Environments enforcement

The Environments primitive is only as good as its enforcement. A sandbox operator must be unable to cause a real-world effect — not merely discouraged. That guarantee rests on two closed chokepoints. Neither is in the open plumbing; both live in the enforcement engine.

​

Chokepoint 1 — the governor

environment is an input to every evaluate call (PROTOCOLS.md §1). The governor decides, and its Verdict carries a target:

• target: "live" — an allowed action routes to the real provider.
• target: "sandbox" — an allowed action routes to the sandbox adapter instead.

For a sandbox operator, allowed guarded actions come back target: "sandbox". The open, per-primitive sandbox adapters honor that verdict — they are simply where a sandbox verdict is carried out, executing the documented sandbox behavior of each primitive and writing synthetic resources stamped sandbox. Policy still runs identically; approvals still freeze. The decision is the governor’s; the adapter only obeys the target it is handed.

​

Per-primitive sandbox behavior

Other guarded primitives (verification, connections, browser, compute, mobile) return synthetic acknowledgements the same way. None can touch a real provider, because a sandbox verdict never routes to the live adapter.

​

Chokepoint 2 — the egress gateway

The egress gateway is the only egress-capable process on a Tower, and it independently enforces the operator’s environment — which it resolves from the runtime token before asking the governor:

• No real credential injection for sandbox. On a terminating provider endpoint, a sandbox operator gets a synthetic body — the gateway never fetches or injects the platform credential via vaultd. Injection is only ever applied at a named terminating provider endpoint for a production operator, never generally.
• A narrowed CONNECT allowlist. The governor decides the host/SNI allowlist per operator + environment, so a sandbox operator’s generic web egress is restricted to the sandbox-permitted set; anything else is refused (and audited by host + verdict only).

So even if a primitive had no on-box adapter, a sandbox agent still could not reach a live provider: the box’s single door checks the environment too.

​

Why production is impossible before promotion

The two chokepoints compose into a closed guarantee:

1. Every operator starts in sandbox (the kit’s mode; the DB default is a fail-safe sandbox).
2. The governor takes environment on every verdict, so a sandbox operator never receives a target: "live" for a guarded action.
3. The open adapters can only carry out the sandbox target they are handed — they have no path to the real provider.
4. The gateway refuses real injection and narrows egress for sandbox, so the transport to a live provider is closed too.
5. Promotion flips only the mode; it never re-stamps sandbox residue, and the governor refuses to replay a sandbox-stamped approval in production (environment_mismatch) — the action must be re-requested.

There is no config, header, or listing filter a sandbox operator can set to make a real-world call. Reaching production requires an explicit promotion, evaluated by the closed engine — which is exactly the point of the primitive.