diff --git a/AgenticPatterns.Tests/AgenticPatterns.Tests.csproj b/AgenticPatterns.Tests/AgenticPatterns.Tests.csproj
index 360e758..5142e47 100644
--- a/AgenticPatterns.Tests/AgenticPatterns.Tests.csproj
+++ b/AgenticPatterns.Tests/AgenticPatterns.Tests.csproj
@@ -21,6 +21,11 @@
         <ProjectReference Include="..\EvaluationAndMonitoring.AgentFramework\EvaluationAndMonitoring.AgentFramework.csproj"/>
         <ProjectReference Include="..\ExceptionHandlingAndRecovery.AgentFramework\ExceptionHandlingAndRecovery.AgentFramework.csproj"/>
         <ProjectReference Include="..\IdempotentToolCalls.AgentFramework\IdempotentToolCalls.AgentFramework.csproj"/>
+        <ProjectReference Include="..\MCP.AgentFramework\MCP.AgentFramework.csproj"/>
+        <!-- NOT MCP.SemanticKernel: excluded conservatively, not because it conflicts - McpToolBinding
+             is mirrored into MCP.SemanticKernel's own namespace, so there is no name collision, and
+             Program.cs's top-level-statement type is internal and invisible across the assembly
+             boundary, so referencing it too would add nothing to test. -->
         <ProjectReference Include="..\MemoryManagement.AgentFramework\MemoryManagement.AgentFramework.csproj"/>
         <ProjectReference Include="..\OrchestratorWorkers.AgentFramework\OrchestratorWorkers.AgentFramework.csproj"/>
         <ProjectReference Include="..\PatternExplorer\PatternExplorer.csproj"/>
@@ -32,6 +37,7 @@
         <ProjectReference Include="..\SelfCorrectionLoop.AgentFramework\SelfCorrectionLoop.AgentFramework.csproj"/>
         <ProjectReference Include="..\SemanticCaching.AgentFramework\SemanticCaching.AgentFramework.csproj"/>
         <ProjectReference Include="..\SkillLearning.AgentFramework\SkillLearning.AgentFramework.csproj"/>
+        <ProjectReference Include="..\StigmergicCoordination.AgentFramework\StigmergicCoordination.AgentFramework.csproj"/>
         <ProjectReference Include="..\TreeOfThoughts\TreeOfThoughts.csproj"/>
         <ProjectReference Include="..\ToolAuthorization.AgentFramework\ToolAuthorization.AgentFramework.csproj"/>
         <!-- NOT Voting.SemanticKernel: excluded conservatively, not because it conflicts - its
diff --git a/AgenticPatterns.Tests/CodeActExecutionTests.cs b/AgenticPatterns.Tests/CodeActExecutionTests.cs
index 948d862..074a8b0 100644
--- a/AgenticPatterns.Tests/CodeActExecutionTests.cs
+++ b/AgenticPatterns.Tests/CodeActExecutionTests.cs
@@ -1,4 +1,6 @@
 using CodeAct.AgentFramework.Execution;
+using Microsoft.Extensions.AI;
+using Shared.Sandbox;
 using Xunit;
 
 #pragma warning disable CS0618 // testing the deliberately-[Obsolete] unsafe runner is the point
@@ -154,6 +156,35 @@ public void HostCannotBeAskedToRunAnythingButTheScript()
         Assert.Equal([Options.ContainerImage, "dotnet", "run", "/workspace/script.cs"], Args()[^4..]);
     }
 
+    // ---- run-directory permissions must not depend on the operator's umask ----
+
+    // Directory.CreateDirectory(path, mode)'s mode is a mkdir(2) mode, masked by the
+    // process umask like any mkdir call - a restrictive umask (e.g. 077, common in CI/hardened
+    // hosts) silently drops the group/other bits the container's uid 65532 needs to traverse
+    // the bind mount and read script.cs, and CodeAct fails loudly with "Script failed" inside
+    // the container. This asserts the ACTUAL mode via File.GetUnixFileMode - regardless of
+    // whatever umask the test process happens to run under - rather than reasoning about the
+    // code, matching StigmergicBuildGateTests.CreateWorkspaceDirectoryIsWorldReadableAndTraversable.
+    [Fact]
+    public void RunDirectoryIsWorldReadableAndTraversableRegardlessOfUmask()
+    {
+        if (OperatingSystem.IsWindows()) return; // UnixFileMode is a no-op there
+        var runId = Guid.NewGuid().ToString("N");
+        var path = ContainerCodeRunner.CreateRunDirectory(runId);
+        try
+        {
+            var mode = File.GetUnixFileMode(path);
+            Assert.True(mode.HasFlag(UnixFileMode.OtherRead) && mode.HasFlag(UnixFileMode.OtherExecute));
+            Assert.True(mode.HasFlag(UnixFileMode.GroupRead) && mode.HasFlag(UnixFileMode.GroupExecute));
+
+            // The shared parent ("codeact") must be traversable too, or uid 65532 cannot
+            // even reach the per-run directory beneath it.
+            var parentMode = File.GetUnixFileMode(Path.GetDirectoryName(path)!);
+            Assert.True(parentMode.HasFlag(UnixFileMode.OtherRead) && parentMode.HasFlag(UnixFileMode.OtherExecute));
+        }
+        finally { Directory.Delete(path, recursive: true); }
+    }
+
     // ---- output and cancellation lifecycle ----
 
     [Fact]
@@ -181,4 +212,31 @@ public async Task CallerCancellationIsNotConvertedIntoATimeoutResult()
         await Assert.ThrowsAnyAsync<OperationCanceledException>(() =>
             runner.RunAsync("Console.WriteLine();", new CancellationToken(canceled: true)));
     }
+
+    // ---- cancellation plumbing: the agent-invocation token must reach the runner ----
+
+    // Same shape as Program.cs's ExecuteCSharp local function (a trailing CancellationToken
+    // parameter, not exposed to the model as a JSON-schema argument): proves
+    // AIFunctionFactory.Create injects the AIFunction invocation's token into that parameter
+    // for exactly this delegate shape, and that it is the SAME token RunAsync receives.
+    [Fact]
+    public async Task ExecuteCSharpToolForwardsTheInvocationTokenToTheRunner()
+    {
+        var runner = new RecordingCodeRunner();
+
+        async Task<string> ExecuteCSharp(string code, CancellationToken cancellationToken)
+        {
+            var execution = await runner.RunAsync(code, cancellationToken);
+            return execution.StandardOutput;
+        }
+
+        var tool = AIFunctionFactory.Create(ExecuteCSharp, "execute_csharp", "test tool");
+        using var cts = new CancellationTokenSource();
+        cts.Cancel();
+
+        await tool.InvokeAsync(new AIFunctionArguments { ["code"] = "Console.WriteLine();" }, cts.Token);
+
+        Assert.Equal(cts.Token, runner.ReceivedToken);
+        Assert.True(runner.ReceivedToken.IsCancellationRequested);
+    }
 }
diff --git a/AgenticPatterns.Tests/Fakes.cs b/AgenticPatterns.Tests/Fakes.cs
index 8cea0c4..e63b9ce 100644
--- a/AgenticPatterns.Tests/Fakes.cs
+++ b/AgenticPatterns.Tests/Fakes.cs
@@ -1,7 +1,20 @@
+using CodeAct.AgentFramework.Execution;
 using Microsoft.Extensions.AI;
 
 namespace AgenticPatterns.Tests;
 
