
== inputs ==
  preset    codex
  network   own namespace (no route off the machine)
  box_id    snapshot
  HOME(env) <HOME>
  chdir     <ROOT>

== egress backends (host half on a socket, in-box on loopback) ==
  openai-responses 127.0.0.1:8715 -> <TMP>/aisan-proxy-16a0eeb0791b6c92/openai-responses.sock

== tmpfs mounts (mounted before binds; intended writable scratch) ==
  [..] <TMP>  (2147483648)
  [..] <HOME>  (1073741824  <- $HOME)
  [..] <MAIN>/.git/worktrees  (no size)

== binds in argv order (later shadows earlier on overlap) ==
  system    /usr /bin /lib /lib64 /sbin /etc /proc /dev /run/systemd/journal/stdout
  [..] rw-root   <ROOT>
  [..] rw        <MAIN>/.git
  [..] ro-pin    <ROOT>/.git
  [..] ro-pin    <MAIN>/.git/config
  [..] ro-pin    <MAIN>/.git/config.worktree
  [..] ro-pin    <MAIN>/.git/objects/info/alternates
  [..] ro-pin    <MAIN>/.git/hooks
  [..] rw        <MAIN>/.git/worktrees/wt
  [..] ro-pin    <MAIN>/.git/worktrees/wt/commondir
  [..] ro-pin    <MAIN>/.git/worktrees/wt/config.worktree
  [..] ro-pin    <MAIN>/.git/objects/pack
  [..] rw        <STATE>
  <AISAN RUNTIME>
  [..] ro        <TMP>/aisan-proxy-16a0eeb0791b6c92
  [..] seal-ro   <MAIN>/.git/worktrees

== sealed directories (empty in the box; nothing creatable) ==
  <MAIN>/.git/worktrees

== environment (the box's complete environment; --clearenv first) ==
  AISAN_CODEX_API_KEY=aisan-placeholder-not-a-credential
  AI_AGENT=aisan
  CODEX_HOME=<STATE>
  DEBIAN_FRONTEND=noninteractive
  GIT_CONFIG_COUNT=3
  GIT_CONFIG_KEY_0=gc.auto
  GIT_CONFIG_KEY_1=gc.pruneExpire
  GIT_CONFIG_KEY_2=gc.worktreePruneExpire
  GIT_CONFIG_VALUE_0=0
  GIT_CONFIG_VALUE_1=never
  GIT_CONFIG_VALUE_2=never
  GIT_PAGER=cat
  GIT_TERMINAL_PROMPT=0
  HOME=<HOME>
  PAGER=cat
  PATH=/usr/bin

== argv (exactly what is exec'd, one token per line) ==
  systemd-run
  --user
  --scope
  -q
  --collect
  -p
  MemoryMax=8G
  -p
  TasksMax=4096
  --
  bwrap
  --ro-bind
  /usr
  /usr
  --symlink
  usr/bin
  /bin
  --symlink
  usr/lib
  /lib
  --symlink
  usr/lib64
  /lib64
  --symlink
  usr/sbin
  /sbin
  --ro-bind
  /etc
  /etc
  --proc
  /proc
  --dev
  /dev
  --unshare-net
  --ro-bind
  /run/systemd/journal/stdout
  /run/systemd/journal/stdout
  --size
  2147483648
  --tmpfs
  <TMP>
  --size
  1073741824
  --tmpfs
  <HOME>
  --bind
  <ROOT>
  <ROOT>
  --bind
  <MAIN>/.git
  <MAIN>/.git
  --ro-bind
  <ROOT>/.git
  <ROOT>/.git
  --ro-bind
  <MAIN>/.git/config
  <MAIN>/.git/config
  --ro-bind
  <MAIN>/.git/config.worktree
  <MAIN>/.git/config.worktree
  --ro-bind
  <MAIN>/.git/objects/info/alternates
  <MAIN>/.git/objects/info/alternates
  --ro-bind
  <MAIN>/.git/hooks
  <MAIN>/.git/hooks
  --tmpfs
  <MAIN>/.git/worktrees
  --bind
  <MAIN>/.git/worktrees/wt
  <MAIN>/.git/worktrees/wt
  --ro-bind
  <MAIN>/.git/worktrees/wt/commondir
  <MAIN>/.git/worktrees/wt/commondir
  --ro-bind
  <MAIN>/.git/worktrees/wt/config.worktree
  <MAIN>/.git/worktrees/wt/config.worktree
  --ro-bind
  <MAIN>/.git/objects/pack
  <MAIN>/.git/objects/pack
  --bind
  <STATE>
  <STATE>
  <AISAN RUNTIME>
  --ro-bind
  <TMP>/aisan-proxy-16a0eeb0791b6c92
  <TMP>/aisan-proxy-16a0eeb0791b6c92
  --remount-ro
  <MAIN>/.git/worktrees
  --unshare-pid
  --unshare-ipc
  --unshare-uts
  --cap-drop
  ALL
  --die-with-parent
  --clearenv
  --setenv
  DEBIAN_FRONTEND
  noninteractive
  --setenv
  GIT_PAGER
  cat
  --setenv
  PAGER
  cat
  --setenv
  GIT_TERMINAL_PROMPT
  0
  --setenv
  AI_AGENT
  aisan
  --setenv
  GIT_CONFIG_COUNT
  3
  --setenv
  GIT_CONFIG_KEY_0
  gc.auto
  --setenv
  GIT_CONFIG_VALUE_0
  0
  --setenv
  GIT_CONFIG_KEY_1
  gc.pruneExpire
  --setenv
  GIT_CONFIG_VALUE_1
  never
  --setenv
  GIT_CONFIG_KEY_2
  gc.worktreePruneExpire
  --setenv
  GIT_CONFIG_VALUE_2
  never
  --setenv
  HOME
  <HOME>
  --setenv
  PATH
  /usr/bin
  --setenv
  CODEX_HOME
  <STATE>
  --setenv
  AISAN_CODEX_API_KEY
  aisan-placeholder-not-a-credential
  --chdir
  <ROOT>
  <AISAN PYTHON>
  -m
  aisan.launch
  <TMP>/aisan-proxy-16a0eeb0791b6c92
  --
  <payload>
