[HackTuah]

A run_lua tool and skill-owned scripts run Lua inside this process: no operating system process, no filesystem handle, no socket. A model asked to total a column produces a number that looks right; a script produces one that is right and leaves the script in the transcript for anyone to check.

The limits are the VM's, not a promise

Limit	Enforced by	Binds?
Wall clock	monitor + timeout	Yes
Heap	max_heap_size with kill: true, set by the runner on itself	Yes, the VM kills it
Concurrency	max_children on the runners' supervisor	Yes, refused by name
Reductions	reported as a statistic	No — see below

One limit is reported rather than claimed, and the measurement is published. luerl_sandbox enforces max_reductions by polling with a 100 ms sleep between checks:

cap=1000     -> reductions=21721012 in 101ms
cap=1000000  -> reductions=34373451 in 101ms

A cap of a thousand and a cap of a million behave identically because neither is ever binding. So reductions are a statistic here and the bound that stops a runaway script is time. AC1 is restated rather than met as written — asserting a small reduction bound would be asserting something false.

No second door

trinity.tool calls Trinity.Effects.Runner.execute/3, the executor a model's own call uses, so it is decided by the same gate and leaves the same receipts. A test asserts a denied call gives the script nothing, because that is exactly what would make Lua a second door.

A call needing a person fails immediately rather than holding the sandbox open — asserted with stats.time_ms < 1_500 against a 2,000 ms budget. A run is bounded in seconds and a person is not; letting a script block would turn every approval into a timeout.

Three corrections to this slice's own spec, all from measuring first

• luerl_sandbox is not a package. It is a module inside luerl, so this adds one dependency, not two.
• lua_entry already existed, carried by the skills parser since slice 040.
• AC1's reduction bound is not one this library delivers, as above.

Two tests that would have proved nothing

• The path-traversal test re-implemented the check and asserted against its own copy. script_path/2 is public now and the test calls the real function.
• It expected /etc/passwd to be refused. It isn't: Path.join drops the leading slash and neutralises it into the skill's directory. The test asserts the true safe behaviour, because a test stating the wrong safe behaviour goes red the day someone makes the code stricter.

One thing I got wrong and undid

mix sobelow --mark-skip-all marked eighty-odd findings across the whole codebase, widening a suppression from 5 entries to 85. Restored from a copy and only this slice's one fingerprint added, with its reason. Sobelow reports exactly one finding in this tree, which is the only reason the damage was visible in a diff.

Verification

mix gate
Result: 794 passed (14 properties, 780 tests), 18 excluded
trinity.coverage: 014 80.31% vs 004 80.31%: OK

README, CHANGELOG, docs/sandbox.md and the effect catalogue are updated. AC7 (a recording of the agent writing Lua) and AC8 (a person reading the threat model) remain manual.

🤖 Generated with Claude Code