Submatter/plans/Plan-workspace-communications/Epic-agent-participation/Task-agent-builder-review-sandbox.md

kind	slug	title	plan_slug	epic_slug	status	priority	tenant_id	owner	cursor_todo_id	updated_at
task	agent-builder-review-sandbox	Review, test, and activate agent drafts	workspace-communications	agent-participation	ready	P1	global	unassigned	null	2026-10-22

Task summary

Add permission review, constrained sandbox testing, and explicit publish/activate flows for generated or manually edited agent drafts.

Description

Turn a private draft into a trusted workspace agent through a structured review of instructions, requested tools, context/channel access, model role, harness route, budget, and provenance. Sandbox runs default to read-only/non-mutating tools, bounded context, timeout, and cost limits. Members may test their drafts read-only; admin/owner approve shared publication and normal tool grants; only owner approves mutating sandbox policy or workspace-wide sensitive tools.

Subtasks

• Build normalized draft diff and permission review UI with validation warnings.
• Add bounded sandbox-run service/state with cancellation and auditable results.
• Wire review UI to canonical Task-agent-install-lifecycle.md publish/install/activate procedures and Task-agent-registry-api.md draft discard; do not duplicate lifecycle endpoints. Requested context access remains ungranted until separately authorized.
• Add tests for privilege escalation, mutating tool denial, budget enforcement, stale versions, and audit records.

Owner or assignee

unassigned

Status

ready

Estimation

M

Acceptance criteria

• Members can run read-only bounded tests for their own drafts but cannot publish, activate, or grant tools.
• admin/owner can approve workspace publication and ordinary allowlisted tools; only owner can approve mutating sandbox policy or sensitive workspace-wide grants.
• Every activation references an immutable reviewed version and records actor, diff, grants, budget, and test result.
• Invalid/stale drafts cannot be activated, and no test leaks provider credentials or bypasses tenant-scoped tools.
• pnpm lint && pnpm type-check && pnpm test pass.

Dependencies and access boundary

Task-agent-builder-editor-drafts.md, Task-agent-install-lifecycle.md, and the bounded execution contract in Task-agent-harness-chat-streaming.md. Review UI consumes canonical lifecycle APIs; sandbox context/tool reads also enforce actual context authority, never workspace role alone. Test data defaults to caller-supplied or explicitly authorized context, not arbitrary private project content.

Links to related Epic / Plan

• Epic: ./Epic-agent-participation.md
• Plan: ../Plan-workspace-communications.md