+/// <summary>Records the token it was invoked with, instead of actually running anything.</summary>
+internal sealed class RecordingCodeRunner : IGeneratedCodeRunner
+{
+    public CancellationToken ReceivedToken { get; private set; }
+
+    public Task<ExecutionResult> RunAsync(string sourceCode, CancellationToken cancellationToken)
+    {
+        ReceivedToken = cancellationToken;
+        return Task.FromResult(new ExecutionResult(0, "", "", TimedOut: false));
+    }
+}
+
 /// <summary>Returns pre-canned responses in order and counts calls.</summary>
 internal sealed class ScriptedChatClient(params ChatResponse[] responses) : IChatClient
 {
diff --git a/AgenticPatterns.Tests/McpToolBindingTests.cs b/AgenticPatterns.Tests/McpToolBindingTests.cs
new file mode 100644
index 0000000..ad54f17
--- /dev/null
+++ b/AgenticPatterns.Tests/McpToolBindingTests.cs
@@ -0,0 +1,64 @@
+using MCP.AgentFramework;
+using Xunit;
+
+namespace AgenticPatterns.Tests;
+
+public class McpToolBindingTests
+{
+    static readonly HashSet<string> Allowed = new(["add", "echo"], StringComparer.Ordinal);
+
+    [Fact]
+    public void OnlyAllowlistedToolsAreBound() =>
+        Assert.Equal(["add", "echo"],
+            McpToolBinding.SelectAuthorized(["add", "echo", "printEnv", "sampleLLM"], Allowed).Order());
+
+    [Fact]
+    public void AMissingAllowlistedToolFailsClosed() =>
+        Assert.Throws<InvalidOperationException>(() => McpToolBinding.SelectAuthorized(["echo"], Allowed));
+
+    [Fact]
+    public void CaseInsensitiveAllowlistUsesTheAllowlistsOwnComparer()
+    {
+        var allowed = new HashSet<string>(["Add", "Echo"], StringComparer.OrdinalIgnoreCase);
+        Assert.Equal(["add", "echo"], McpToolBinding.SelectAuthorized(["add", "echo"], allowed).Order());
+    }
+
+    [Fact]
+    public void DuplicateDiscoveredNamesAreNotDuplicatedInTheResult() =>
+        Assert.Equal(["add", "echo"], McpToolBinding.SelectAuthorized(["add", "add", "echo"], Allowed).Order());
+}
+
+/// I1: the MCP sample used to pass `User: null` - the only caller-visible opt-out of a
+/// SandboxOptions default in the tree - while README.md and PatternExplorer/patterns/MCP.md both
+/// promised the "identical" locked-down boundary CodeAct gets, including `--user 65532:65532`.
+/// It was non-root only because the image's own `USER mcp` line said so, and MCP.md tells readers
+/// to point SandboxOptions.Image at any other sandboxed server. Verified by hand that the pinned
+/// server runs fine under the explicit uid, so the boundary enforces it rather than trusting the
+/// image - and this pins that so the next change to it is deliberate.
+public class McpSandboxOptionsTests
+{
+    [Fact]
+    public void TheMcpSandboxOptsOutOfNoDefaultAndRunsNonRoot()
+    {
+        var options = McpToolBinding.Sandbox();
+
+        Assert.Equal("65532:65532", options.User);
+        Assert.False(options.Network);
+        Assert.Equal(McpToolBinding.ServerImage, options.Image);
+        Assert.True(options.Interactive);   // the stdio transport needs -i
+        Assert.NotNull(options.ContainerName);
+        Assert.Null(options.Mounts);        // no host path is visible to the server
+        Assert.Null(options.Environment);   // no host credential reaches it
+    }
+
+    [Fact]
+    public void TheNonRootUserActuallyReachesDocker()
+    {
+        var args = Shared.Sandbox.SandboxRunner.BuildRunArguments(McpToolBinding.Sandbox(), []).ToList();
+        Assert.Equal("65532:65532", args[args.IndexOf("--user") + 1]);
+    }
+
+    [Fact]
+    public void EachRunGetsItsOwnContainerNameSoATimeoutKillsTheRightOne() =>
+        Assert.NotEqual(McpToolBinding.Sandbox().ContainerName, McpToolBinding.Sandbox().ContainerName);
+}
diff --git a/AgenticPatterns.Tests/RunSessionTests.cs b/AgenticPatterns.Tests/RunSessionTests.cs
new file mode 100644
index 0000000..e859f9d
--- /dev/null
+++ b/AgenticPatterns.Tests/RunSessionTests.cs
@@ -0,0 +1,152 @@
+using PatternExplorer;
+using Xunit;
+
+namespace AgenticPatterns.Tests;
+
+/// Exercises RunSession's registry, lookup and channel behavior directly - never through
+/// Start/RunAsync, which would spawn a real `dotnet run` child process.
+public class RunSessionTests
+{
+    [Fact]
+    public void Two_sessions_are_independently_retrievable_and_isolated()
+    {
+        var a = new RunSession();
+        var b = new RunSession();
+        RunSession.Register(a);
+        RunSession.Register(b);
+        try
+        {
+            Assert.Same(a, RunSession.TryGet(a.Id, a.Token));
+            Assert.Same(b, RunSession.TryGet(b.Id, b.Token));
+
+            // A valid token, just from the wrong live run, must not unlock this one.
+            Assert.Null(RunSession.TryGet(a.Id, b.Token));
+
+            a.Cancel();
+
+            Assert.True(a.IsCancelled);
+            Assert.False(b.IsCancelled);
+        }
+        finally
+        {
+            RunSession.Unregister(a);
+            RunSession.Unregister(b);
+        }
+    }
+
+    [Fact]
+    public void TryGet_returns_null_for_wrong_token_or_wrong_id()
+    {
+        var session = new RunSession();
+        RunSession.Register(session);
+        try
+        {
+            Assert.Null(RunSession.TryGet(session.Id, "wrong-token"));
+            Assert.Null(RunSession.TryGet("wrong-id", session.Token));
+        }
+        finally
+        {
+            RunSession.Unregister(session);
+        }
+    }
+
+    [Fact]
+    public void Register_throws_once_the_live_run_cap_is_reached()
+    {
+        var sessions = Enumerable.Range(0, 8).Select(_ => new RunSession()).ToList();
+        foreach (var s in sessions) RunSession.Register(s);
+        try
+        {
+            var extra = new RunSession();
+            Assert.Throws<InvalidOperationException>(() => RunSession.Register(extra));
+        }
+        finally
+        {
+            foreach (var s in sessions) RunSession.Unregister(s);
+        }
+    }
+
+    [Fact]
+    public void Bounded_channel_drops_oldest_instead_of_growing_or_blocking()
+    {
+        var session = new RunSession();
+
+        for (var i = 0; i < 5000; i++)
+            Assert.True(session.Writer.TryWrite(new Chunk("out", i.ToString())));
+
+        var received = new List<Chunk>();
+        while (session.Reader.TryRead(out var chunk)) received.Add(chunk);
+
+        Assert.True(received.Count <= 4096);
+        Assert.DoesNotContain(received, c => c.T == "0");
+        Assert.Contains(received, c => c.T == "4999");
+    }
+}
+
+/// 2.5a's whole point: a sample launched from Explorer gets ONLY what it needs, never Explorer's
+/// own environment (which holds the operator's credentials for every other tool). Deleting
+/// `environment.Clear()` from RunSession leaves every other test in this suite green while every
+/// child sample silently regains the lot, so it gets its own assertion here. Goes through
+/// ApplyChildEnvironment, not Start - no `dotnet run` is spawned.
+public class RunSessionEnvironmentTests
+{
+    const string Secret = "AGENTIC_PATTERNS_TEST_UNRELATED_SECRET";
+    const string Allowed = "AzureOpenAi__ApiKey";
+
+    static void WithVariable(string name, string? value, Action body)
+    {
+        var previous = Environment.GetEnvironmentVariable(name);
+        Environment.SetEnvironmentVariable(name, value);
+        try { body(); }
+        finally { Environment.SetEnvironmentVariable(name, previous); }
+    }
+
+    [Fact]
+    public void The_child_gets_the_allowlist_and_dotnet_run_essentials_but_not_the_rest_of_the_host()
+    {
+        WithVariable(Secret, "leaked", () => WithVariable(Allowed, "sk-test", () =>
+        {
+            // A real ProcessStartInfo, which pre-populates Environment from this process - the
+            // exact thing Clear() has to undo.
+            var info = new System.Diagnostics.ProcessStartInfo("dotnet");
+            Assert.True(info.Environment.ContainsKey(Secret), "precondition: the host variable is inherited");
+
+            RunSession.ApplyChildEnvironment(info.Environment, new PatternProject("AgentFramework", "Some.Sample"));
+
+            Assert.False(info.Environment.ContainsKey(Secret));
+            Assert.Equal("sk-test", info.Environment[Allowed]);
+            Assert.True(info.Environment.ContainsKey("PATH"), "`dotnet run` needs PATH");
+        }));
+    }
+
+    [Fact]
+    public void A_variable_outside_the_projects_own_allowlist_is_not_forwarded()
+    {
+        WithVariable(Secret, "leaked", () =>
+        {
+            var info = new System.Diagnostics.ProcessStartInfo("dotnet");
+            var project = new PatternProject("AgentFramework", "Some.Sample")
+            {
+                EnvironmentAllowlist = [Allowed]
+            };
+
+            RunSession.ApplyChildEnvironment(info.Environment, project);
+
+            Assert.False(info.Environment.ContainsKey(Secret));
+        });
+    }
+
+    [Fact]
+    public void An_allowlisted_variable_that_is_unset_is_simply_absent_not_empty()
+    {
+        WithVariable(Secret, null, () =>
+        {
+            var info = new System.Diagnostics.ProcessStartInfo("dotnet");
+            var project = new PatternProject("AgentFramework", "Some.Sample") { EnvironmentAllowlist = [Secret] };
+
+            RunSession.ApplyChildEnvironment(info.Environment, project);
+
+            Assert.False(info.Environment.ContainsKey(Secret));
+        });
+    }
+}
diff --git a/AgenticPatterns.Tests/SandboxArgumentTests.cs b/AgenticPatterns.Tests/SandboxArgumentTests.cs
new file mode 100644
index 0000000..746ecc7
--- /dev/null
+++ b/AgenticPatterns.Tests/SandboxArgumentTests.cs
@@ -0,0 +1,203 @@
+using Shared.Sandbox;
+using Xunit;
+
+namespace AgenticPatterns.Tests;
+
+public class SandboxArgumentTests
+{
+    [Fact]
+    public void DefaultsDenyNetworkAndCapabilitiesAndWrites()
+    {
+        var args = SandboxRunner.BuildRunArguments(new SandboxOptions("img"), ["echo", "hi"]).ToList();
+        Assert.Equal("none", args[args.IndexOf("--network") + 1]);
+        Assert.Contains("--read-only", args);
+        Assert.Contains("--cap-drop", args);
+        Assert.Contains("--pids-limit", args);
+        Assert.DoesNotContain("--privileged", args);
+    }
+
+    [Fact]
+    public void NoHostEnvironmentIsInherited()
+    {
+        var args = SandboxRunner.BuildRunArguments(new SandboxOptions("img"), ["echo"]);
+        // The container only sees variables passed explicitly; none were passed here.
+        Assert.DoesNotContain("--env", args);
+    }
+
+    // Controller ruling: BuildRunArguments emits "--mount type=bind,src=...,dst=...[,readonly]",
+    // not "-v host:container:ro" — CodeActExecutionTests.OnlyThePerRunDirectoryIsMountedAndReadOnly
+    // already pins this shape and cannot change.
+    [Fact]
+    public void MountsAreReadOnlyWhenRequested()
+    {
+        var options = new SandboxOptions("img", Mounts: [("/host/src", "/src", true)]);
+        Assert.Contains(SandboxRunner.BuildRunArguments(options, ["echo"]),
+            a => a == "type=bind,src=/host/src,dst=/src,readonly");
+    }
+
+    [Fact]
+    public void EnablingTheNetworkIsExplicit()
+    {
+        // M2: assert intent (no --network flag at all), not just the absence of the
+        // string "none" — a weaker assertion would pass even if the flag leaked through
+        // with some other value.
+        var args = SandboxRunner.BuildRunArguments(new SandboxOptions("img", Network: true), ["echo"]);
+        Assert.DoesNotContain("--network", args);
+    }
+
+    // ---- I4: the four fields ruling 2 added, pinned individually ----
+
+    [Fact]
+    public void NullUserOmitsTheFlagAndItsValue()
+    {
+        // No sample opts out of the non-root default any more (MCP used to, and stopped).
+        // The option still has to behave: null omits the flag AND its value, never `--user ""`.
+        var args = SandboxRunner.BuildRunArguments(new SandboxOptions("img", User: null), ["echo"]);
+        Assert.DoesNotContain("--user", args);
+        Assert.DoesNotContain("65532:65532", args);
+    }
+
+    [Fact]
+    public void InteractiveFlagIsPlacedBeforeTheImage()
+    {
+        // MCP's stdio transport depends on -i being a docker FLAG, i.e. before the image
+        // argument, not appended after it (where docker would pass it to the command instead).
+        var args = SandboxRunner.BuildRunArguments(new SandboxOptions("img", Interactive: true), ["echo"]).ToList();
+        Assert.True(args.IndexOf("-i") < args.IndexOf("img"));
+    }
+
+    [Fact]
+    public void NullContainerNameOmitsTheFlag()
+    {
+        var args = SandboxRunner.BuildRunArguments(new SandboxOptions("img", ContainerName: null), ["echo"]);
+        Assert.DoesNotContain("--name", args);
+    }
+
+    [Fact]
+    public void NullTmpfsOmitsTheFlag()
+    {
+        var args = SandboxRunner.BuildRunArguments(new SandboxOptions("img", Tmpfs: null), ["echo"]);
+        Assert.DoesNotContain("--tmpfs", args);
+    }
+
+    [Fact]
+    public void NonPositivePidsLimitFallsBackToTheSafeDefault()
+    {
+        // M3: 0 (or negative) reads to docker as "unlimited" — the same fail-open-on-a-bound
+        // shape as an unset Timeout must not be reachable through PidsLimit either.
+        var args = SandboxRunner.BuildRunArguments(new SandboxOptions("img", PidsLimit: 0), ["echo"]).ToList();
+        Assert.Equal("128", args[args.IndexOf("--pids-limit") + 1]);
+    }
+
+    // ---- fix round 2: assert the clamps as pure values, not by waiting for them ----
+    // A test that runs a fast command and asserts TimedOut: false cannot fail if the clamp
+    // is reverted — a fast command finishes long before either an unbounded wait or a
+    // 3-minute bound expires. Assert the decision directly instead.
+
+    [Fact]
+    public void EffectiveTimeoutClampsNonPositiveValuesToThreeMinutes()
+    {
+        Assert.Equal(TimeSpan.FromMinutes(3), SandboxRunner.EffectiveTimeout(TimeSpan.Zero));
+        Assert.Equal(TimeSpan.FromMinutes(3), SandboxRunner.EffectiveTimeout(TimeSpan.FromSeconds(-5)));
+    }
+
+    [Fact]
+    public void EffectiveTimeoutNeverOverridesAnExplicitCallerValue() =>
+        Assert.Equal(TimeSpan.FromSeconds(30), SandboxRunner.EffectiveTimeout(TimeSpan.FromSeconds(30)));
+
+    [Fact]
+    public void EffectivePidsLimitClampsNonPositiveValuesTo128()
+    {
+        Assert.Equal(128, SandboxRunner.EffectivePidsLimit(0));
+        Assert.Equal(128, SandboxRunner.EffectivePidsLimit(-1));
+    }
+
+    [Fact]
+    public void EffectivePidsLimitNeverOverridesAnExplicitCallerValue() =>
+        Assert.Equal(64, SandboxRunner.EffectivePidsLimit(64));
+
+    // ---- M3: --memory 0 / --cpus 0 read to docker as UNLIMITED, the same fail-open shape ----
+
+    [Theory]
+    [InlineData("0")]
+    [InlineData("0m")]
+    [InlineData("0.0")]
+    [InlineData("")]
+    [InlineData(null)]
+    public void EffectiveMemoryClampsAnythingDockerWouldReadAsUnlimited(string? configured) =>
+        Assert.Equal("512m", SandboxRunner.EffectiveMemory(configured));
+
+    [Theory]
+    [InlineData("0")]
+    [InlineData("0.0")]
+    [InlineData("")]
+    [InlineData(null)]
+    public void EffectiveCpusClampsAnythingDockerWouldReadAsUnlimited(string? configured) =>
+        Assert.Equal("1", SandboxRunner.EffectiveCpus(configured));
+
+    [Fact]
+    public void EffectiveMemoryAndCpusNeverOverrideAnExplicitCallerValue()
+    {
+        Assert.Equal("1g", SandboxRunner.EffectiveMemory("1g"));
+        Assert.Equal("2", SandboxRunner.EffectiveCpus("2"));
+    }
+
+    [Fact]
+    public void ZeroMemoryAndCpusReachDockerAsTheSafeDefaults()
+    {
+        var args = SandboxRunner.BuildRunArguments(
+            new SandboxOptions("img", Memory: "0", Cpus: "0"), ["echo"]).ToList();
+        Assert.Equal("512m", args[args.IndexOf("--memory") + 1]);
+        Assert.Equal("1", args[args.IndexOf("--cpus") + 1]);
+    }
+
+    // ---- M4: `--mount` is a comma-separated option list with no escaping mechanism ----
+
+    [Fact]
+    public void AMountPathContainingACommaIsRejectedRatherThanInjectingMountOptions()
+    {
+        var options = new SandboxOptions("img", Mounts: [("/host/a,readwrite,/etc", "/src", true)]);
+        Assert.Throws<ArgumentException>(() => SandboxRunner.BuildRunArguments(options, ["echo"]));
+    }
+
+    // ---- I1: the non-root default the README and MCP.md both promise ----
+
+    [Fact]
+    public void TheDefaultUserIsNonRootAndIsActuallyPassedToDocker()
+    {
+        var args = SandboxRunner.BuildRunArguments(new SandboxOptions("img"), ["echo"]).ToList();
+        Assert.Equal("65532:65532", args[args.IndexOf("--user") + 1]);
+    }
+}
+
+// The clamp VALUE is asserted purely above (EffectiveTimeout*). What a pure test cannot prove is
+// that RunAsync actually wires it into CancelAfter — that needs a real run whose command outlives
+// the bound. The previous version of this test ran `dotnet --version` and asserted TimedOut is
+// false, which stayed green with `timeoutCts.CancelAfter(...)` deleted, and green on CI where the
+// image it named (built only by ContainerCodeRunner.EnsureImageAsync) is absent and `docker run`
+// exits 125 having launched nothing. This one uses the SDK image StigmergicBuildGateSandboxTests
+// already depends on — pulled if absent — and asserts the timeout FIRES, so deleting the
+// CancelAfter line makes it fail rather than pass. Docker-gated like CodeActSandboxSmokeTests.
+public class SandboxTimeoutTests
+{
+    private static readonly bool DockerAvailable = SandboxRunner.IsAvailable("docker");
+
+    [Fact]
+    public async Task TheConfiguredTimeoutIsWiredIntoTheRunAndKillsTheContainer()
+    {
+        if (!DockerAvailable) return;
+
+        var options = new SandboxOptions("mcr.microsoft.com/dotnet/sdk:10.0",
+            Timeout: TimeSpan.FromSeconds(3),
+            ContainerName: $"sandbox-timeout-test-{Guid.NewGuid():N}");
+
+        var started = System.Diagnostics.Stopwatch.StartNew();
+        var result = await SandboxRunner.RunAsync(options, ["sleep", "120"], stdin: null, CancellationToken.None);
+        started.Stop();
+
+        Assert.True(result.TimedOut);
+        Assert.Equal(-1, result.ExitCode);
+        // Bounded well below `sleep 120`: proves the run was cut short, not merely reported as such.
+        Assert.True(started.Elapsed < TimeSpan.FromSeconds(90), $"took {started.Elapsed}");
+    }
+}
diff --git a/AgenticPatterns.Tests/SecurityHeadersTests.cs b/AgenticPatterns.Tests/SecurityHeadersTests.cs
new file mode 100644
index 0000000..b1afe6c
--- /dev/null
+++ b/AgenticPatterns.Tests/SecurityHeadersTests.cs
@@ -0,0 +1,54 @@
+using PatternExplorer;
+using Xunit;
+
+namespace AgenticPatterns.Tests;
+
+/// <summary>
+/// This is a content assertion on the <see cref="SecurityHeaders.ContentSecurityPolicy"/>
