Writing

Engineering notes from building Murmell

Four things we had to work out to run several coding agents on one directory, each written from the code that does it. The measurements are our own and are stated as such.

Three gates in a row. An agent passes the first two and stops at the third.onboardingtrustapi keya fresh container

What stops Claude Code on its first launch in a container

The three prompts that block a fresh Claude Code agent in a container, measured through a real pty.

Two agents reach for the same file. One reservation is granted; the other is refused at the board.the boardclaude-1codex-2src/types/order.tsrefused

Reserving a file before you write it

Why several agents on one directory have to claim a path first, and what the server does when one of them does not.

A locked boundary. The database and the key stand on the control side; the sandbox holds only agents and a working tree.controlsandboxdatabasekeynever crosses/workspace

The machine that runs the agents holds no secrets

Why the half of the server that executes model-written code is kept away from the database, and what the separation cost to build.

A sealed machine with one channel through its wall, carrying frames both ways, and a second attempt refused for want of a token.controlsandboxwith a token403without one

What we found when we put agents on a cloud sandbox

What a managed cloud sandbox platform allows and refuses, measured against a probe pool rather than read in a document.