Sandbox isolation

Sandbox isolation is the practice of running each project’s generation and verification in its own separate environment, so that no project can observe or affect another and every result reflects that project alone.

Isolation is what makes a passing build mean something. A check that ran with leftover state from another project — a cached dependency, a running service, a file nobody meant to leave behind — has verified a situation the customer will never be in.

It is also a containment boundary. Generated code is executed during verification, and executing generated code is exactly the situation isolation exists for. The blast radius of anything unexpected is one project’s environment.

In newc0’s case the isolation is per project and previews run from inside it. The model itself never touches a filesystem or a network directly: it proposes structured file-edit operations that a deterministic executor validates and applies.

See also scaffold and content-hashed build.