Writing

Engineering notes from building Murmell

Seven things we had to work out to run several coding agents on one directory, each written from the code that does it. The measurements are our own and are stated as such.

A browser, a control plane and a sandbox. Output flows right to left; the congestion that starts at the browser has to be felt at the sandbox.browsercontrolsandboxoutputoutputslowholdreceive window closesstop writing

Watching a terminal you do not host

What it takes to keep a browser attached to an agent running on somebody else’s machine, and the two things that break silently when it is done carelessly.

Three named people on one canvas, reached by a link. The preview is served through the session; a public address for it is refused.one linkaminaeditingmosseditingjonasviewinglive preview*.preview.murmell.comnever

What a link has to carry to share a live coding session

The three things a share link has to carry, and why the live preview behind it is the part that is easy to get dangerously wrong.

Above, a task leaves for an isolated environment and returns as a diff. Below, the agent works inside the shared tree and there is nothing to hand back.a task, delegatedits own environmenta diffthe same agent, insideone directory

Codex on your laptop, Codex in the cloud, and a third place

Why choosing between the Codex CLI and Codex cloud is a question about who is watching, not about how much compute you want.

Three gates in a row. An agent passes the first two and stops at the third.onboardingtrustapi keya fresh container

What stops Claude Code on its first launch in a container

The three prompts that block a fresh Claude Code agent in a container, measured through a real pty.

Two agents reach for the same file. One reservation is granted; the other is refused at the board.the boardclaude-1codex-2src/types/order.tsrefused

Reserving a file before you write it

Why several agents on one directory have to claim a path first, and what the server does when one of them does not.

A locked boundary. The database and the key stand on the control side; the sandbox holds only agents and a working tree.controlsandboxdatabasekeynever crosses/workspace

The machine that runs the agents holds no secrets

Why the half of the server that executes model-written code is kept away from the database, and what the separation cost to build.

A sealed machine with one channel through its wall, carrying frames both ways, and a second attempt refused for want of a token.controlsandboxwith a token403without one

What we found when we put agents on a cloud sandbox

What a managed cloud sandbox platform allows and refuses, measured against a probe pool rather than read in a document.