Phase 3: lifecycle & isolation — reap agents, harden docker, honest permissions (#79, #85, #87, #86, #88)

[joctaTorres]

Phase 3 of 4 — stacked on Phase 2. Top of the stack — the verified-green tree (phase proof-of-work passed here).

• runtime: teardown never reaps the agent — nohup'd agents survive timeouts, docker containers and remote agents orphan, sentinel files litter the repo #79 — deterministic process-group reaping across all three runtimes; sentinels relocated + swept; realSpawner timeout.
• rex: the docker locus is a weak sandbox — rw full-repo mount as root, unrestricted network, no resource limits #85 — docker locus runs as host uid with memory/pids/cpus/network knobs (new flat settings); documented isolation contract.
• rex: a repo-committed batch.yaml can silently escalate to full-autonomy (--dangerously-skip-permissions) with no confirmation #87 — manifest scope may only narrow permissions (no silent full-autonomy escalation).
• rex: the default posture misleads — 'local' locus has no isolation, 'repo-sandboxed-permissive' names a sandbox that isn't there, doctor never pushes toward one #86 — local agent env allowlist-scoped (no host-secret leak).
• rex: permission mapping honesty — cursor postures are a silent no-op, codex/cursor flags never verified, deny patterns presented as a boundary they aren't #88 — batch config/view render real per-locus isolation + per-agent enforcement; doctor nudges docker.

Closes #79
Closes #85
Closes #87
Closes #86
Closes #88

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	ratchet	7eaa86a	Commit Preview URL Branch Preview URL	Jul 09 2026, 10:26 PM