+/// constant, not coverage of the header actually being registered: a WebApplicationFactory-based
+/// end-to-end assertion isn't available in this environment (Program.cs's top-level-statement
+/// type isn't exposed for one, and the project brings no Mvc.Testing/TestHost package). Deleting
+/// the `app.Use` block that writes this header in Program.cs would leave this test green. Manual
+/// verification of the live header (curl, and a Playwright-driven page load with zero CSP console
+/// violations) is in the task report.
+/// </summary>
+public class SecurityHeadersTests
+{
+    [Fact]
+    public void ContentSecurityPolicy_restricts_to_self_and_permits_inline_style()
+    {
+        Assert.Contains("default-src 'self'", SecurityHeaders.ContentSecurityPolicy);
+        Assert.Contains("script-src 'self'", SecurityHeaders.ContentSecurityPolicy);
+        Assert.Contains("style-src 'self' 'unsafe-inline'", SecurityHeaders.ContentSecurityPolicy);
+        Assert.Contains("img-src 'self' data:", SecurityHeaders.ContentSecurityPolicy);
+        Assert.Contains("connect-src 'self'", SecurityHeaders.ContentSecurityPolicy);
+        Assert.Contains("base-uri 'self'", SecurityHeaders.ContentSecurityPolicy);
+        Assert.Contains("form-action 'self'", SecurityHeaders.ContentSecurityPolicy);
+        Assert.Contains("frame-ancestors 'none'", SecurityHeaders.ContentSecurityPolicy);
+
+        // No loosening beyond the brief's starting policy was needed - verified live in the
+        // report - so nothing here should grant 'unsafe-eval' or a wildcard source.
+        Assert.DoesNotContain("unsafe-eval", SecurityHeaders.ContentSecurityPolicy);
+        Assert.DoesNotContain("*", SecurityHeaders.ContentSecurityPolicy);
+    }
+}
+
+/// M5: `GET /api/run` starts a process and spends money, and the per-run token gates only /input
+/// and /cancel - so any page the operator visits could fire one with a bare `<img src=...>`.
+/// CSP frame-ancestors/form-action do not stop a cross-origin GET; Sec-Fetch-Site does.
+public class CrossSiteRequestTests
+{
+    [Theory]
+    [InlineData("cross-site")]
+    [InlineData("same-site")] // another localhost port is still not this app
+    public void Requests_the_browser_marks_as_foreign_are_rejected(string secFetchSite) =>
+        Assert.True(SecurityHeaders.IsCrossSiteRequest(secFetchSite));
+
+    [Theory]
+    [InlineData("same-origin")] // the page's own EventSource
+    [InlineData("none")]        // typed into the address bar
+    [InlineData("")]            // curl, or a browser too old to send the header
+    [InlineData(null)]
+    public void The_apps_own_requests_and_header_less_clients_are_allowed(string? secFetchSite) =>
+        Assert.False(SecurityHeaders.IsCrossSiteRequest(secFetchSite));
+}
diff --git a/AgenticPatterns.Tests/StigmergicBuildGateTests.cs b/AgenticPatterns.Tests/StigmergicBuildGateTests.cs
new file mode 100644
index 0000000..f3b1b2d
--- /dev/null
+++ b/AgenticPatterns.Tests/StigmergicBuildGateTests.cs
@@ -0,0 +1,354 @@
+using Shared.Sandbox;
+using StigmergicCoordination.AgentFramework;
+using Xunit;
+
+namespace AgenticPatterns.Tests;
+
+// Security control flow of the stigmergic build gate without a model or a container runtime:
+// the size cap fires before anything is compiled, error lines are parsed correctly, the
+// sandboxed options grant nothing beyond what an offline `dotnet build` needs, and the host
+// fallback needs the same double opt-in as CodeAct.
+public class StigmergicBuildGateTests
+{
+    private static T WithEnvironmentVariable<T>(string name, string? value, Func<T> body)
+    {
+        var original = Environment.GetEnvironmentVariable(name);
+        Environment.SetEnvironmentVariable(name, value);
+        try { return body(); }
+        finally { Environment.SetEnvironmentVariable(name, original); }
+    }
+
+    // ---- size cap ----
+
+    [Fact]
+    public void OversizedFileIsRejectedBeforeAnythingCompiles()
+    {
+        var workspace = Directory.CreateDirectory(Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString("N"))).FullName;
+        try
+        {
+            File.WriteAllText(Path.Combine(workspace, "Big.cs"), new string('x', (int)BuildGate.MaxSourceBytes + 1));
+            var error = BuildGate.OversizedSourceError(workspace);
+            Assert.NotNull(error);
+            Assert.Contains("Big.cs", error);
+            Assert.Contains("error AP0001", error);
+        }
+        finally { Directory.Delete(workspace, recursive: true); }
+    }
+
+    [Fact]
+    public void FilesUnderTheCapAreNotRejected()
+    {
+        var workspace = Directory.CreateDirectory(Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString("N"))).FullName;
+        try
+        {
+            File.WriteAllText(Path.Combine(workspace, "Small.cs"), "class Small {}");
+            Assert.Null(BuildGate.OversizedSourceError(workspace));
+        }
+        finally { Directory.Delete(workspace, recursive: true); }
+    }
+
+    // ---- error parsing ----
+
+    [Fact]
+    public void ParseErrorsExtractsAndDedupesErrorLines()
+    {
+        var output = "Build started\nFoo.cs(3,5): error CS0535: 'Foo' does not implement\n" +
+                     "Foo.cs(3,5): error CS0535: 'Foo' does not implement\nBuild succeeded? no\n";
+        var errors = BuildGate.ParseErrors(output);
+        Assert.Single(errors);
+        Assert.Contains("error CS0535", errors[0]);
+    }
+
+    [Fact]
+    public void ParseErrorsIgnoresWarningsAndPlainOutput()
+    {
+        var output = "warning CS8600: possible null\nRestore complete.\n";
+        Assert.Empty(BuildGate.ParseErrors(output));
+    }
+
+    // ---- sandboxed options (ruling 1: tmpfs, not the read-only /src mount, is the writable /build) ----
+
+    [Fact]
+    public void SandboxedOptionsDenyNetworkAndGrantOnlyAWritableTmpfsBuildDir()
+    {
+        var args = SandboxRunner.BuildRunArguments(BuildGate.SandboxedOptions("/host/ws"), ["dotnet"]).ToList();
+        Assert.Equal("none", args[args.IndexOf("--network") + 1]);
+        Assert.Contains("--tmpfs", args);
+        Assert.Contains("/tmp:rw,exec,nosuid,nodev,size=1g", args);
+        Assert.Contains("type=bind,src=/host/ws,dst=/src,readonly", args);
+    }
+
+    [Fact]
+    public void SandboxedOptionsSetTheSameOfflineEnvironmentAsContainerCodeRunner()
+    {
+        // Tmpfs (and HOME/DOTNET_CLI_HOME) sit on /tmp, not a separate /build mount - see the
+        // doc comment on SandboxedOptions for why /build alone fails (the CLI's first-run
+        // mutex is hardcoded under /tmp/.dotnet/shm regardless of HOME/TMPDIR).
+        var args = SandboxRunner.BuildRunArguments(BuildGate.SandboxedOptions("/host/ws"), ["dotnet"]);
+        Assert.Contains("HOME=/tmp", args);
+        Assert.Contains("DOTNET_CLI_HOME=/tmp/dotnet", args);
+        Assert.Contains("DOTNET_NOLOGO=1", args);
+        Assert.Contains("DOTNET_CLI_TELEMETRY_OPTOUT=1", args);
+    }
+
+    // ---- fail-closed / double opt-in, same shape as CodeRunnerFactory ----
+
+    private static void WithBothVariables(string? enable, string? acknowledge, Action body) =>
+        WithEnvironmentVariable(BuildGate.UnsafeEnableVariable, enable, () =>
+        WithEnvironmentVariable(BuildGate.UnsafeAcknowledgementVariable, acknowledge, () => { body(); return true; }));
+
+    [Fact]
+    public void NeitherVariableSetMeansNoOptIn() =>
+        WithBothVariables(null, null, () => Assert.False(BuildGate.IsUnsafeHostBuildRequested()));
+
+    [Fact]
+    public void EnableAloneIsInsufficient() =>
+        WithBothVariables(BuildGate.UnsafeEnableValue, null, () => Assert.False(BuildGate.IsUnsafeHostBuildRequested()));
+
+    [Fact]
+    public void AcknowledgementAloneIsInsufficient() =>
+        WithBothVariables(null, BuildGate.UnsafeAcknowledgementValue, () => Assert.False(BuildGate.IsUnsafeHostBuildRequested()));
+
+    [Fact]
+    public void BothVariablesTogetherOptIn() =>
+        WithBothVariables(BuildGate.UnsafeEnableValue, BuildGate.UnsafeAcknowledgementValue,
+            () => Assert.True(BuildGate.IsUnsafeHostBuildRequested()));
+
+    [Fact]
+    public void FailClosedMessageNamesBothOverrideVariables()
+    {
+        Assert.Contains(BuildGate.UnsafeEnableVariable, BuildGate.FailClosedMessage);
+        Assert.Contains(BuildGate.UnsafeAcknowledgementVariable, BuildGate.FailClosedMessage);
+    }
+
+    // ---- C1: the exit code is never discarded - a nonzero exit with no parsed compiler
+    // diagnostic must not read as a pass. Pure, so no Docker/host build needed to pin it. ----
+
+    [Fact]
+    public void NonzeroExitWithNoParsedErrorBecomesASyntheticGateError()
+    {
+        var result = new SandboxResult(1, "", "cp: cannot access '/src': Permission denied\n", TimedOut: false);
+        var errors = BuildGate.InterpretResult(result);
+        Assert.Single(errors);
+        Assert.Contains("error AP0003", errors[0]);
+        Assert.Contains("Permission denied", errors[0]);
+    }
+
+    [Fact]
+    public void ZeroExitWithNoOutputIsAGenuinePass() =>
+        Assert.Empty(BuildGate.InterpretResult(new SandboxResult(0, "", "", TimedOut: false)));
+
+    [Fact]
+    public void NonzeroExitWithAParsedCompilerErrorReportsOnlyTheCompilerError()
+    {
+        var result = new SandboxResult(1, "Foo.cs(1,1): error CS0535: whatever\n", "", TimedOut: false);
+        var errors = BuildGate.InterpretResult(result);
+        Assert.Single(errors);
+        Assert.Contains("CS0535", errors[0]);
+        Assert.DoesNotContain(errors, e => e.Contains("AP0003"));
+    }
+
+    [Fact]
+    public void TimedOutTakesPriorityOverExitCode() =>
+        Assert.Equal(["error AP0002: the build gate timed out"],
+            BuildGate.InterpretResult(new SandboxResult(1, "", "", TimedOut: true)));
+
+    // ---- C2: workspace/file permissions must not depend on the operator's umask ----
+
+    [Fact]
+    public void CreateWorkspaceDirectoryIsWorldReadableAndTraversable()
+    {
+        if (OperatingSystem.IsWindows()) return; // UnixFileMode is a no-op there
+        var parent = Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString("N"));
+        var path = Path.Combine(parent, Guid.NewGuid().ToString("N"));
+        try
+        {
+            BuildGate.CreateWorkspaceDirectory(path);
+            var mode = File.GetUnixFileMode(path);
+            Assert.True(mode.HasFlag(UnixFileMode.OtherRead) && mode.HasFlag(UnixFileMode.OtherExecute));
+        }
+        finally { Directory.Delete(parent, recursive: true); }
+    }
+
+    [Fact]
+    public async Task WriteWorldReadableAsyncMakesTheFileReadableByOthers()
+    {
+        if (OperatingSystem.IsWindows()) return;
+        var dir = Directory.CreateDirectory(Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString("N"))).FullName;
+        try
+        {
+            var path = Path.Combine(dir, "f.cs");
+            await BuildGate.WriteWorldReadableAsync(path, "class C {}", CancellationToken.None);
+            Assert.True(File.GetUnixFileMode(path).HasFlag(UnixFileMode.OtherRead));
+        }
+        finally { Directory.Delete(dir, recursive: true); }
+    }
+
+    // ---- host fallback: I3 wants a test that actually ENTERS HostBuildAsync, not one that
+    // throws before the NuGet.config write even completes. Both below run a real `dotnet
+    // build` on the host - no Docker needed, since this is the unsandboxed path. ----
+
+    [Fact]
+    public async Task HostFallbackActuallyCompilesOnTheHostAndReportsTheCompilerError()
+    {
+        var workspace = Directory.CreateDirectory(Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString("N"))).FullName;
+        try
+        {
+            File.WriteAllText(Path.Combine(workspace, "Broken.cs"), "this is not C#;");
+            File.WriteAllText(Path.Combine(workspace, "Broken.csproj"),
+                """
+                <Project Sdk="Microsoft.NET.Sdk">
+                    <PropertyGroup>
+                        <TargetFramework>net10.0</TargetFramework>
+                    </PropertyGroup>
+                </Project>
+                """);
+
+            var errors = await BuildGate.RunAsync(workspace, useSandbox: false, CancellationToken.None);
+
+            Assert.NotEmpty(errors);
+            Assert.Contains(errors, e => e.Contains(": error "));
+        }
+        finally { Directory.Delete(workspace, recursive: true); }
+    }
+
+    [Fact]
+    public async Task CancellationDuringHostBuildPropagatesInsteadOfHangingOrFalselyPassing()
+    {
+        var workspace = Directory.CreateDirectory(Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString("N"))).FullName;
+        try
+        {
+            File.WriteAllText(Path.Combine(workspace, "Program.cs"), "System.Console.WriteLine(\"hi\");");
+            File.WriteAllText(Path.Combine(workspace, "Program.csproj"),
+                """
+                <Project Sdk="Microsoft.NET.Sdk">
+                    <PropertyGroup>
+                        <OutputType>Exe</OutputType>
+                        <TargetFramework>net10.0</TargetFramework>
+                    </PropertyGroup>
+                </Project>
+                """);
+            // Cancels after the NuGet.config write but almost certainly while `dotnet build`
+            // is still running (process startup alone dominates 50ms) - I3: this must
+            // propagate as cancellation (not hang, not report a false PASSED/timeout).
+            using var cts = new CancellationTokenSource(TimeSpan.FromMilliseconds(50));
+
+            await Assert.ThrowsAnyAsync<OperationCanceledException>(() =>
+                BuildGate.RunAsync(workspace, useSandbox: false, cts.Token));
+        }
+        finally { Directory.Delete(workspace, recursive: true); }
+    }
+}
+
+// Live verification of the sandbox BOUNDARY itself: writes a workspace with the same shape
+// Program.cs writes (contracts + a deliberately contract-breaking worker file) and runs the
+// real gate through Docker. Needs Docker; on machines without it these pass vacuously rather
+// than fail the suite, matching CodeActSandboxSmokeTests.
+public class StigmergicBuildGateSandboxTests
+{
+    private static readonly bool DockerAvailable = SandboxRunner.IsAvailable("docker");
+
+    private const string Contracts =
+        """
+        namespace Campaign;
+        public record ProductSpec(string Name);
+        public interface IPricingModule { int[] GetTiers(ProductSpec spec); }
+        """;
+
+    private static string CreateWorkspace()
+    {
+        var workspace = Directory.CreateDirectory(Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString("N"))).FullName;
+        File.WriteAllText(Path.Combine(workspace, "Contracts.cs"), Contracts);
+        // Mirrors Program.cs's IntegrationGate.cs: never executed, but instantiating
+        // PricingModule where IPricingModule is expected is what actually forces the
+        // compiler to check the contract - without this, an unrelated class just compiles.
+        File.WriteAllText(Path.Combine(workspace, "IntegrationGate.cs"),
+            "namespace Campaign;\npublic static class IntegrationGate { public static IPricingModule Wire() => new PricingModule(); }");
+        File.WriteAllText(Path.Combine(workspace, "Campaign.csproj"),
+            """
+            <Project Sdk="Microsoft.NET.Sdk">
+                <PropertyGroup>
+                    <TargetFramework>net10.0</TargetFramework>
+                    <Nullable>enable</Nullable>
+                </PropertyGroup>
+            </Project>
+            """);
+        return workspace;
+    }
+
+    [Fact]
+    public async Task ContractDriftIsCaughtInsideTheSandbox()
+    {
+        if (!DockerAvailable) return;
+
+        var workspace = CreateWorkspace();
+        try
+        {
+            // Deliberately does NOT implement IPricingModule - the same drift Program.cs seeds.
+            File.WriteAllText(Path.Combine(workspace, "PricingModule.cs"),
+                "namespace Campaign;\npublic sealed class PricingModule { public int[] GetPrices() => []; }");
+
+            var errors = await BuildGate.RunAsync(workspace, useSandbox: true, CancellationToken.None);
+
+            Assert.NotEmpty(errors);
+            Assert.Contains(errors, e => e.Contains(": error "));
+        }
+        finally { Directory.Delete(workspace, recursive: true); }
+    }
+
+    [Fact]
+    public async Task ConformingWorkerPassesTheSandboxedGateOffline()
+    {
+        if (!DockerAvailable) return;
+
+        var workspace = CreateWorkspace();
+        try
+        {
+            File.WriteAllText(Path.Combine(workspace, "PricingModule.cs"),
+                """
+                namespace Campaign;
+                public sealed class PricingModule : IPricingModule
+                {
+                    public int[] GetTiers(ProductSpec spec) => [10, 20, 30];
+                }
+                """);
+
+            var errors = await BuildGate.RunAsync(workspace, useSandbox: true, CancellationToken.None);
+
+            Assert.Empty(errors);
+        }
+        finally { Directory.Delete(workspace, recursive: true); }
+    }
+
+    // C1 regression, reproduced the same way the reviewer did: an artificially starved
+    // pids-limit kills `dotnet build` (fork fails) before it ever prints a line containing
+    // ": error " - verified by hand first ("sh: 1: Cannot fork", exit 2). InterpretResult
+    // must not read that silence as PASSED.
+    [Fact]
+    public async Task PidsLimitKillIsNotSilentlyReadAsPassed()
+    {
+        if (!DockerAvailable) return;
+
+        var workspace = CreateWorkspace();
+        try
+        {
+            File.WriteAllText(Path.Combine(workspace, "PricingModule.cs"),
+                """
+                namespace Campaign;
+                public sealed class PricingModule : IPricingModule
+                {
+                    public int[] GetTiers(ProductSpec spec) => [10, 20, 30];
+                }
+                """);
+
+            var options = BuildGate.SandboxedOptions(workspace) with { PidsLimit = 1 };
+            var result = await SandboxRunner.RunAsync(options,
+                ["sh", "-c", "cp -r /src /tmp/build && cd /tmp/build && dotnet build -nologo --verbosity quiet"],
+                stdin: null, CancellationToken.None);
+
+            Assert.NotEqual(0, result.ExitCode);
+            Assert.NotEmpty(BuildGate.InterpretResult(result));
+        }
+        finally { Directory.Delete(workspace, recursive: true); }
+    }
+}
diff --git a/CodeAct.AgentFramework/Execution/ContainerCodeRunner.cs b/CodeAct.AgentFramework/Execution/ContainerCodeRunner.cs
index be490f5..4da7b97 100644
--- a/CodeAct.AgentFramework/Execution/ContainerCodeRunner.cs
+++ b/CodeAct.AgentFramework/Execution/ContainerCodeRunner.cs
@@ -1,4 +1,5 @@
 using System.Diagnostics;
+using Shared.Sandbox;
 
