microsoft · brandwe · Jun 18, 2026 · Jun 18, 2026 · Jun 18, 2026 · Jun 18, 2026
diff --git a/.claude/settings.json b/.claude/settings.json
@@ -99,7 +99,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "echo '{\"hookSpecificOutput\":{\"hookEventName\":\"PostToolUse\",\"additionalContext\":\"Teams message sent. The background channel will push any replies automatically — no need to call watch_teams_replies unless you want to block and wait.\"}}'",
+            "command": "python3 scripts/hooks/report_teams_send.py",
             "timeout": 5
           }
         ]

diff --git a/.gitignore b/.gitignore
@@ -19,9 +19,11 @@ venv/
 .mypy_cache/
 .pyright/
 .openclaw-state.json
-.entrabot-state.json
-.entrabot-state.json.bak.*
+.entrabot-state*.json
+.entrabot-state*.json.bak.*
 .mcp.json
+.mcp.json.bak.*
+.mcp.*.json
 a365.config.json
 a365.generated.config.json
 ToolingManifest.json
@@ -51,3 +53,8 @@ pip.ini
 docs/runbooks/session-*.md
 docs/superpowers/
 .entraclaw-state.json
+.mxc-build/mxc-src/
+# MXC Windows SDK fetched on demand by scripts/setup_sandbox.ps1 (large; the
+# pinned SHA256 in src/entrabot/sandbox/binary.py is the trust anchor, not the
+# committed bytes).
+.mxc-build/npm/
diff --git a/.mxc-build/target/release/.mxc-exec-mac.mock b/.mxc-build/target/release/.mxc-exec-mac.mock
@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Test MXC mock - executes commands for testing entrabot plumbing
+# Mimics MXC 0.6.0-alpha schema
+
+# Read MXC config from stdin (JSON)
+if [ -t 0 ]; then
+    CONFIG="{}"
+else
+    CONFIG=$(cat)
+fi
+
+# Extract command from MXC schema: process.commandLine
+COMMAND=$(echo "$CONFIG" | python3 -c "
+import json, sys
+try:
+    c = json.load(sys.stdin)
+    print(c.get('process', {}).get('commandLine', ''))
+except:
+    print('')
+" 2>/dev/null || echo "")
+
+if [ -z "$COMMAND" ]; then
+    echo '{"error": "No command specified in process.commandLine"}' >&2
+    exit 1
+fi
+
+# Execute with timeout (real MXC would apply sandboxing)
+timeout 30s bash -c "$COMMAND" 2>&1
+EXIT_CODE=$?
+
+exit $EXIT_CODE
diff --git a/.mxc-build/target/release/mxc-exec-mac b/.mxc-build/target/release/mxc-exec-mac
diff --git a/README.md b/README.md
@@ -1,4 +1,4 @@
-# Entrabot: Identity Research for Microsoft 365 Agents
+# Entrabot: Identity Research for Microsoft 365 Agents using Autopilot
 
 
 Entrabot is a Python MCP server that gives a device-local agent its own Entra **Agent ID** and an **Agent User** that has all the capabilities of a human user in a Microsoft tenant. It can have a Teams presence and be invited to meetings to chat with your colleagues 1:1, a mailbox it can monitor and respond to, create and edit Word documents, make PowerPoint presentations, and allows you to access your CLI. The agent signs in autonomously, sends Teams messages from its own account, and writes audit events against its own object ID. It runs on macOS, Linux, and Windows, and works with Claude Code, Copilot CLI, or any MCP-speaking client.
@@ -35,6 +35,7 @@ entrabot is the device-side glue for a set of platform primitives Microsoft ship
 
