MECHANISM · SAFETY · CORE

Network Boundary

Constrain outbound destinations, protocols, resolution, redirects, and credential flow independently from whether a tool is semantically approved.

1 lessons0 agent snapshots1 experiments

safetynetwork-boundaryproblem → policy → evidence

L0Intuitioncomplete

L1Buildcomplete

L2Engineeringpartial

L3Architecturepartial

L4Researchmissing

DEPENDENCY GRAPH · READER PATH

What feeds it, and what does it unlock?

Arrows show learning and design dependencies, not runtime data flow. Follow any node to continue through the Atlas.

Prerequisites

execution-policyExecution Policy os-sandboxOperating-System Sandbox

network-boundaryNetwork BoundaryCurrent research boundary

UnlocksNo dependents yet

Bilingual deep dive missing

Constrain outbound destinations, protocols, resolution, redirects, and credential flow independently from whether a tool is semantically approved.

The structured record is in the Atlas, but the L0–L4 article has not passed content review.

AGENT MAPPING · EVIDENCE ONLY

Snapshot implementations

An implementation enters the map only when both a snapshot and claims exist; unknowns remain visible.

UNKNOWN · EVIDENCE GAPClaude Code

No implementation currently clears the Snapshot + Claim threshold; this is not a claim that the product lacks the capability.

Inspect coverage boundary →

UNKNOWN · EVIDENCE GAPCodex

No implementation currently clears the Snapshot + Claim threshold; this is not a claim that the product lacks the capability.

Inspect coverage boundary →

UNKNOWN · EVIDENCE GAPGrok Build

No implementation currently clears the Snapshot + Claim threshold; this is not a claim that the product lacks the capability.

Inspect coverage boundary →

UNKNOWN · EVIDENCE GAPOpenCode

No implementation currently clears the Snapshot + Claim threshold; this is not a claim that the product lacks the capability.

Inspect coverage boundary →

UNKNOWN · EVIDENCE GAPPi

No implementation currently clears the Snapshot + Claim threshold; this is not a claim that the product lacks the capability.

Inspect coverage boundary →

UNKNOWN · EVIDENCE GAPReasonix

No implementation currently clears the Snapshot + Claim threshold; this is not a claim that the product lacks the capability.

Inspect coverage boundary →

UNKNOWN · EVIDENCE GAPReference Harness

No implementation currently clears the Snapshot + Claim threshold; this is not a claim that the product lacks the capability.

Inspect coverage boundary →

No reviewed Agent claims

The teaching-harness reference does not automatically become an architectural claim about any vendor agent.

EXPERIMENTS · EXERCISES

What has actually been tested?

Formal experiments are separate from course exercises. Exercises can validate the reference implementation but cannot replace Native evidence from a real agent.

controlled · completeReference Harness sandbox and network policy probeCan the Reference Harness record a destination-scoped network decision while guaranteeing that the teaching backend performs no real network effect?

s11-sandbox-networkobserve

Verify the two-layer safety chain

sandbox.configure and an exact network decision still appear after approval allows the tool.

python3 -m curriculum.golden verify s11-sandbox-network

s11-sandbox-networkmodify

Challenge the network allowlist

An unlisted host is denied before the backend runs and the simulator call count does not increase.

python3 -m unittest curriculum.tests.test_vertical_slice.VerticalSliceTests.test_s11_denies_unlisted_network_before_backend_execution -v

OPEN QUESTIONS · L4

01

Should policy bind hostnames before or after DNS resolution and redirect handling?

02

How can a harness expose proxied, tunneled, and child-process traffic in one trace?

03

Which credential scopes remain safe when one destination is allowed?