 namespace CodeAct.AgentFramework.Execution;
 
@@ -10,54 +11,51 @@ namespace CodeAct.AgentFramework.Execution;
 /// mount of the per-run script directory and a bounded tmpfs for build artifacts.
 /// This demonstrates the required isolation boundary; it is NOT a production-grade
 /// sandbox for adversarial or multi-tenant workloads (use a disposable VM/microVM
-/// isolation service for that).
+/// isolation service for that). The isolation boundary itself lives in
+/// <see cref="SandboxRunner"/> (Shared.Sandbox) so other samples can reuse it; this
+/// class owns only what is specific to CodeAct: the sandbox image, per-run script
+/// staging, and mapping <see cref="CodeExecutionOptions"/> onto <see cref="SandboxOptions"/>.
 /// </summary>
 public sealed class ContainerCodeRunner(CodeExecutionOptions options) : IGeneratedCodeRunner
 {
+    private static readonly IReadOnlyList<string> RunScriptCommand = ["dotnet", "run", "/workspace/script.cs"];
+
     /// <summary>True when the runtime CLI exists AND its daemon answers.</summary>
-    public static bool IsAvailable(string containerRuntime)
-    {
-        try
-        {
-            var (exitCode, _, _) = RunRuntimeCommandAsync(containerRuntime,
-                ["version", "--format", "{{.Server.Version}}"], TimeSpan.FromSeconds(10))
-                .GetAwaiter().GetResult();
-            return exitCode == 0;
-        }
-        catch (Exception e) when (e is System.ComponentModel.Win32Exception or PlatformNotSupportedException)
-        {
-            return false; // CLI not on PATH
-        }
-    }
+    public static bool IsAvailable(string containerRuntime) => SandboxRunner.IsAvailable(containerRuntime);
 
     /// <summary>
     /// The whole security posture, as one pure function so tests can pin every flag.
-    /// Deny everything; allow only what `dotnet run script.cs` needs.
+    /// Deny everything; allow only what `dotnet run script.cs` needs. Thin mapping onto
+    /// <see cref="SandboxRunner.BuildRunArguments"/> — the argument construction itself
+    /// lives there now.
     /// </summary>
     public static IReadOnlyList<string> BuildRunArguments(
         string containerName, string runDirectory, CodeExecutionOptions options) =>
-    [
-        "run", "--rm",
-        "--name", containerName,                        // unique name so a timeout can kill THIS container
-        "--network", "none",                            // no network, not even DNS
-        "--read-only",                                  // immutable container filesystem
-        "--cap-drop", "ALL",                            // no Linux capabilities
-        "--security-opt", "no-new-privileges=true",     // setuid binaries cannot escalate
-        "--pids-limit", "128",                          // fork bombs die early
-        "--memory", "1g",                               // enough for Roslyn to compile, nothing runaway
-        "--cpus", "1",
-        "--user", "65532:65532",                        // non-root, no matching user on the host
-        "--tmpfs", "/tmp:rw,exec,nosuid,nodev,size=512m", // the ONLY writable path: bounded, for build
-                                                        // artifacts; exec because the compiled script
-                                                        // binary lives (and must run) here
-        "--mount", $"type=bind,src={runDirectory},dst=/workspace,readonly", // per-run dir only, read-only
-        "--env", "HOME=/tmp",                           // no host env is forwarded; these four are the
-        "--env", "DOTNET_CLI_HOME=/tmp/dotnet",         // complete environment the SDK needs to run
-        "--env", "DOTNET_NOLOGO=1",                     // as an unknown non-root user offline
-        "--env", "DOTNET_CLI_TELEMETRY_OPTOUT=1",
-        options.ContainerImage,
-        "dotnet", "run", "/workspace/script.cs"
-    ];
+        SandboxRunner.BuildRunArguments(ToSandboxOptions(containerName, runDirectory, options), RunScriptCommand);
+
+    private static SandboxOptions ToSandboxOptions(
+        string containerName, string runDirectory, CodeExecutionOptions options) => new(
+        Image: options.ContainerImage,
+        ContainerRuntime: options.ContainerRuntime,
+        Network: false,
+        Memory: "1g",                                    // enough for Roslyn to compile, nothing runaway
+        Cpus: "1",
+        PidsLimit: 128,                                   // fork bombs die early
+        Timeout: options.ExecutionTimeout,
+        MaxOutputCharacters: options.MaxOutputCharacters,
+        Environment: new Dictionary<string, string>       // no host env is forwarded; these four are the
+        {                                                  // complete environment the SDK needs to run
+            ["HOME"] = "/tmp",                             // as an unknown non-root user offline
+            ["DOTNET_CLI_HOME"] = "/tmp/dotnet",
+            ["DOTNET_NOLOGO"] = "1",
+            ["DOTNET_CLI_TELEMETRY_OPTOUT"] = "1",
+        },
+        Mounts: [(runDirectory, "/workspace", true)],      // per-run dir only, read-only
+        ContainerName: containerName,                      // unique name so a timeout can kill THIS container
+        User: "65532:65532",                                // non-root, no matching user on the host
+        Tmpfs: "/tmp:rw,exec,nosuid,nodev,size=512m");      // the ONLY writable path: bounded, for build
+                                                             // artifacts; exec because the compiled script
+                                                             // binary lives (and must run) here
 
     public async Task<ExecutionResult> RunAsync(string sourceCode, CancellationToken cancellationToken)
     {
@@ -82,67 +80,26 @@ await WriteWorldReadableAsync(Path.Combine(runDirectory, "NuGet.config"),
 
             await EnsureImageAsync(cancellationToken);
 
-            using var timeoutCts = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
-            timeoutCts.CancelAfter(options.ExecutionTimeout);
-
-            using var process = StartRuntimeProcess(options.ContainerRuntime,
-                BuildRunArguments(containerName, runDirectory, options));
-            try
-            {
-                var stdoutTask = BoundedReader.ReadBoundedAsync(
-                    process.StandardOutput, options.MaxOutputCharacters, timeoutCts.Token);
-                var stderrTask = BoundedReader.ReadBoundedAsync(
-                    process.StandardError, options.MaxOutputCharacters, timeoutCts.Token);
-
-                await process.WaitForExitAsync(timeoutCts.Token);
-
-                return new ExecutionResult(process.ExitCode, await stdoutTask, await stderrTask, TimedOut: false);
-            }
-            catch (OperationCanceledException) when (!cancellationToken.IsCancellationRequested)
-            {
-                // Timeout, not caller cancellation. Kill by NAME: cancelling the client
-                // process does not guarantee the containerized process has stopped.
-                await KillContainerAsync(containerName);
-                if (!process.HasExited) process.Kill(entireProcessTree: true);
-                return new ExecutionResult(
-                    ExitCode: -1,
-                    StandardOutput: "",
-                    StandardError: "Execution exceeded the configured time limit.",
-                    TimedOut: true);
-            }
-            // Caller cancellation propagates as OperationCanceledException — it is never
-            // converted into an ordinary failure result. The finally still cleans up.
+            var sandboxOptions = ToSandboxOptions(containerName, runDirectory, options);
+            var result = await SandboxRunner.RunAsync(sandboxOptions, RunScriptCommand, stdin: null, cancellationToken);
+            return new ExecutionResult(result.ExitCode, result.StdOut, result.StdErr, result.TimedOut);
         }
         finally
         {
-            await RemoveContainerAsync(containerName);
             try { Directory.Delete(runDirectory, recursive: true); }
             catch (IOException) { }
             catch (UnauthorizedAccessException) { }
         }
     }
 
-    private static async Task WriteWorldReadableAsync(string path, string content, CancellationToken cancellationToken)
-    {
-        await File.WriteAllTextAsync(path, content, cancellationToken);
-        if (!OperatingSystem.IsWindows())
-            File.SetUnixFileMode(path, UnixFileMode.UserRead | UnixFileMode.UserWrite |
-                                       UnixFileMode.GroupRead | UnixFileMode.OtherRead);
-    }
+    private static Task WriteWorldReadableAsync(string path, string content, CancellationToken cancellationToken) =>
+        HostWorkspace.WriteWorldReadableAsync(path, content, cancellationToken);
 
-    private static string CreateRunDirectory(string runId)
-    {
-        var path = Path.Combine(Path.GetTempPath(), "codeact", runId);
-        if (OperatingSystem.IsWindows())
-            return Directory.CreateDirectory(path).FullName;
-
-        // World-readable/traversable so container uid 65532 can read the bind mount.
-        const UnixFileMode mode = UnixFileMode.UserRead | UnixFileMode.UserWrite | UnixFileMode.UserExecute |
-                                  UnixFileMode.GroupRead | UnixFileMode.GroupExecute |
-                                  UnixFileMode.OtherRead | UnixFileMode.OtherExecute;
-        Directory.CreateDirectory(Path.Combine(Path.GetTempPath(), "codeact"), mode);
-        return Directory.CreateDirectory(path, mode).FullName;
-    }
+    /// <summary>The per-run staging directory, world-traversable so container uid 65532 can
+    /// read the bind mount regardless of the operator's umask - see <see cref="HostWorkspace"/>,
+    /// which owns that fix for both this sample and StigmergicCoordination's build gate.</summary>
+    internal static string CreateRunDirectory(string runId) =>
+        HostWorkspace.CreateWorldReadableDirectory(Path.Combine(Path.GetTempPath(), "codeact", runId));
 
     /// <summary>Builds the repo-controlled sandbox image from Sandbox/Dockerfile on first use.</summary>
     private async Task EnsureImageAsync(CancellationToken cancellationToken)
@@ -162,39 +119,24 @@ private async Task EnsureImageAsync(CancellationToken cancellationToken)
                 $"  {options.ContainerRuntime} build -t {options.ContainerImage} CodeAct.AgentFramework/Sandbox\n{buildErr}");
     }
 
-    private async Task KillContainerAsync(string containerName) =>
-        await RunRuntimeCommandAsync(options.ContainerRuntime,
-            ["kill", containerName], TimeSpan.FromSeconds(30));
-
-    private async Task RemoveContainerAsync(string containerName)
-    {
-        // Belt and braces next to --rm; a missing container is the expected happy path.
-        try
-        {
-            await RunRuntimeCommandAsync(options.ContainerRuntime,
-                ["rm", "-f", containerName], TimeSpan.FromSeconds(30));
-        }
-        catch (System.ComponentModel.Win32Exception) { }
-    }
-
-    private static Process StartRuntimeProcess(string containerRuntime, IReadOnlyList<string> arguments)
+    // ponytail: duplicates SandboxRunner's private process-exec helper. `docker image
+    // inspect`/`docker build` aren't sandboxed container runs, so SandboxRunner's public
+    // surface (fixed by the task interface) has no method for them; a ~20-line local
+    // helper is cheaper than adding a new public "run arbitrary runtime command" API
+    // that nothing else needs yet. Promote to a shared helper if a third caller appears.
+    private static async Task<(int ExitCode, string Stdout, string Stderr)> RunRuntimeCommandAsync(
+        string containerRuntime, IReadOnlyList<string> arguments, TimeSpan timeout,
+        CancellationToken cancellationToken = default)
     {
+        using var cts = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+        cts.CancelAfter(timeout);
         var startInfo = new ProcessStartInfo(containerRuntime)
         {
             RedirectStandardOutput = true,
             RedirectStandardError = true
         };
         foreach (var argument in arguments) startInfo.ArgumentList.Add(argument);
-        return Process.Start(startInfo)!;
-    }
-
-    private static async Task<(int ExitCode, string Stdout, string Stderr)> RunRuntimeCommandAsync(
-        string containerRuntime, IReadOnlyList<string> arguments, TimeSpan timeout,
-        CancellationToken cancellationToken = default)
-    {
-        using var cts = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
-        cts.CancelAfter(timeout);
-        using var process = StartRuntimeProcess(containerRuntime, arguments);
+        using var process = Process.Start(startInfo)!;
         var stdoutTask = process.StandardOutput.ReadToEndAsync(cts.Token);
         var stderrTask = process.StandardError.ReadToEndAsync(cts.Token);
         try
diff --git a/CodeAct.AgentFramework/Execution/UnsafeHostCodeRunner.cs b/CodeAct.AgentFramework/Execution/UnsafeHostCodeRunner.cs
index a703178..5592c91 100644
--- a/CodeAct.AgentFramework/Execution/UnsafeHostCodeRunner.cs
+++ b/CodeAct.AgentFramework/Execution/UnsafeHostCodeRunner.cs
@@ -1,4 +1,5 @@
 using System.Diagnostics;
+using Shared.Sandbox;
 
 namespace CodeAct.AgentFramework.Execution;
 
diff --git a/CodeAct.AgentFramework/Program.cs b/CodeAct.AgentFramework/Program.cs
index 15df82c..de63105 100644
--- a/CodeAct.AgentFramework/Program.cs
+++ b/CodeAct.AgentFramework/Program.cs
@@ -67,7 +67,7 @@ findings. Then answer the user from the script output.
 
