MOOTER · SPAWN · DES. 018ESC 1:1 · REV v1.53.0 · 2026-08-28

Spawn agents — local-first, by default

mooter spawn "fix bug in Hero.tsx" classifies the task with the same classify.js doctrine that routes everything else, cuts an isolated git worktree, wraps the process in a 4-layer sandbox, and streams the output to a log you can tail.

layers4 mandatorynone can be switched off by a flag
  1. 01Network egress

    --unshare-net for pure-compute spawns.

  2. 02Filesystem

    read-only root; the worktree is the single writable mount; secret dirs masked.

  3. 03Secrets

    cleared env + whitelist; ANTHROPIC_API_KEY never reaches a local spawn.

  4. 04Config

    settings.json read-only.

verify1 commandon real bubblewrap, every release
No opt-out

There is no --no-sandbox.

Run mooter security spawn-test to verify the sandbox blocks the escape — on real bubblewrap, every release.