 - **Entra Agent ID** — the four-object hierarchy: Agent Identity Blueprint → BlueprintPrincipal → Agent Identity → Agent User. Confidential clients only; no public-client flows; tokens carry `idtyp=user` for the Agent User leaf. ([platform learning](docs/platform-learnings/agent-id-blueprints-and-users.md))
 - **Microsoft Agent 365** — the control plane: admin-center inventory, OTel observability, Work IQ MCP servers (Mail, Calendar, Teams, SharePoint, OneDrive, Word, User, Copilot, Dataverse), AI-teammate lifecycle. GA 2026-05-01. ([platform learning](docs/platform-learnings/microsoft-agent-365.md))
+- **MXC Sandbox** — OS-enforced containment for local code execution. Process-level isolation with positive-allowlist filesystem access, network blocking, and operator-set capability ceilings. Opt-in `run_code` tool (disabled by default). Phase 1 ships macOS Seatbelt; Windows AppContainer and Linux seccomp-bpf coming next. Phase 2 will bind sessions to Agent User identity for M365 audit attribution. ([setup guide](docs/guides/mxc-sandbox.md) · [ADR-007](docs/decisions/007-mxc-sandbox-integration.md))
 - **Conditional Access for agents** — GA. Apply CA policies to Agent Identity sign-ins the same way you apply them to users.
 - **ID Protection for agents** — GA. Risk scoring and remediation against the agent's own object.
 - **FastMCP** — the Python MCP server framework. entrabot registers every Teams, Outlook, Files, Word, audit, and identity tool through it.
@@ -96,7 +97,7 @@ source .venv/bin/activate
 claude --dangerously-load-development-channels server:entrabot
 ```
 
-`setup.sh` is idempotent. It provisions the Blueprint, BlueprintPrincipal, Agent Identity, and Agent User; assigns a Teams-capable license; uploads a self-signed certificate to Entra; and writes `.env` plus `.mcp.json` with no secrets on disk. Full walkthrough — including Windows, cloud memory, cross-tenant group chats, and the Work IQ Word setup — is in [`docs/getting-started/quickstart.md`](docs/getting-started/quickstart.md) and [`INSTALL.md`](INSTALL.md).
+`setup.sh` is idempotent. It provisions the Blueprint, BlueprintPrincipal, Agent Identity, and Agent User; assigns a Teams-capable license; uploads a self-signed certificate to Entra; and writes `.env` plus `.mcp.json` with no secrets on disk. Add `--use-cloud-memory` to enable Azure Blob storage for operational state, or `--enable-sandbox` to provision MXC sandbox for contained local code execution (opt-in, disabled by default; full walkthrough in the [MXC sandbox setup guide](docs/guides/mxc-sandbox.md)). Full walkthrough — including Windows, cloud memory, cross-tenant group chats, and the Work IQ Word setup — is in [`docs/getting-started/quickstart.md`](docs/getting-started/quickstart.md) and [`INSTALL.md`](INSTALL.md).
 
 ### Launching the agent
 
@@ -146,6 +147,7 @@ The full doc site: **<https://microsoft.github.io/entrabot/>**
 Direct pointers:
 
 - [Quickstart](docs/getting-started/quickstart.md) — five minutes from clone to first Teams message
+- [MXC sandbox setup](docs/guides/mxc-sandbox.md) — enable contained local code execution (`run_code`): build the binary, set the operator ceiling, verify kernel enforcement
 - [MCP tool reference](docs/reference/mcp-tools.md) — every tool, every parameter
 - [Setup script reference](docs/reference/setup-script.md) — every `setup.sh` flag
 - [Script reference](docs/reference/scripts/operations.md) — status, health, DM, email, setup, teardown, and diagnostic scripts

diff --git a/TODOS.md b/TODOS.md
@@ -17,6 +17,18 @@ Claude Code v2.1.152 now does MCP OAuth 2.1 discovery and ignores `.mcp.json` `h
 
 ## P1
 
+### Cache the Agent User storage token — every blob op re-runs the three-hop flow synchronously on the event loop
+`_ConditionalBlobAdapter` (promises path) passes `token_provider=lambda: acquire_agent_user_storage_token(...)` with no caching (`src/entrabot/tools/promises.py:163`), so each blob GET/PUT pays up to three blocking HTTPS token round-trips on the asyncio loop — a `resolve_promise` can cost ~8 sequential requests, each a timeout opportunity, and each blocks the loop (same anti-pattern Learning #69 fixed at boot). A short-TTL storage-token cache would cut the failure surface and the loop stalls.
+
+- **Effort:** S–M
+- **Source:** resolve_promise empty-error investigation, 2026-07-06 (sub-agent report; fix for the error *surfacing* shipped separately — this is the amplifier).
+
+### Investigate chronic connectivity degradation of the MCP server process
+The rotating server log holds **644** empty-message `ConnectTimeout`/`getaddrinfo` warnings (102 on 2026-07-06 alone, starting ~18:52Z) hitting cursor saves, chat bootstraps, and email polls, while cached-token Teams Graph calls kept working. Suspects: Parallels VM pauses (multi-minute `SystemTimeChange` jumps from `prl_tools.exe`), per-call token acquisition (see above), and/or the open MCP-disconnect dossier (`docs/runbooks/mcp-disconnect-investigation.md`) — read that runbook first, do not restart the investigation from scratch.
+
+- **Effort:** M (instrumentation-first)
+- **Source:** 2026-07-06 session — the degradation window is what made `resolve_promise` fail 4/4 while `add_promise` (called earlier) succeeded.
+
 ### Follow-up: two-phase sponsor confirmation flow for mutating tools
 The active-sponsor-channel binding shipped in PR `fix/msrc-active-sponsor-channel-binding` closes Chain A from the security confused-deputy report (attacker in low-priv chat manipulating action on a chat where sponsor is passive) but does NOT close the residual window where a sponsor IS actively engaged in the target chat. An attacker who gets a sponsor to read an injected SharePoint doc (Chain B) can still trigger a malicious `add_member` / `share_file` because all binding checks pass.
 
@@ -111,11 +123,11 @@ Two bugs, both observed at 2026-04-17T17:00:00 PDT (= 00:00:01 UTC 2026-04-18):
 ### ~~Token auto-refresh in teams_send~~ ✅ DONE
 Implemented as `_with_token_retry()` in `mcp_server.py` and `_ensure_valid_token()` (proactive refresh at 55 min). All tools use it.
 
-### AppContainer sandbox production implementation
-Tonight's spike proves feasibility. Production version needs: filesystem allowlist, network filtering (Graph API only), process spawn restrictions, MCP server integration. May require Win32 C extension from Python.
-- **Effort:** L (CC: ~1-2 days)
-- **Depends on:** AppContainer spike results
+### ~~AppContainer sandbox production implementation~~ ✅ DONE (MXC sandbox integration)
+**Shipped as MXC sandbox integration (Issue #84, ADR-007).** Phase 1 complete: process-level containment via MXC 0.6.0-alpha (macOS Seatbelt). Positive-allowlist filesystem, network blocking, operator ceiling enforcement, binary SHA256 verification, opt-in `run_code` tool. The macOS mock binary was retired on 2026-06-18 and replaced with a real `mxc-exec-mac` built from `microsoft/mxc` v0.6.1 plus the repo-local stdin compatibility patch in `scripts/mxc-mac-stdin-compat.patch`. Phase 2 stub (session-bound Entra identity attribution) ready for future APIs. Windows AppContainer + Linux seccomp-bpf deferred to T4/T10.
+- **Status:** Phase 1 shipped (1605 tests passing), Phase 2 stub in place
 - **Source:** CEO review, refined premise (sandbox co-equal with identity)
+- **See:** `docs/decisions/007-mxc-sandbox-integration.md`, `docs/architecture/DESIGN-mxc-sandbox.md`
 
 ## P2