Source: bulkhead (pmembrey) — Aug-2026 landscape pass (research/sandbox-landscape-synthesis-2026-08.md §4, top tier).
What
An opt-in mode where sandy works against a fresh git clone --no-local --no-hardlinks of the workspace into a scratch dir, so the source repo's .git/ (hooks, config, workflows) is never mounted into the container at all — instead of today's model where the workspace (incl. .git/) is bind-mounted and a set of paths are protected :ro + swept for tampering at session end.
Why
Sandy's current git-hook / .github/workflows tamper defense is detection-only (.protected-existed-at-launch + exit-time warning), and CLAUDE.md itself admits a "threat window between session end and the user's first git pull." Clone-mode is prevention: the metadata that could carry a hook/workflow payload isn't reachable to begin with. bulkhead's clone mode (.bulkhead/clones/<name>, --base/--branch/--detach) is the reference.
Notes / open design
- Changes the "land a PR from inside" flow (no host
.git to push against) — needs the push-back-to-origin story worked out (a host relay, or push from the clone to origin then the host fetches). Interacts with the HEAD-preserving pattern already documented.
- Opt-in (
SANDY_GIT_CLONE_MODE or similar); default stays the bind-mount+protect model.
Effort: M.
Source: bulkhead (pmembrey) — Aug-2026 landscape pass (
research/sandbox-landscape-synthesis-2026-08.md§4, top tier).What
An opt-in mode where sandy works against a fresh
git clone --no-local --no-hardlinksof the workspace into a scratch dir, so the source repo's.git/(hooks, config, workflows) is never mounted into the container at all — instead of today's model where the workspace (incl..git/) is bind-mounted and a set of paths are protected:ro+ swept for tampering at session end.Why
Sandy's current git-hook /
.github/workflowstamper defense is detection-only (.protected-existed-at-launch+ exit-time warning), and CLAUDE.md itself admits a "threat window between session end and the user's first git pull." Clone-mode is prevention: the metadata that could carry a hook/workflow payload isn't reachable to begin with. bulkhead's clone mode (.bulkhead/clones/<name>,--base/--branch/--detach) is the reference.Notes / open design
.gitto push against) — needs the push-back-to-origin story worked out (a host relay, or push from the clone to origin then the host fetches). Interacts with the HEAD-preserving pattern already documented.SANDY_GIT_CLONE_MODEor similar); default stays the bind-mount+protect model.Effort: M.