 return;
 
-async Task<string> ExecuteCSharp(string code)
+async Task<string> ExecuteCSharp(string code, CancellationToken cancellationToken)
 {
     // Models sometimes wrap code in markdown fences despite instructions.
     code = code.Trim();
@@ -84,7 +84,7 @@ async Task<string> ExecuteCSharp(string code)
 
     // The action API is appended below the model's code: local functions may follow the
     // top-level statements, and are callable from them regardless of declaration order.
-    var execution = await runner.RunAsync(code + "\n\n" + ActionApiSource, CancellationToken.None);
+    var execution = await runner.RunAsync(code + "\n\n" + ActionApiSource, cancellationToken);
 
     var result = execution switch
     {
diff --git a/Dockerfile b/Dockerfile
index 256cfde..2bf60d1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,19 +1,11 @@
 # syntax=docker/dockerfile:1
 
-FROM node:24-bookworm-slim AS node
-
 FROM mcr.microsoft.com/dotnet/sdk:10.0
 
-COPY --from=node /usr/local/bin/node /usr/local/bin/node
-COPY --from=node /usr/local/lib/node_modules /usr/local/lib/node_modules
-RUN ln -s /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
-    && ln -s /usr/local/lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx
-
 ENV ASPNETCORE_URLS=http://0.0.0.0:5080 \
     DOTNET_CLI_HOME=/tmp/dotnet \
     DOTNET_CLI_TELEMETRY_OPTOUT=1 \
     DOTNET_NOLOGO=1 \
-    NPM_CONFIG_CACHE=/tmp/npm \
     NUGET_PACKAGES=/app/.nuget/packages
 
 WORKDIR /app
@@ -27,6 +19,6 @@ RUN dotnet restore "Agentic Patterns.slnx" \
 
 EXPOSE 5080
 HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
-    CMD node -e "fetch('http://127.0.0.1:5080/api/patterns').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"
+    CMD curl -fsS http://127.0.0.1:5080/api/patterns >/dev/null || exit 1
 
 ENTRYPOINT ["dotnet", "run", "--no-build", "--project", "PatternExplorer/PatternExplorer.csproj"]
diff --git a/MCP.AgentFramework/McpToolBinding.cs b/MCP.AgentFramework/McpToolBinding.cs
new file mode 100644
index 0000000..11e09fe
--- /dev/null
+++ b/MCP.AgentFramework/McpToolBinding.cs
@@ -0,0 +1,44 @@
+namespace MCP.AgentFramework;
+
+using Shared.Sandbox;
+
+public static class McpToolBinding
+{
+    /// The pinned server image. Built by hand before the run - see MCP.AgentFramework/Sandbox/Dockerfile.
+    public const string ServerImage = "agentic-patterns/mcp-server-everything:2025.8.18";
+
+    /// <summary>
+    /// The sandbox the pinned server runs in. The server speaks stdio, so the container IS the
+    /// transport: no network, no host environment, no credentials, read-only filesystem, dropped
+    /// capabilities, non-root, bounded pids and memory. Every one of those is a
+    /// <see cref="SandboxOptions"/> DEFAULT - this sample opts out of none of them, which is what
+    /// lets README.md and PatternExplorer/patterns/MCP.md say "the identical locked-down-container
+    /// boundary CodeAct uses" without qualification. Lives here rather than inline in each
+    /// Program.cs so both flavors share one definition and a test can pin it.
+    ///
+    /// Named explicitly (not left to SandboxRunner.RunAsync's own naming, which this stdio path
+    /// doesn't go through) so the container can be torn down by name if the process is killed -
+    /// SIGKILLing the `docker run` CLI does not stop the daemon-side container.
+    /// ponytail: no automatic kill-by-name wired up on this path (McpClient owns the process, not
+    /// RunAsync) - add it if this sample stops being a short-lived demo.
+    /// </summary>
+    public static SandboxOptions Sandbox() => new(
+        ServerImage, Network: false, Memory: "256m", PidsLimit: 64, Interactive: true,
+        ContainerName: $"mcp-sandbox-{Guid.NewGuid():N}");
+
+    /// Discovery and authorization are separate steps: discovering a tool never grants it.
+    /// Fails closed - a missing allowlisted tool means the server is not the one we pinned.
+    /// Takes a HashSet (not IReadOnlySet) so its own Comparer governs both the match and the
+    /// missing-check - one comparer for the whole function, not the set's for one direction
+    /// and the default for the other.
+    public static IReadOnlyList<string> SelectAuthorized(IEnumerable<string> discovered,
+        HashSet<string> allowed)
+    {
+        var found = discovered.Where(allowed.Contains).Distinct(allowed.Comparer).ToList();
+        var missing = allowed.Except(found, allowed.Comparer).ToList();
+        if (missing.Count > 0)
+            throw new InvalidOperationException(
+                $"The MCP server does not advertise the required tool(s): {string.Join(", ", missing)}.");
+        return found;
+    }
+}
diff --git a/MCP.AgentFramework/Program.cs b/MCP.AgentFramework/Program.cs
index 84bba2e..91e75db 100644
--- a/MCP.AgentFramework/Program.cs
+++ b/MCP.AgentFramework/Program.cs
@@ -1,27 +1,47 @@
+using MCP.AgentFramework;
 using Microsoft.Agents.AI;
 using Microsoft.Extensions.AI;
 using ModelContextProtocol.Client;
 using Shared;
+using Shared.Sandbox;
 
-// 1) Connect to the official MCP demo server (stdio, no credentials needed)
-await using var mcpClient = await McpClient.CreateAsync(
-    new StdioClientTransport(new StdioClientTransportOptions
-    {
-        Name = "MCPServer",
-        Command = "npx",
-        Arguments = ["-y", "@modelcontextprotocol/server-everything"]
-    }));
+var allowed = new HashSet<string>(["add", "echo"], StringComparer.Ordinal);
 
-// 2) Discover tools
-var tools = await mcpClient.ListToolsAsync().ConfigureAwait(false);
-Console.WriteLine($"MCP tools: {string.Join(", ", tools.Select(t => t.Name))}");
+// Fail closed: no sandbox, no MCP server. Unlike CodeAct, this sample has no host-execution
+// fallback at all - there is nothing to opt into, so the message must not imply otherwise.
+// It names only Docker because that is the only runtime this sample can actually use: unlike
+// CodeAct, which takes the runtime from CodeExecutionOptions.ContainerRuntime, the command
+// below is hardcoded. Advertising Podman here would leave a podman-only user installing
+// exactly what the message asked for and getting the identical message forever.
+if (!SandboxRunner.IsAvailable("docker"))
+{
+    Console.Error.WriteLine(
+        "Docker is not available. This sample runs a third-party MCP server, which is " +
+        "untrusted code; it will not be started on the host. Install Docker to run it.");
+    return 1;
+}
+
+// Every isolation flag - including the non-root --user default the docs promise - comes from
+// McpToolBinding.Sandbox(); this sample opts out of nothing. See its doc comment.
+var sandbox = McpToolBinding.Sandbox();
+await using var mcpClient = await McpClient.CreateAsync(new StdioClientTransport(new StdioClientTransportOptions
+{
+    Name = "MCPServer",
+    Command = "docker",
+    Arguments = [.. SandboxRunner.BuildRunArguments(sandbox, [])],
+}));
+
+var discovered = await mcpClient.ListToolsAsync();
+Console.WriteLine($"Discovered: {string.Join(", ", discovered.Select(t => t.Name))}");
+var authorized = McpToolBinding.SelectAuthorized(discovered.Select(t => t.Name), allowed).ToHashSet();
+Console.WriteLine($"Bound to the agent: {string.Join(", ", authorized)}");
 
-// 3) McpClientTool derives from AIFunction, so MCP tools plug straight into the agent
 var agent = new ChatClientAgent(Settings.ChatClient,
     "Use MCP tools when needed. Be concise and cite tool results in your reasoning.",
-    tools: [.. tools.Cast<AITool>()]);
+    tools: [.. discovered.Where(t => authorized.Contains(t.Name)).Cast<AITool>()]);
 
 var prompt = "Use the 'add' tool to compute 1234 + 5678, then use the 'echo' tool to repeat the result.";
 
 var response = await agent.RunAsync(prompt);
 Console.WriteLine(response);
+return 0;
diff --git a/MCP.AgentFramework/Sandbox/Dockerfile b/MCP.AgentFramework/Sandbox/Dockerfile
new file mode 100644
index 0000000..401cfd1
--- /dev/null
+++ b/MCP.AgentFramework/Sandbox/Dockerfile
@@ -0,0 +1,16 @@
+# Sandbox image for the third-party MCP demo server.
+#
+# The upstream sample spawns `npx -y @modelcontextprotocol/server-everything`, which
+# downloads an UNPINNED package at run time and executes it on the host with the
+# application's environment. This image replaces that: the exact server version is
+# baked in at BUILD time (the only moment network access is legitimate), so the
+# sandbox can run with `--network none` and no host credentials at all. The security
+# boundary itself is enforced at `docker run` time by
+# Shared.Sandbox.SandboxRunner.BuildRunArguments (no network, read-only rootfs,
+# dropped capabilities, non-root user, pids/memory/cpu limits).
+FROM node:22-alpine
+ARG SERVER_VERSION=2025.8.18
+RUN npm install -g @modelcontextprotocol/server-everything@${SERVER_VERSION} \
+ && addgroup -S mcp && adduser -S -G mcp mcp
+USER mcp
+ENTRYPOINT ["mcp-server-everything"]
diff --git a/MCP.SemanticKernel/McpToolBinding.cs b/MCP.SemanticKernel/McpToolBinding.cs
new file mode 100644
index 0000000..1a28bf2
--- /dev/null
+++ b/MCP.SemanticKernel/McpToolBinding.cs
@@ -0,0 +1,44 @@
+namespace MCP.SemanticKernel;
+
+using Shared.Sandbox;
+
+public static class McpToolBinding
+{
+    /// The pinned server image. Built by hand before the run - see MCP.AgentFramework/Sandbox/Dockerfile.
+    public const string ServerImage = "agentic-patterns/mcp-server-everything:2025.8.18";
+
+    /// <summary>
+    /// The sandbox the pinned server runs in. The server speaks stdio, so the container IS the
+    /// transport: no network, no host environment, no credentials, read-only filesystem, dropped
+    /// capabilities, non-root, bounded pids and memory. Every one of those is a
+    /// <see cref="SandboxOptions"/> DEFAULT - this sample opts out of none of them, which is what
+    /// lets README.md and PatternExplorer/patterns/MCP.md say "the identical locked-down-container
+    /// boundary CodeAct uses" without qualification. Lives here rather than inline in each
+    /// Program.cs so both flavors share one definition and a test can pin it.
+    ///
+    /// Named explicitly (not left to SandboxRunner.RunAsync's own naming, which this stdio path
+    /// doesn't go through) so the container can be torn down by name if the process is killed -
+    /// SIGKILLing the `docker run` CLI does not stop the daemon-side container.
+    /// ponytail: no automatic kill-by-name wired up on this path (McpClient owns the process, not
+    /// RunAsync) - add it if this sample stops being a short-lived demo.
+    /// </summary>
+    public static SandboxOptions Sandbox() => new(
+        ServerImage, Network: false, Memory: "256m", PidsLimit: 64, Interactive: true,
+        ContainerName: $"mcp-sandbox-{Guid.NewGuid():N}");
+
+    /// Discovery and authorization are separate steps: discovering a tool never grants it.
+    /// Fails closed - a missing allowlisted tool means the server is not the one we pinned.
+    /// Takes a HashSet (not IReadOnlySet) so its own Comparer governs both the match and the
+    /// missing-check - one comparer for the whole function, not the set's for one direction
+    /// and the default for the other.
+    public static IReadOnlyList<string> SelectAuthorized(IEnumerable<string> discovered,
+        HashSet<string> allowed)
+    {
+        var found = discovered.Where(allowed.Contains).Distinct(allowed.Comparer).ToList();
+        var missing = allowed.Except(found, allowed.Comparer).ToList();
+        if (missing.Count > 0)
+            throw new InvalidOperationException(
+                $"The MCP server does not advertise the required tool(s): {string.Join(", ", missing)}.");
+        return found;
+    }
+}
diff --git a/MCP.SemanticKernel/Program.cs b/MCP.SemanticKernel/Program.cs
index d9c4135..0040013 100644
--- a/MCP.SemanticKernel/Program.cs
+++ b/MCP.SemanticKernel/Program.cs
@@ -1,32 +1,51 @@
+using MCP.SemanticKernel;
 using Microsoft.SemanticKernel;
 using Microsoft.SemanticKernel.Agents;
 using Microsoft.SemanticKernel.Connectors.OpenAI;
 using ModelContextProtocol.Client;
 using Shared;
+using Shared.Sandbox;
 
 #pragma warning disable SKEXP0001
 
-await using var mcpClient = await McpClient.CreateAsync(
-    new StdioClientTransport(new StdioClientTransportOptions
-    {
-        Name = "MCPServer",
-        Command = "npx",
-        // Official MCP demo server: runs over stdio, needs no credentials.
-        Arguments = ["-y", "@modelcontextprotocol/server-everything"]
-    }));
+var allowed = new HashSet<string>(["add", "echo"], StringComparer.Ordinal);
 
-// 2) Discover tools
-var tools = await mcpClient.ListToolsAsync().ConfigureAwait(false);
+// Fail closed: no sandbox, no MCP server. Unlike CodeAct, this sample has no host-execution
+// fallback at all - there is nothing to opt into, so the message must not imply otherwise.
+// It names only Docker because that is the only runtime this sample can actually use: unlike
+// CodeAct, which takes the runtime from CodeExecutionOptions.ContainerRuntime, the command
+// below is hardcoded. Advertising Podman here would leave a podman-only user installing
+// exactly what the message asked for and getting the identical message forever.
+if (!SandboxRunner.IsAvailable("docker"))
+{
+    Console.Error.WriteLine(
+        "Docker is not available. This sample runs a third-party MCP server, which is " +
+        "untrusted code; it will not be started on the host. Install Docker to run it.");
+    return 1;
+}
 
-// 3) Register MCP tools as SK functions (agent can tool-call)
-var kernel = Settings.Kernel;
+// Every isolation flag - including the non-root --user default the docs promise - comes from
+// McpToolBinding.Sandbox(); this sample opts out of nothing. See its doc comment.
+var sandbox = McpToolBinding.Sandbox();
+await using var mcpClient = await McpClient.CreateAsync(new StdioClientTransport(new StdioClientTransportOptions
+{
+    Name = "MCPServer",
+    Command = "docker",
+    Arguments = [.. SandboxRunner.BuildRunArguments(sandbox, [])],
+}));
 
