[Lightheartdevs]

Problem

Pixel is never told what its exec sandbox contains. The workspace TOOLS.md "Shell" section says only that shell runs in the sandbox with a read-only root filesystem. So on coding tasks Pixel spends tool calls finding out:

• Photo renamer ("write a python script that renames all photos in a folder by date taken, and test it"): Pixel sent five exec probes (python3 -c "from PIL import Image", import piexif, import exifread) before it wrote any file. Those calls used up the run's failure budget and the turn stopped.
• Another install, same build: Pixel lost three attempts to pip: not found, pip3: not found and No module named pip.

The sandbox image (ods/vendor/pixel/deploy/sandbox/Dockerfile) ships Python 3.11 with Pillow and python-docx. It has no pip, and the sandbox has no network, so nothing can be installed.

Fix

Add one static contract, ODS_SANDBOX_RUNTIME_CONTRACT, after the conversation contract. It is added only when trusted configuration proves sandboxed exec, meaning executionHostForAgent returns sandbox (sandbox mode all with exec host sandbox). It tells Pixel:

• the sandbox is Debian 12 (bookworm) with Python 3.11
• the only Python packages beyond the standard library are Pillow (import PIL) and python-docx (import docx)
• the installed commands: bash, git, jq, rg, rsync, file, unzip, the poppler-utils, tesseract with English data, and catdoc/xls2csv
• pip, pytest, Node.js and npm are not installed, and there is no network. Pixel must not probe for or install packages, and should use the standard library and python3 -m unittest
• files go in the workspace, which is writable and persists. /tmp is small scratch space. The root filesystem, including home, is read-only.

In native (full-access) mode, and in any mode that is not proven, Pixel gets no sandbox claim.

Why the plugin and not the workspace template

The text lives in pixel-agent/plugin/prompt-contract.mjs (conversationContractForExecution):

• It reaches existing installs. The pixel-ods plugin loads on every Linux, WSL and native macOS install, so each install gets the text on its next update. The template is copied with cp -n, so changes to it never reach existing workspaces. migrate-workspace-source-boundary.mjs runs only in Linux apply.sh. bootstrap-capabilities.mjs changes only TOOLS.md files whose digest still matches the shipped one, so owner-edited files would be skipped.
• It follows the execution mode. A workspace file can't say "sandbox only", and these facts are false when exec runs natively.
• It doesn't touch vendor/pixel. No pixel.bundle regeneration is needed, and nothing overlaps fix(pixel): remove the owner's private operating contract from the workspace template #6755's template scrub. This branch does not need to be built on fix(pixel): remove the owner's private operating contract from the workspace template #6755.
• It keeps the prompt cache stable. The text depends only on the release and the configured execution mode, so it is byte-identical across turns. It sits right after the conversation contract, before any per-message section. With fix(pixel): keep Pixel's prompt append-only across owner messages #6702 it lands in systemContext, the session-stable part. The September 16 core and compact core hashes are unchanged.

Platforms

All platforms use the same image definition:

• Linux: vendor/pixel/scripts/bootstrap.sh builds deploy/sandbox as openclaw-sandbox:bookworm-slim.
• Windows: Pixel runs only through the Linux installer inside WSL2. service-plan.ps1 disables Pixel on native Windows. So Windows uses the Linux path and the same image.
• Native macOS: pixel-native-bootstrap.py builds the same deploy/sandbox Dockerfile for linux/arm64, tagged ods-pixel-native-sandbox:<version>-uid-<uid>-<ref>. Bookworm arm64 ships the same packages and Python 3.11.

All three render the sandbox through render-config.mjs: network none, a read-only root, /workspace read-write, and /tmp as a 256 MB tmpfs.

The only differences between platforms are the image tag and the CPU architecture.

Drift test

tests/sandbox_runtime_contract.test.mjs fails CI when the image or the sandbox settings stop matching the text. test-linux.yml runs pixel-agent/tests/*.test.mjs on every PR, so a change to the Dockerfile alone is caught. The test checks that:

• every package in the Dockerfile's apt-get install line maps to a phrase in the contract, or is explicitly marked unadvertised (ca-certificates, and curl, which is useless without network). Adding or removing a package fails.
• the base image's Debian release (bookworm) maps to the stated Python (3.11). A new release fails until the text is updated.
• the Dockerfile has no other way to add tools: no pip/npm/gem/cargo/go install, no curl | sh, and no COPY/ADD.
• the tools the contract calls absent (pip/venv, pytest, Node.js, npm) are not installed.
• the sandbox block in render-config.mjs keeps network none, readOnlyRoot: true, workspaceAccess: "rw", workdir /workspace, and a /tmp tmpfs.
• the Linux/WSL and macOS installers build that Dockerfile and render that config.
• the contract appears exactly once, at the same position, for every prompt in both the full and lean contracts under sandbox exec, and never under native exec or an unproven mode.

I checked by hand that each of these changes fails the test: adding python3-numpy, removing python3-docx, adding nodejs, switching the base to trixie, adding a RUN pip install line, adding a COPY line, setting network to bridge, and setting readOnlyRoot: false.

Validation

Full Linux pixel-agent suite (node --test tests/*.test.mjs):

Tree	Tests	Pass	Fail
main 5afd46c	3203	3165	0
this branch 46b9c67	3207	3169	0
this branch + main (merge commit, not pushed)	3207	3169	0
+ #6743	3279	3241	0
+ #6702	3244	3206	0
+ #6753	3230	3191	1

The #6753 failure (tower2 replay through the registered hooks: the refused cleanup keeps the current pass... in deletion_refusal_delivery.test.mjs) is not caused by this branch. It also fails on main + #6753 without this change, and passes on #6753 alone, which is behind main.

Conflicts

git merge-tree against open PRs:

• Clean: fix(pixel): plan within the output limit, continue a cut Portal turn once, report otherwise #6743, fix(pixel): steer preview tools to their direct route and answer wrapped control tools #6747, fix(pixel): every non-passing preview inspection returns a ready, validated next call or a measured diagnosis #6748, fix(pixel): capsule role/name locators match Playwright's source-text names as well as Chromium's text-transformed names #6750, fix(pixel): judge an exit-0 unittest run by the runner's own summary; a coding stop takes precedence over test-command coaching #6752, fix(pixel): a refused rm -rf keeps a current passing test, and the owner gets a receipt instead of guard text #6753, fix(pixel): keep a passing show/hide proof across later passing checks of the same snapshot #6754, fix(pixel): remove the owner's private operating contract from the workspace template #6755, fix(pixel): let the turn continue after an in-project rm -rf is refused #6722, fix(pixel): answer after an unchanged file and check preview bytes when a result is saved #6732, fix(pixel): report a requested card published twice under identical headings #6759, fix(pixel): a stopped turn links an earlier preview only when it continues that project #6760, fix(pixel): a harness revision or continuation prompt keeps the owner's request scope #6756, fix(pixel): keep Pixel's prompt append-only across owner messages #6702.
• Conflicts that also occur against main without this branch: Defer a host-guided inspection failure that would stop the run for exactly one corrected attempt, with every hard bound kept #6749 and fix(pixel): stop whole-file rewrites and test bisection after failed tool results (output efficiency C1-C4) #6716 conflict in tool-loop-guard.mjs (fix(pixel): stop whole-file rewrites and test bisection after failed tool results (output efficiency C1-C4) #6716 also in workspace-preview-inspect.mjs), fix(pixel): keep the system prompt byte-stable across owner messages #6654 in index.js, and Improve Pixel task execution, evidence reuse, and visible progress #6645 in several files. This branch adds no conflicts.

🤖 Generated with Claude Code