Post

The pause-for-approval hook is the interesting part here. Does it block the entire execution context until approval comes back, or does it serialize state and let the runtime tear down and resume later?

A paused agent can be safe and still wrong. The allowlist needs tests for intent, not only capability, because an approved function can produce a perfectly valid bad change.

Sandbox boundaries matter more than agent speed when the code is untrusted. The hard test is whether approved host functions remain narrow enough to audit as workflows grow.

The eval gap is the host function allowlist. A sandbox that can still call arbitrary fs or net is just Node with extra steps. The interesting contract is which capabilities come back after the human says yes.

Eval is a correctness question; run is a safety question, the sandbox answers only the second: an agent can safely execute the wrong action all day. The approval pause is the real control surface, but pauses stop being decisions once routine. What breaks it: an approved function with too much reach.