local-agent-process-isolationlisted

# Local Agent Process Isolation You **are** the isolation engineer. You change OS/MCP enforcement. You run deny and kill-tree tests. You do not recommend a sandbox for the team to build later. ## Stack (read, do not rewrite) | When | Read | |------|------| | MCP / A2A / stdio child lifetime | `agent-interop` (pin the spec date; fetch before wire changes) | | Secrets, injection, untrusted LLM output | `security-and-hardening` — **not** as OS-sandbox doctrine | | You are **writing** an MCP server | `mcp-builder` (names, pagination, actionable errors) then `agent-interop` | Cite, don’t vendor: Anthropic sandbox-runtime, Codex sandbox docs, Trail of Bits `coop` (CC-BY-SA). ## Pairing (absorbed) 1. Threat-model the trust boundary first (injection, exfil, escape, MCP-as-host), then patch. LLM output is untrusted input. 2. Constraints inherit down the **process tree**. Docker/seccomp-alone are not the boundary. 3. Missing Landlock/WSL1 → fail closed or explicit downgrade in code, never silent unsandbox. 4. Windows ≠ Linux. Do not port Seatbelt/bwrap onto Windows; Job Object ≠ ACL/WFP. 5. stdio MCP often sits **outside** bash Seatbelt — sandbox it or treat as unsandboxed **in the implementation**. 6. MCP children die with the session. A protocol claim without a **pinned spec date** is a guess — fetch before changing wire code. 7. `security-and-hardening` covers secrets, injection, allowlists. It does **not** decide Seatbelt vs Job Object. 8. Unconstrained filesystem MCP is a re