-// This pattern (MCP tools -> Kernel functions) is used in the official SK MCP sample.
+var discovered = await mcpClient.ListToolsAsync().ConfigureAwait(false);
+Console.WriteLine($"Discovered: {string.Join(", ", discovered.Select(t => t.Name))}");
+var authorized = McpToolBinding.SelectAuthorized(discovered.Select(t => t.Name), allowed).ToHashSet();
+Console.WriteLine($"Bound to the agent: {string.Join(", ", authorized)}");
+
+// Register MCP tools as SK functions (agent can tool-call) - allowlisted tools only.
+var kernel = Settings.Kernel;
 kernel.Plugins.AddFromFunctions(
     "McpTools",
-    tools.Select(aiFunction => aiFunction.AsKernelFunction()));
+    discovered.Where(t => authorized.Contains(t.Name)).Select(aiFunction => aiFunction.AsKernelFunction()));
 
-// 4) Enable auto function calling
+// Enable auto function calling
 var exec = new OpenAIPromptExecutionSettings
 {
     FunctionChoiceBehavior = FunctionChoiceBehavior.Auto(
@@ -36,7 +55,7 @@
         })
 };
 
-// 5) Agent uses MCP tools as needed
+// Agent uses MCP tools as needed
 var agent = new ChatCompletionAgent
 {
     Name = "McpAgent",
@@ -48,4 +67,5 @@
 var prompt = "Use the 'add' tool to compute 1234 + 5678, then use the 'echo' tool to repeat the result.";
 
 await foreach (var response in agent.InvokeAsync(prompt))
-    Console.WriteLine(response.Message.Content);
\ No newline at end of file
+    Console.WriteLine(response.Message.Content);
+return 0;
diff --git a/PatternExplorer/Catalog.cs b/PatternExplorer/Catalog.cs
index b5f0539..1d0eac5 100644
--- a/PatternExplorer/Catalog.cs
+++ b/PatternExplorer/Catalog.cs
@@ -7,14 +7,26 @@ namespace PatternExplorer;
 /// <param name="Interactive">The sample reads from stdin, so the UI shows an input box.</param>
 /// <param name="Server">Optional companion project to start first (A2A).</param>
 /// <param name="ServerPort">Port to poll before starting the main project.</param>
-/// <param name="Note">Extra requirement shown next to the run button (e.g. "needs npx").</param>
+/// <param name="Note">Extra requirement shown next to the run button (e.g. "Needs Docker").</param>
 public record PatternProject(
     string Flavor,
     string Path,
     bool Interactive = false,
     string? Server = null,
     int ServerPort = 0,
-    string? Note = null);
+    string? Note = null)
+{
+    /// Environment variable names copied from Explorer's own environment into the child process,
+    /// in addition to PATH/HOME/DOTNET_* which `dotnet run` always needs. Defaults to the four
+    /// Azure OpenAI settings (see Shared/AzureOpenAISettings.cs) most samples need to run at all.
+    public IReadOnlyList<string> EnvironmentAllowlist { get; init; } =
+    [
+        "AzureOpenAi__ChatModelDeployment",
+        "AzureOpenAi__EmbeddingModelDeployment",
+        "AzureOpenAi__Endpoint",
+        "AzureOpenAi__ApiKey"
+    ];
+}
 
 /// <param name="Risk">Optional warning shown above the Run button (e.g. "Runs model-written code on this machine.").</param>
 public record PatternMeta(string Title, string Summary, string Category, PatternProject[] Projects, string? Risk = null);
diff --git a/PatternExplorer/PatternExplorer.csproj b/PatternExplorer/PatternExplorer.csproj
index 5563a73..e904fe6 100644
--- a/PatternExplorer/PatternExplorer.csproj
+++ b/PatternExplorer/PatternExplorer.csproj
@@ -4,4 +4,8 @@
         <RootNamespace>PatternExplorer</RootNamespace>
     </PropertyGroup>
 
+    <ItemGroup>
+        <InternalsVisibleTo Include="AgenticPatterns.Tests"/>
+    </ItemGroup>
+
 </Project>
diff --git a/PatternExplorer/Program.cs b/PatternExplorer/Program.cs
index f15d9b3..732084d 100644
--- a/PatternExplorer/Program.cs
+++ b/PatternExplorer/Program.cs
@@ -8,6 +8,17 @@
 builder.WebHost.UseUrls(Environment.GetEnvironmentVariable("ASPNETCORE_URLS") ?? "http://localhost:5080");
 
 var app = builder.Build();
+
+// Everything the page needs (marked/mermaid vendored under wwwroot, the doc's own <style>
+// attributes) is same-origin or inline style - see the report for what was actually verified
+// against the live app before shipping this policy. Nothing needed loosening: no 'unsafe-eval',
+// no worker-src/blob: - the vendored mermaid bundle renders diagrams under this policy as-is.
+app.Use(async (context, next) =>
+{
+    context.Response.Headers["Content-Security-Policy"] = SecurityHeaders.ContentSecurityPolicy;
+    await next();
+});
+
 app.UseDefaultFiles();
 // Local authoring tool: never cache, so edits to the page or the pattern files show up on refresh.
 app.UseStaticFiles(new StaticFileOptions
@@ -15,8 +26,12 @@
     OnPrepareResponse = context => context.Context.Response.Headers.CacheControl = "no-store"
 });
 
+// EnvironmentAllowlist is server-side plumbing (what the child process is allowed to inherit) -
+// project it out of the wire shape rather than exposing "what does the server forward" to the page.
+object ProjectForWire(PatternProject p) => new { p.Flavor, p.Path, p.Interactive, p.Server, p.ServerPort, p.Note };
+
 app.MapGet("/api/patterns", () => Catalog.Load(patternsDir)
-    .Select(p => new { p.Id, p.Meta.Title, p.Meta.Summary, p.Meta.Category, p.Meta.Projects, p.Meta.Risk }));
+    .Select(p => new { p.Id, p.Meta.Title, p.Meta.Summary, p.Meta.Category, Projects = p.Meta.Projects.Select(ProjectForWire), p.Meta.Risk }));
 
 app.MapGet("/api/patterns/{id}", (string id) =>
 {
@@ -29,7 +44,7 @@
         pattern.Meta.Title,
         pattern.Meta.Summary,
         pattern.Meta.Category,
-        pattern.Meta.Projects,
+        Projects = pattern.Meta.Projects.Select(ProjectForWire),
         pattern.Meta.Risk,
         pattern.Body,
         Sources = pattern.Meta.Projects.ToDictionary(
@@ -51,6 +66,14 @@
 
 app.MapGet("/api/run", async (HttpContext context, string id, string flavor) =>
 {
+    // This GET starts a process and spends money. Nothing else on the page does, so it is the
+    // one endpoint a cross-site <img>/<script>/<link> could abuse - see SecurityHeaders.
+    if (SecurityHeaders.IsCrossSiteRequest(context.Request.Headers["Sec-Fetch-Site"]))
+    {
+        context.Response.StatusCode = 403;
+        return;
+    }
+
     var project = Catalog.Load(patternsDir).FirstOrDefault(p => p.Id == id)?
         .Meta.Projects.FirstOrDefault(p => p.Flavor == flavor);
     if (project is null)
@@ -59,13 +82,30 @@
         return;
     }
 
+    RunSession session;
+    try
+    {
+        session = RunSession.Start(repoRoot, project);
+    }
+    catch (InvalidOperationException ex)
+    {
+        context.Response.StatusCode = 429;
+        await context.Response.WriteAsync(ex.Message);
+        return;
+    }
+
     context.Response.Headers.ContentType = "text/event-stream";
     context.Response.Headers.CacheControl = "no-cache";
     context.Response.Headers["X-Accel-Buffering"] = "no";
 
-    var session = RunSession.Start(repoRoot, project);
     try
     {
+        // The id/token pair the client needs to reach /api/runs/{id}/input and /cancel - sent as
+        // the first event so a single GET both starts the run and hands out its credentials.
+        await context.Response.WriteAsync(
+            $"event: session\ndata: {JsonSerializer.Serialize(new { session.Id, session.Token }, JsonSerializerOptions.Web)}\n\n");
+        await context.Response.Body.FlushAsync();
+
         await foreach (var chunk in session.Reader.ReadAllAsync(context.RequestAborted))
         {
             await context.Response.WriteAsync($"data: {JsonSerializer.Serialize(chunk, JsonSerializerOptions.Web)}\n\n");
@@ -82,16 +122,22 @@
     }
 });
 
-app.MapPost("/api/run/input", async (HttpContext context) =>
+app.MapPost("/api/runs/{id}/input", async (HttpContext context, string id) =>
 {
+    var session = RunSession.TryGet(id, context.Request.Headers["X-Run-Token"].ToString());
+    if (session is null) return Results.NotFound();
+
     using var reader = new StreamReader(context.Request.Body);
-    RunSession.Current?.SendInput((await reader.ReadToEndAsync()).TrimEnd('\n'));
+    session.SendInput((await reader.ReadToEndAsync()).TrimEnd('\n'));
     return Results.Ok();
 });
 
-app.MapPost("/api/run/cancel", () =>
+app.MapPost("/api/runs/{id}/cancel", (string id, HttpContext context) =>
 {
-    RunSession.Current?.Cancel();
+    var session = RunSession.TryGet(id, context.Request.Headers["X-Run-Token"].ToString());
+    if (session is null) return Results.NotFound();
+
+    session.Cancel();
     return Results.Ok();
 });
 
diff --git a/PatternExplorer/RunSession.cs b/PatternExplorer/RunSession.cs
index 7901c40..9c7fb60 100644
--- a/PatternExplorer/RunSession.cs
+++ b/PatternExplorer/RunSession.cs
@@ -1,5 +1,8 @@
+using System.Collections.Concurrent;
 using System.Diagnostics;
 using System.Net.Sockets;
+using System.Security.Cryptography;
+using System.Text;
 using System.Threading.Channels;
 
 namespace PatternExplorer;
@@ -8,42 +11,85 @@ namespace PatternExplorer;
 /// <param name="T">Raw text chunk (not line-buffered, so `Console.Write` prompts show up).</param>
 public record Chunk(string S, string T);
 
-/// Runs one sample at a time as a child `dotnet run` and streams its console output.
+/// Runs one sample as a child `dotnet run` and streams its console output. One instance per run,
+/// looked up by (id, token) so concurrent tabs don't fight over a single global.
 public sealed class RunSession
 {
-    // ponytail: one run at a time, so a static current session is all the bookkeeping needed.
-    public static RunSession? Current { get; private set; }
-
-    readonly Channel<Chunk> _channel = Channel.CreateUnbounded<Chunk>();
+    // ponytail: a dictionary keyed by run id, capped at MaxLiveRuns and guarded by a single lock
+    // so the count-then-add is actually atomic. A single-user local tool does not need a
+    // scheduler; it does need two tabs not to fight. Upgrade to a real queue/scheduler if
+    // Explorer ever grows multi-user or needs to run more than a handful of samples at once.
+    const int MaxLiveRuns = 8;
+    static readonly ConcurrentDictionary<string, RunSession> Runs = new(StringComparer.Ordinal);
+    static readonly object RunsLock = new();
+
+    static readonly TimeSpan MaxRuntime = TimeSpan.FromMinutes(15);
+    const long MaxOutputBytes = 4 * 1024 * 1024;
+
+    public string Id { get; } = Guid.NewGuid().ToString("N");
+    public string Token { get; } = Convert.ToHexString(RandomNumberGenerator.GetBytes(16));
+
+    readonly Channel<Chunk> _channel = Channel.CreateBounded<Chunk>(
+        new BoundedChannelOptions(4096) { FullMode = BoundedChannelFullMode.DropOldest });
     readonly CancellationTokenSource _cts = new();
     readonly List<Process> _processes = [];
     StreamWriter? _input;
+    long _outputBytes;
+    int _outputLimitHit;
 
     public ChannelReader<Chunk> Reader => _channel.Reader;
 
+    // Test seam: lets tests write chunks and observe drop-oldest behavior without spawning a process.
+    internal ChannelWriter<Chunk> Writer => _channel.Writer;
+
+    // Test seam: cancellation is otherwise unobservable from outside the session. Named IsCancelled
+    // (not CancellationToken) so `CancellationToken.None` below keeps meaning the BCL type.
+    internal bool IsCancelled => _cts.IsCancellationRequested;
+
+    public static RunSession? TryGet(string id, string token) =>
+        Runs.TryGetValue(id, out var session) &&
+        CryptographicOperations.FixedTimeEquals(
+            Encoding.UTF8.GetBytes(session.Token), Encoding.UTF8.GetBytes(token))
+            ? session : null;
+
     public static RunSession Start(string repoRoot, PatternProject project)
     {
-        Current?.Cancel();
         var session = new RunSession();
-        Current = session;
+        Register(session);
         _ = Task.Run(() => session.RunAsync(repoRoot, project));
         return session;
     }
 
+    // Registration and removal are split out from Start/RunAsync so tests can exercise session
+    // lifetime (lookup, isolation, the live-run cap) without ever spawning `dotnet run`.
+    internal static void Register(RunSession session)
+    {
+        lock (RunsLock)
+        {
+            if (Runs.Count >= MaxLiveRuns)
+                throw new InvalidOperationException($"Too many live runs (max {MaxLiveRuns}). Cancel one and retry.");
+            Runs[session.Id] = session;
+        }
+    }
+
+    internal static void Unregister(RunSession session) => Runs.TryRemove(session.Id, out _);
+
     async Task RunAsync(string repoRoot, PatternProject project)
     {
         try
         {
+            _cts.CancelAfter(MaxRuntime);
+
             if (project.Server is not null)
             {
                 Emit("sys", $"dotnet run --project {project.Server}");
-                StartProcess(repoRoot, project.Server, "out");
+                StartProcess(repoRoot, project, project.Server, "out");
                 await WaitForPortAsync(project.ServerPort, _cts.Token);
                 Emit("sys", $"server is listening on port {project.ServerPort}");
             }
 
             Emit("sys", $"dotnet run --project {project.Path}");
-            var main = StartProcess(repoRoot, project.Path, "out");
+            var main = StartProcess(repoRoot, project, project.Path, "out");
             _input = main.StandardInput;
 
             await main.WaitForExitAsync(_cts.Token);
@@ -62,10 +108,11 @@ async Task RunAsync(string repoRoot, PatternProject project)
         {
             KillAll();
             _channel.Writer.TryComplete();
+            Unregister(this);
         }
     }
 
-    Process StartProcess(string repoRoot, string projectPath, string tag)
+    Process StartProcess(string repoRoot, PatternProject project, string projectPath, string tag)
     {
         var directory = Path.Combine(repoRoot, projectPath);
         var info = new ProcessStartInfo("dotnet")
@@ -78,6 +125,8 @@ Process StartProcess(string repoRoot, string projectPath, string tag)
             UseShellExecute = false
         };
 
+        ApplyChildEnvironment(info.Environment, project);
+
         var process = Process.Start(info) ?? throw new InvalidOperationException("dotnet run did not start.");
         lock (_processes) _processes.Add(process);
 
