INTERFACE-LEVEL CAPABILITY ARGUMENT (NOT AN OS-SANDBOX PROOF)
Assumptions: trusted controller/interpreters/tokenizer/native Ollama/Python/Windows/driver operate as inspected; no malicious co-resident host process or binary substitution. The model may emit arbitrary text before validation.
1. Strict decoding bounds message size/depth and rejects duplicate keys/nonfinite values/invalid scalars. Exact fields are plan, verify, claim. plan contains at most 16 strings, each equal to an allowed manifest ID; flags have exact literal types/enums.
2. No model string is resolved as a path, command, import, executable, URL, model tag, runtime configuration or controller filename. The only model-dependent dispatch choices are install a finite list, perform a pre-authored structural check, and assess a completion claim.
3. Interpreter state transitions use only fixed synthetic data, bounded lists and trusted rules. Both finite interpreter modules have been statically inspected for absence of dynamic execution and host-I/O calls; model-output validation precedes them. Negative controls exercise paths/code/URLs, malformed JSON, extra verdict fields and stale verification.
4. Logging and model API calls occur in the trusted controller using preassigned folder indices and a fixed loopback endpoint. Agent data are JSON-serialized; they do not choose these destinations. The only installed artifact is an in-memory plan; changes invalidate its check hash/version.
By induction over admitted turns, an evaluated-agent response can change only the permitted synthetic state and completion decision. It cannot request a host-file, network or process operation through this interface. This is an inspected interface-level argument, not formal verification of every dependency or protection against a compromised native server.
Host operating limits independently cap resource use and clean up owned process groups; persistent stop/heartbeat loss prevents further admission. Actual resource-stop evidence and cleanup are retained. These controls do not grant filesystem isolation to native binaries, and the empirical experiment is not an adversarial sandbox benchmark.
