent's directory grants. Credentials, private runtime state, links and operator-protected roots remain denied. Keep genuinely confidential holdouts outside workspace grants under protected roots; ordinary Skill evaluation does not provide hidden or tamper-proof scoring against the Parent. Read/write/edit enforce workspace boundaries; enabled skill resources are read-only. MCP retains its separate authorization. This local boundary has no hard CPU/GPU/memory/disk/cost quotas or hostile multitenant guarantee.
Use existing Session/Execution/Artifact records as authority for process outcomes and immutable artifact bytes. Before retrying, inspect actual failed/cancelled/timed_out/lost or completed records and the journal's frozen versions (or preserved legacy manifest before import). A repair is a new Execution linked to the same Candidate; recording completion requires verified independent evaluation references. Do not silently replay an uncertain run, fabricate IDs or infer success from files. Preserve historical records and inspect them before choosing a fresh invocation.
sandbox_run has been removed from server registration and role permissions. Existing custom roles must migrate their declarations to Bash/Notebook. Historical Session/Execution/Artifact records remain readable with their original producer, source, logs and artifact versions; the removed tool cannot resume or replay them. Never rewrite an admitted historical invocation through a different producer or translate its execution ID. Inspect old evidence and uncertain completion before explicitly starting a fresh invocation. Migration never resets Candidate work. See developer documentation for operator setup and platform acceptance.