Build1 publisher2 min readPublished
A proposed planner commits a sandbox write only when the receipt epoch matches the live lease
A dev.to architecture review would let a planner commit a mutating tool step only after a write receipt joins a live sandbox epoch. The author is explicit that the fixture is a proposed simulator, not an executed test.
The Engineer · Build desk
What happened
- The review's counterexample runs in order: the planner sends apply_patch, the sandbox answers 200, the replica is reclaimed, and the retry lands on cold disk with the file gone.
- Its invariant blocks the commit of a mutating tool step until a write receipt joins a live sandbox epoch, and requires the system to reject or compensate once that epoch has moved.
- The commit bit depends on a join of receipt and epoch, and the design bars every other signal, including a 200 with an empty body, from moving the saga forward.
- The author marks the late 200 as the violating event, and says a common implementation stores success on it without ever consulting the lease.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- constraint The join is computable only where the runtime hands back the generation it accepted the write under. A sandbox API that returns a status and a body leaves the planner nothing to compare.
- decision Retry policy moves out of the prompt and into the tool layer. A replay has to acquire a fresh epoch before it runs, or it lands on a generation that cannot see it.
- exposure Teams that score agent runs on model quality absorb this failure as flakiness, and the debugging effort goes to the layer that did not cause it.
- cost Only write paths pay the overhead. Leases, heartbeats and compensation code attach to write_file, apply_patch and run_migration, and read-only tools keep the cheap path.
A 200 describes a message. The review declines to let it describe a disk, and the rest of the design follows from that. The sandbox here is a remote workspace that may be preempted between any two messages, and writes on the replica are visible only while the epoch that accepted them is still live.
The epoch lease is a monotonic integer owned by the current sandbox generation, kept live by heartbeats. The planner log is append-only, and a step is pending, fenced, committed or compensated. In the traced case the generation moves from 7 to 8 while the call is in flight, so the receipt the planner joins is exactly one generation stale.
Two conditions have to hold before any of this is buildable. The runtime must publish the generation under which it accepted the write, and preemption must move that number. The review does not say how to get an epoch out of a runtime that publishes none.
The rest of the adoption cost is structural. Only the planner may commit saga state, and every mutating step needs a compensation path, because reject-or-compensate is the specified answer to a moved epoch. Duplicate delivery is assumed after a timeout, an ack loss or a reconnect. "Replay without a new fence is how you mint a second write," the author wrote.
A retry that does not carry the new epoch will either no-op on a dead generation or double-apply on a live one. The author puts the check below the tool call rather than in the loop that drives it: "The fence has to sit under the tool, not inside the prompt."
The review also separates this from model quality, calling it a protocol question. "If your eval harness treats a vanished sandbox as a flaky model, you will debug the wrong layer," the author wrote. The four domains in the design are split because they fail independently, and the collision the author cares about is replica preemption plus a late 200: commit there and the saga has advanced past a write the next replica cannot see.
None of this has been measured. The fixture is described as a proposed simulator, and the piece disclaims being a production war story or a benchmark. The assumptions rule out dedicated hardware, reserved capacity and a measured SLA. The author's sequencing puts a local simulator first, with remote wiring after the properties pass, and says the review is heavier than you need if your sandbox is a reserved VM with a disk you control.
What to watch
- Whether the author publishes results from the local simulator, including which properties the join actually passes.
- Whether sandbox providers start returning a generation identifier alongside tool output, since the join is undefined without one.
- Whether the four independently failing domains get named and tested separately in a follow-up.