@@ -86,6 +135,34 @@ Process StartProcess(string repoRoot, string projectPath, string tag)
         return process;
     }
 
+    /// The sample gets only what it needs to run, not Explorer's whole environment (which may hold
+    /// credentials for other tools). `dotnet run` itself needs PATH/HOME/DOTNET_*.
+    /// Test seam: the allowlist is the entire point of the child-process isolation, and
+    /// StartProcess is otherwise only reachable through Start/RunAsync, which spawns a real
+    /// `dotnet run`. Taking the dictionary lets a test assert the computed child environment
+    /// without a process (see RunSessionTests).
+    internal static void ApplyChildEnvironment(IDictionary<string, string?> environment, PatternProject project)
+    {
+        environment.Clear();
+        foreach (var name in HostEnvironmentNamesForDotnetRun())
+            CopyIfSet(environment, name);
+        foreach (var name in project.EnvironmentAllowlist)
+            CopyIfSet(environment, name);
+    }
+
+    // ponytail: PATH/HOME/DOTNET_* is what `dotnet run` needs on Linux/macOS, which is all this
+    // repo targets (see README). Windows would also need USERPROFILE/APPDATA/SystemRoot/TEMP -
+    // add them here if Explorer ever needs to run there.
+    static IEnumerable<string> HostEnvironmentNamesForDotnetRun() =>
+        Environment.GetEnvironmentVariables().Keys.Cast<string>()
+            .Where(name => name is "PATH" or "HOME" || name.StartsWith("DOTNET_", StringComparison.Ordinal));
+
+    static void CopyIfSet(IDictionary<string, string?> environment, string name)
+    {
+        var value = Environment.GetEnvironmentVariable(name);
+        if (value is not null) environment[name] = value;
+    }
+
     // Character-level, not line-level: `Console.Write("Approve? (y/n): ")` must reach the browser
     // before the sample blocks on Console.ReadLine.
     async Task PumpAsync(StreamReader reader, string tag)
@@ -93,8 +170,21 @@ async Task PumpAsync(StreamReader reader, string tag)
         var buffer = new char[1024];
         while (true)
         {
+            if (Volatile.Read(ref _outputLimitHit) != 0) return;
+
             var count = await reader.ReadAsync(buffer);
             if (count == 0) return;
+
+            if (Interlocked.Add(ref _outputBytes, Encoding.UTF8.GetByteCount(buffer, 0, count)) > MaxOutputBytes)
+            {
+                if (Interlocked.Exchange(ref _outputLimitHit, 1) == 0)
+                {
+                    Emit("sys", "output limit reached, run cancelled");
+                    _cts.Cancel();
+                }
+                return;
+            }
+
             Emit(tag, new string(buffer, 0, count));
         }
     }
diff --git a/PatternExplorer/SecurityHeaders.cs b/PatternExplorer/SecurityHeaders.cs
new file mode 100644
index 0000000..c8fb394
--- /dev/null
+++ b/PatternExplorer/SecurityHeaders.cs
@@ -0,0 +1,26 @@
+namespace PatternExplorer;
+
+// Pulled out of Program.cs so a test can assert the header value without a WebApplicationFactory
+// (not available in this environment - see AgenticPatterns.Tests/SecurityHeadersTests.cs).
+internal static class SecurityHeaders
+{
+    public const string ContentSecurityPolicy =
+        "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; " +
+        "img-src 'self' data:; connect-src 'self'; base-uri 'self'; form-action 'self'; " +
+        "frame-ancestors 'none'";
+
+    /// <summary>
+    /// True when the browser told us the request came from another site. `GET /api/run` starts a
+    /// child process and burns billed model calls, so an `&lt;img src="http://localhost:5080/api/run?
+    /// id=CodeAct&amp;flavor=AgentFramework"&gt;` on any page the user happens to visit must not be
+    /// able to trigger one - and CSP `frame-ancestors`/`form-action` do not stop a cross-origin GET.
+    /// The page's own EventSource sends `same-origin`; a typed URL sends `none`.
+    /// ponytail: a header check is the whole CSRF defence. Clients that send no Sec-Fetch-Site at
+    /// all (curl, pre-2020 browsers) are let through, which is fine for a single-user localhost
+    /// authoring tool and costs one `if`. Upgrade path: require the same per-run token `/input` and
+    /// `/cancel` already use - i.e. a real double-submit - if Explorer is ever exposed beyond
+    /// localhost.
+    /// </summary>
+    public static bool IsCrossSiteRequest(string? secFetchSite) =>
+        !string.IsNullOrEmpty(secFetchSite) && secFetchSite is not ("same-origin" or "none");
+}
diff --git a/PatternExplorer/patterns/CodeAct.md b/PatternExplorer/patterns/CodeAct.md
index d57170a..fef1d08 100644
--- a/PatternExplorer/patterns/CodeAct.md
+++ b/PatternExplorer/patterns/CodeAct.md
@@ -4,7 +4,13 @@
   "summary": "One code-execution tool instead of many bound tools — intermediate results stay inside the script.",
   "category": "Orchestration",
   "risk": "Executes model-written C# in a locked-down local container (no network, read-only, non-root, resource limits); fails closed without Docker/Podman. Host execution requires an explicit double opt-in.",
-  "projects": [ { "flavor": "AgentFramework", "path": "CodeAct.AgentFramework" } ]
+  "projects": [
+    { "flavor": "AgentFramework", "path": "CodeAct.AgentFramework", "environmentAllowlist": [
+      "AzureOpenAi__ChatModelDeployment", "AzureOpenAi__EmbeddingModelDeployment",
+      "AzureOpenAi__Endpoint", "AzureOpenAi__ApiKey",
+      "AGENTIC_PATTERNS_ALLOW_UNSAFE_HOST_EXECUTION", "AGENTIC_PATTERNS_ACKNOWLEDGE_UNSAFE_CODE_EXECUTION"
+    ] }
+  ]
 }
 ---
 
diff --git a/PatternExplorer/patterns/MCP.md b/PatternExplorer/patterns/MCP.md
index 86267b0..9a0e11d 100644
--- a/PatternExplorer/patterns/MCP.md
+++ b/PatternExplorer/patterns/MCP.md
@@ -1,12 +1,12 @@
 ---
 {
   "title": "Model Context Protocol",
-  "summary": "Discover tools from an external MCP server at runtime instead of compiling them in.",
+  "summary": "Discover tools from a pinned, sandboxed MCP server at runtime, but bind only an explicit allowlist.",
   "category": "Orchestration",
-  "risk": "Downloads and runs an external MCP server via npx (unpinned); its tools act with your local privileges.",
+  "risk": "Runs a third-party MCP server; discovery and authorization are kept separate so only an explicit allowlist is ever bound.",
   "projects": [
-    { "flavor": "AgentFramework", "path": "MCP.AgentFramework", "note": "Needs npx on PATH - the MCP server is fetched with npx on first run." },
-    { "flavor": "SemanticKernel", "path": "MCP.SemanticKernel", "note": "Needs npx on PATH - the MCP server is fetched with npx on first run." }
+    { "flavor": "AgentFramework", "path": "MCP.AgentFramework", "note": "Needs Docker (this sample hardcodes the docker CLI - only CodeAct takes the runtime from an option), and the sandbox image built first (docker build -t agentic-patterns/mcp-server-everything:2025.8.18 MCP.AgentFramework/Sandbox) - unlike CodeAct, this sample does not build it for you." },
+    { "flavor": "SemanticKernel", "path": "MCP.SemanticKernel", "note": "Needs Docker (this sample hardcodes the docker CLI - only CodeAct takes the runtime from an option), and the sandbox image built first (docker build -t agentic-patterns/mcp-server-everything:2025.8.18 MCP.AgentFramework/Sandbox) - unlike CodeAct, this sample does not build it for you." }
   ]
 }
 ---
@@ -34,17 +34,28 @@ untrusted instruction source.
 
 ## How the demo works
 
-Both samples spawn the official reference server, `@modelcontextprotocol/server-everything`, over
-stdio via `npx -y` — no credentials needed, but **npx must be on PATH** and the first run
-downloads the package. They call `ListToolsAsync()`, register everything it returns with the
-agent, and send one prompt: *"Use the 'add' tool to compute 1234 + 5678, then use the 'echo' tool
-to repeat the result."* Two chained calls against tools that were unknown at compile time.
+Build the sandbox image once before running either flavor —
+`docker build -t agentic-patterns/mcp-server-everything:2025.8.18 MCP.AgentFramework/Sandbox`.
+Unlike **CodeAct**, this sample does **not** build its image automatically on first run; without
+it, `docker run` exits 125 and the stdio transport dies on a pipe nothing is writing to.
+
+Both samples run the official reference server, `@modelcontextprotocol/server-everything`, over
+stdio — but inside the same locked-down local container the **CodeAct** sample uses, not on the
+host. They call `ListToolsAsync()`, but unlike the pre-fix version they do **not** register
+everything the server returns: discovery and authorization are two separate steps, and only an
+explicit allowlist (`add`, `echo`) is bound to the agent. Then they send one prompt: *"Use the
+'add' tool to compute 1234 + 5678, then use the 'echo' tool to repeat the result."* Two chained
+calls against tools that were unknown at compile time — and unreachable if they weren't
+allowlisted.
 
 ```mermaid
 flowchart LR
-    P[Program starts] --> S[npx spawns MCP server<br/>server-everything over stdio]
-    S --> L[ListToolsAsync]
-    L --> A[Agent registered with<br/>discovered tools]
+    P[Program starts] --> D{Docker<br/>available?}
+    D -- no --> X[Fail closed - exit]
+    D -- yes --> S[docker run spawns MCP server<br/>server-everything over stdio]
+    S --> L[ListToolsAsync: many tools]
+    L --> AL[SelectAuthorized:<br/>allowlist add, echo only]
+    AL --> A[Agent registered with<br/>allowlisted tools only]
     A -->|add 1234 and 5678| S
     A -->|echo the result| S
     S --> R[Final answer 6912]
@@ -57,25 +68,75 @@ into the `ChatClientAgent` constructor. Semantic Kernel converts each one with
 `FunctionChoiceBehavior.Auto` with `RetainArgumentTypes = true` — without that, the numeric
 arguments reach the `add` tool as strings and the call fails schema validation.
 
+## Security: pin, sandbox, and allowlist the server
+
+An MCP server is a third-party tool provider: its binary runs on your machine (or one you
+control) and its tool descriptions land straight in your prompt. The pre-fix shape of this
+sample — `npx -y @modelcontextprotocol/server-everything` (an **unpinned**, latest-at-run-time
+package), executed directly **on the host with the application's own environment**, with
+**every discovered tool bound to the agent** — is exactly what this sample now exists to *not*
+do. The same rule this repo applies to every pattern that executes untrusted work:
+
+> **The model proposes. A constrained host validates and executes. Untrusted execution
+> never inherits the application's authority.**
+
+Concretely:
+
+- **Pin the server.** `MCP.AgentFramework/Sandbox/Dockerfile` bakes in an exact version
+  (`@modelcontextprotocol/server-everything@2025.8.18`) at build time — no "whatever is
+  latest today" resolved at run time.
+- **Run it in the same constrained container as CodeAct.** The pinned server is launched with
+  `Shared.Sandbox.SandboxRunner.BuildRunArguments`, the identical locked-down-container boundary
+  the **CodeAct** sample uses for model-generated code — see that pattern's security section for
+  the full flag-by-flag walkthrough. `McpToolBinding.Sandbox()` opts out of **no**
+  `SandboxOptions` default, so every row of that table applies here unchanged, `--user
+  65532:65532` included: the boundary enforces non-root rather than trusting the image's own
+  `USER` line to do it. That matters for the "point it at another server" note below — swap in an
+  image whose Dockerfile never drops root and it still runs as an unprivileged uid.
+- **Pass no host environment or credentials.** The container gets nothing from the host process;
+  the server never sees an API key, a token, or a host env var it wasn't explicitly handed.
+- **Deny network unless the chosen server needs it.** This demo server only needs stdio, so
+  `Network: false` — `--network none`. A server that legitimately calls out (a real GitHub or
+  database MCP server) would need that grant made explicit and justified, not defaulted on.
+- **Keep discovery and authorization separate.** `ListToolsAsync()` still returns everything the
+  server advertises — discovering a tool never grants it.
+- **Bind an explicit allowlist.** `McpToolBinding.SelectAuthorized` filters the discovered list
+  down to exactly `add` and `echo` before anything reaches the agent, and **fails closed** —
+  throwing `InvalidOperationException` — if an allowlisted tool goes missing, on the theory that
+  a missing expected tool means the server isn't the one that was pinned.
+- **Fail closed when the boundary is unavailable.** No Docker means no sandbox, which
+  means no MCP server — the sample exits with an explanatory message rather than falling back to
+  running the third-party server on the host. Same double opt-in as CodeAct
+  (`AGENTIC_PATTERNS_ALLOW_UNSAFE_HOST_EXECUTION` + `AGENTIC_PATTERNS_ACKNOWLEDGE_UNSAFE_CODE_EXECUTION`)
+  would be required to override that, and this sample does not wire that override up.
+
+The bundled Dockerfile/sandbox is a teaching boundary, not a production one — see CodeAct's
+"Included sandbox ≠ production-ready sandbox" for the caveats, which apply here unchanged.
+
 ## Key APIs
 
 | Agent Framework | Semantic Kernel |
 |---|---|
 | `McpClient.CreateAsync(new StdioClientTransport(...))` | `McpClient.CreateAsync(new StdioClientTransport(...))` |
 | `mcpClient.ListToolsAsync()` | `mcpClient.ListToolsAsync()` |
-| `tools.Cast<AITool>()` into `ChatClientAgent` | `kernel.Plugins.AddFromFunctions("McpTools", tools.Select(f => f.AsKernelFunction()))` |
+| `McpToolBinding.SelectAuthorized(discovered, allowed)` | `McpToolBinding.SelectAuthorized(discovered, allowed)` |
+| `tools.Where(authorized).Cast<AITool>()` into `ChatClientAgent` | `kernel.Plugins.AddFromFunctions("McpTools", tools.Where(authorized).Select(f => f.AsKernelFunction()))` |
 | — no conversion, `McpClientTool` is an `AIFunction` | `FunctionChoiceBehaviorOptions { RetainArgumentTypes = true }` |
 
-`StdioClientTransportOptions` is what launches the process: `Command = "npx"` with
-`Arguments = ["-y", "@modelcontextprotocol/server-everything"]`. Point it at any other executable
-and the rest of the code is unchanged.
+`StdioClientTransportOptions` is what launches the process: `Command = "docker"` with
+`Arguments = SandboxRunner.BuildRunArguments(sandbox, [])` — an empty command list, because the
+image's own `ENTRYPOINT` is the pinned server binary. Point `McpToolBinding.Sandbox()`'s image at
+any other sandboxed server and the rest of the code is unchanged — and because the non-root uid is
+imposed by the run arguments rather than inherited from the image, an image that never drops root
+does not quietly become a root container.
 
 ## What to watch in the output
 
-The Agent Framework sample prints `MCP tools: ` followed by the full discovered list — `echo`,
-`add`, `longRunningOperation`, `printEnv` and the rest — which is the whole point of the pattern
-made visible; nothing in the source names them. Then comes the agent's answer containing
-**6912**, a number only the remote `add` tool produced. The Semantic Kernel sample skips the
-listing and prints just the streamed answer. If the run hangs or dies at startup, npx is missing
-or still downloading. Compare with **ToolUse** for locally compiled tools, and **HostedTools**
-for tools the model provider runs on your behalf.
+Both samples print `Discovered: ` followed by the full list the container hands back — `echo`,
+`add`, `longRunningOperation`, `printEnv` and the rest — then `Bound to the agent: ` showing
+exactly `echo, add`, the visible proof that discovery and authorization are different steps. Then
+comes the agent's answer containing **6912**, a number only the remote `add` tool produced. If the
+run exits immediately with "Docker is not available", Docker isn't installed or the
+daemon isn't running. Compare with **ToolUse** for locally compiled tools, **HostedTools** for
+tools the model provider runs on your behalf, and **CodeAct** for the container sandbox this
+sample reuses.
diff --git a/PatternExplorer/patterns/ProgressiveToolDisclosure.md b/PatternExplorer/patterns/ProgressiveToolDisclosure.md
index 8d860f3..f972a64 100644
--- a/PatternExplorer/patterns/ProgressiveToolDisclosure.md
+++ b/PatternExplorer/patterns/ProgressiveToolDisclosure.md
@@ -67,5 +67,7 @@ answered with `[tool definitions sent to the model: 1 of 16 available]`: the mod
 only `search_tools`, used it, and confirmed what it loaded. Turn two shows `3 of 16` —
 search_tools plus the two discovered tools — and the actual answers. The closing line
 names what was loaded on demand and notes that the other 13 definitions never entered
-the context. **MCP** is the contrast case, binding every discovered tool up front;
-**SkillLearning** applies the same frontmatter-first trick to learned procedures.
+the context. **MCP** is a related contrast case: it still sends every *bound* tool's
+definition on every call rather than searching on demand, though it narrows which
+discovered tools get bound at all with an explicit allowlist. **SkillLearning** applies
+the same frontmatter-first trick to learned procedures.
diff --git a/PatternExplorer/patterns/StigmergicCoordination.md b/PatternExplorer/patterns/StigmergicCoordination.md
index 41fb69e..ceba648 100644
--- a/PatternExplorer/patterns/StigmergicCoordination.md
+++ b/PatternExplorer/patterns/StigmergicCoordination.md
@@ -3,7 +3,14 @@
   "title": "Stigmergic Coordination",
   "summary": "Workers coordinate through a shared workspace and compiler-enforced contracts instead of exchanging messages.",
   "category": "Orchestration",
-  "projects": [ { "flavor": "AgentFramework", "path": "StigmergicCoordination.AgentFramework" } ]
+  "risk": "Compiles model-written C# in a locked-down local container (no network, read-only source mount, resource limits); compiling runs build tasks, source generators and MSBuild targets. Fails closed without Docker. A host build requires an explicit double opt-in.",
+  "projects": [
+    { "flavor": "AgentFramework", "path": "StigmergicCoordination.AgentFramework", "note": "Needs Docker - the build gate refuses to compile model-written source on the host.", "environmentAllowlist": [
+      "AzureOpenAi__ChatModelDeployment", "AzureOpenAi__EmbeddingModelDeployment",
+      "AzureOpenAi__Endpoint", "AzureOpenAi__ApiKey",
+      "AGENTIC_PATTERNS_ALLOW_UNSAFE_HOST_EXECUTION", "AGENTIC_PATTERNS_ACKNOWLEDGE_UNSAFE_CODE_EXECUTION"
+    ] }
+  ]
 }
 ---
 
@@ -50,7 +57,7 @@ electric vehicle — but shaped as a three-component system: `SloganModule`, `Pr
 `IntegrationGate.cs` — a never-executed class whose only job is to *compile*: it instantiates
 each worker's class where its interface is expected, so a wrong name or signature anywhere
 fails the build. Three workers run concurrently, each producing one C# file into a temp
-workspace. The gate is `dotnet build`.
+workspace. The gate is a sandboxed `dotnet build`.
 
 One trap is deliberate: the Pricing worker's brief quotes a **stale interface**
 (`IReadOnlyList<decimal> GetPrices()`) instead of the real contract
@@ -68,14 +75,26 @@ flowchart TD
     W1 -->|SloganModule.cs| WS
     W2 -->|PricingModule.cs| WS
     W3 -->|BriefAssembler.cs| WS
-    WS --> G{dotnet build<br/>mechanical gate}
+    WS --> G{sandboxed dotnet build<br/>mechanical gate}
     G -->|error CS0535| W2
     G -->|all contracts satisfied| DONE[0 messages exchanged]
 ```
 
