Sandbox separates policy from execution. The baseline production shape is one or more stateless controllers, PostgreSQL for durable state, and dedicated workers that never accept operator traffic directly. NATS is optional rather than a prerequisite for a working control plane.

The controller decides; the worker executes. sandboxd --role controller authenticates requests, validates specs, applies policy, runs AEGIS, records desired state, assigns leases, accepts results, emits lifecycle events, and reaps expired work. It does not hold a Docker socket or run tenant code.

The worker reports what it can safely do. sandboxd --role worker registers capacity and isolation capabilities, heartbeats resource availability, leases assignments, invokes one runtime adapter, bounds output, and reports a result. Its node ID is stable across restarts through its state directory.

The client surfaces stay thin. The sandbox CLI is a typed API client, while sandbox-mcp is a local stdio JSON-RPC bridge. Neither one owns the production policy; both request the same controller contract.

PostgreSQL is the source of truth. It records nodes, sandboxes, operations, and assignments. The in-memory store is for tests and single-process development, not high availability.

Events are useful but not authoritative. The in-memory bus needs no extra service; the optional NATS backend publishes lifecycle envelopes. A failed event publish is logged but does not roll back a state mutation, so consumers should always reconcile from the API.

Docker and microVM-grade isolation are different claims. The built-in Docker adapter uses a read-only root filesystem, dropped capabilities, no-new-privileges, CPU/RAM/PID limits, bounded tmpfs, and an explicit network. It is intended for dedicated worker hosts or trusted tenants.

An external runtime driver is the strong-boundary escape hatch. An operator can attach Firecracker, Kata Containers, gVisor, Cloud Hypervisor, Kubernetes, or a private runtime through the driver protocol without linking it into the control plane. Read security and isolation before selecting a runtime for hostile workloads.

Create, exec, tunnel updates, and delete are asynchronous operations. They move through pending, running, succeeded, or failed; a client must inspect the operation rather than infer remote completion from an HTTP response.

Assignment leases can expire and be delivered again. Create and delete should be idempotent; exec is at-least-once in v0.1. Healthy scheduling excludes draining, stale, overloaded, or incompatible workers before placement.

Use CLI lifecycle workflows to drive the contract and operations to recover from capacity or cleanup failures.