 The model's code is compiled but **never executed** — the compiler is the integration test.
-That keeps the sample inside the repository's untrusted-execution rule; a production version
-would add behavioral contract tests running in a sandbox (see **CodeAct** for what that takes).
+But compiling is not risk-free either: build tasks, source generators, and MSBuild targets all
+run as part of a build, not just at execution time, so `dotnet build` still runs inside the
+same locked-down container boundary **CodeAct** uses for model-generated code — no network,
+read-only source mount, a bounded writable build directory, capped CPU/memory/pids, a
+wall-clock timeout, and bounded output. The image differs, though: this sample pulls the stock
+`mcr.microsoft.com/dotnet/sdk` image from the network on first use, rather than CodeAct's
+repo-controlled image with an offline package cache baked in — same isolation flags, different
+image provenance. The sample fails closed with no fallback to a host build unless the same
+double opt-in CodeAct offers is set (and even then the timeout and source-size cap still
+apply) — and it hardcodes the `docker` CLI, so unlike CodeAct there is no Podman option. A
+nonzero exit with no compiler diagnostic — a permission mismatch on the mount, a resource-limit
+kill, an image-pull failure — is reported as a gate error too, never as a silent pass. A
+production version would go further and add behavioral contract tests running in that same
+sandbox.
 
 ## Key APIs
 
@@ -85,8 +104,8 @@ no workflow. The coordination machinery is the environment itself.
 - `ChatClientAgent(client, instructions, name)` — one plain agent per worker, no tools.
 - `Task.WhenAll(...)` — workers run concurrently precisely because they share no channel.
 - `File.WriteAllText` into a shared workspace — the write *is* the coordination act.
-- `Process.Start("dotnet", "build ...")` — the mechanical gate; its `error CS*` lines are
-  parsed and routed to the worker owning the failing file.
+- `BuildGate.RunAsync` / `SandboxRunner.RunAsync` — the mechanical gate, run inside a
+  container; its `error CS*` lines are parsed and routed to the worker owning the failing file.
 
 ## What to watch in the output
 
diff --git a/PatternExplorer/wwwroot/app.js b/PatternExplorer/wwwroot/app.js
index d112a55..1c28047 100644
--- a/PatternExplorer/wwwroot/app.js
+++ b/PatternExplorer/wwwroot/app.js
@@ -10,22 +10,52 @@ let flavor = null;
 let stream = null;
 let lines = [];
 let pendingRender = false;
+let runId = null;
+let runToken = null;
+
+const MAX_TERMINAL_LINES = 5000;
 
 // ---------- markdown ----------
 
+// Only these URL schemes are ever emitted as href/src - javascript:/data:/etc. in a link or
+// image target render as a plain '#'/empty target instead of an executable URI. CSP's
+// script-src blocks a javascript: click too, but that's a second layer, not a reason to skip
+// this one - see task-2.5b-report.md "Fix round 1".
+function isSafeUrl(href) {
+    try {
+        return ['http:', 'https:', 'mailto:'].includes(new URL(href, location.href).protocol);
+    } catch {
+        return false;
+    }
+}
+
 marked.use({
     renderer: {
         code(token) {
             if (token.lang === 'mermaid') return `<pre class="mermaid">${escapeHtml(token.text)}</pre>`;
             return `<pre class="code"><code>${escapeHtml(token.text)}</code></pre>`;
+        },
+        // Pattern docs are repo-controlled, but marked otherwise passes raw inline/block HTML
+        // straight through (verified: an unescaped <img onerror=...> renders live). Escaping it
+        // here is defence in depth, not a fix for a reachable hole.
+        html(token) { return escapeHtml(token.text); },
+        link(token) {
+            const safe = isSafeUrl(token.href) ? token : { ...token, href: '#' };
+            return marked.Renderer.prototype.link.call(this, safe);
+        },
+        image(token) {
+            const safe = isSafeUrl(token.href) ? token : { ...token, href: '' };
+            return marked.Renderer.prototype.image.call(this, safe);
         }
     }
 });
 
-mermaid.initialize({ startOnLoad: false, theme: 'dark', securityLevel: 'loose' });
+mermaid.initialize({ startOnLoad: false, theme: 'dark', securityLevel: 'strict' });
 
+// Covers attribute position too (") since p.id/p.flavor/file paths get interpolated into
+// href/data-* attributes below, not just text nodes.
 function escapeHtml(text) {
-    return text.replace(/[&<>]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;' }[c]));
+    return text.replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
 }
 
 // ---------- catalog ----------
@@ -47,7 +77,7 @@ function renderList() {
     $('list').innerHTML = categories.map((category) => `
         <div class="category">${escapeHtml(category)}</div>
         ${matches.filter((p) => p.category === category).map((p) => `
-            <a href="#${p.id}" data-id="${p.id}">
+            <a href="#${escapeHtml(p.id)}" data-id="${escapeHtml(p.id)}">
                 ${escapeHtml(p.title)}
                 <span class="flavor-dots">${[...new Set(p.projects.map((x) => x.flavor.startsWith('SemanticKernel') ? 'SK' : 'AF'))].join(' ')}</span>
             </a>`).join('')}
@@ -91,7 +121,7 @@ async function select(id) {
 
 function renderFlavors() {
     $('flavors').innerHTML = current.projects.map((p) => `
-        <button data-flavor="${p.flavor}" class="${p.flavor === flavor ? 'active' : ''}">
+        <button data-flavor="${escapeHtml(p.flavor)}" class="${p.flavor === flavor ? 'active' : ''}">
             ${escapeHtml(flavorLabel(p.flavor))}
         </button>`).join('');
 
@@ -111,7 +141,7 @@ function renderSources() {
     const files = current.sources[flavor] ?? [];
     $('source-view').hidden = true;
     $('sources').innerHTML = files.map((f) =>
-        `<button data-path="${f}">${escapeHtml(f)}</button>`).join('');
+        `<button data-path="${escapeHtml(f)}">${escapeHtml(f)}</button>`).join('');
 }
 
 async function showSource(path, button) {
@@ -127,6 +157,8 @@ function run() {
     if (stream) stopStream();
 
     lines = [];
+    runId = null;
+    runToken = null;
     $('terminal').innerHTML = '';
     $('terminal-panel').hidden = false;
     $('terminal-title').textContent = `${current.title} · ${flavor}`;
@@ -135,6 +167,11 @@ function run() {
     $('run').disabled = true;
 
     stream = new EventSource(`/api/run?id=${encodeURIComponent(current.id)}&flavor=${encodeURIComponent(flavor)}`);
+    stream.addEventListener('session', (event) => {
+        const session = JSON.parse(event.data);
+        runId = session.id;
+        runToken = session.token;
+    });
     stream.onmessage = (event) => {
         const chunk = JSON.parse(event.data);
         append(chunk.s, chunk.t);
@@ -148,6 +185,8 @@ function finish(state, message) {
     stopStream();
     setStatus(state, message);
     $('run').disabled = false;
+    runId = null;
+    runToken = null;
 }
 
 function stopStream() {
@@ -157,7 +196,12 @@ function stopStream() {
 }
 
 function cancel() {
-    fetch('/api/run/cancel', { method: 'POST' });
+    if (runId && runToken) {
+        fetch(`/api/runs/${encodeURIComponent(runId)}/cancel`, {
+            method: 'POST',
+            headers: { 'X-Run-Token': runToken }
+        }).catch(() => {});
+    }
     finish('done', 'stopped');
 }
 
@@ -175,6 +219,7 @@ function append(streamTag, text) {
         else lines.push({ stream: streamTag, text: part, open: true });
         if (i < parts.length - 1) lines[lines.length - 1].open = false;
     });
+    if (lines.length > MAX_TERMINAL_LINES) lines.splice(0, lines.length - MAX_TERMINAL_LINES);
 }
 
 function scheduleRender() {
@@ -233,7 +278,13 @@ $('close-terminal').addEventListener('click', () => {
 
 $('stdin-form').addEventListener('submit', (e) => {
     e.preventDefault();
-    fetch('/api/run/input', { method: 'POST', body: $('stdin').value });
+    if (runId && runToken) {
+        fetch(`/api/runs/${encodeURIComponent(runId)}/input`, {
+            method: 'POST',
+            headers: { 'X-Run-Token': runToken },
+            body: $('stdin').value
+        }).catch(() => {});
+    }
     $('stdin').value = '';
 });
 
diff --git a/README.md b/README.md
index 5fa7c1b..84e695d 100644
--- a/README.md
+++ b/README.md
@@ -49,19 +49,27 @@ docker run --rm --init \
 # then open http://localhost:5080
 ```
 
-The image contains the .NET 10 SDK, prebuilt samples, and Node.js with npm/npx. It runs as a
+The image contains the .NET 10 SDK and prebuilt samples. It runs as a
 non-root user; the command above also binds only to loopback and drops Linux capabilities. Do
 not expose Pattern Explorer directly to the internet: its run endpoints intentionally execute
-samples with the supplied credentials. Enabling the two optional CodeAct variables runs generated
-code directly inside this outer container instead of a nested Docker sandbox. The generated code
-therefore shares the container's credentials, filesystem, and network access.
+samples with the supplied credentials. Enabling the two optional unsafe-execution variables
+affects **two** samples, not one: `CodeAct` then runs generated code directly inside this outer
+container instead of a nested Docker sandbox, and `StigmergicCoordination` likewise runs its
+`dotnet build` of model-written source there. Both then share the container's credentials,
+filesystem, and network access. The `MCP` sample cannot run inside this container at all: it needs
+a container runtime of its own to sandbox the MCP server, and this image ships neither a Docker
+client nor a daemon socket — running it here always hits the fail-closed path and exits. Run `MCP`
+from a terminal with Docker installed instead.
 
 Running a sample from the UI spawns `dotnet run` for that project and calls your Azure OpenAI
 deployment, exactly as running it from the terminal would. Samples that ask for approval get an
 input box wired to the process's stdin; the A2A sample starts its server first automatically.
 
 The write-ups live in `PatternExplorer/patterns/*.md` — one file per pattern, re-read on every
-request, so edits show up on refresh.
+request, so edits show up on refresh. The page serves them under a same-origin
+Content-Security-Policy and renders their Markdown with raw HTML escaped rather than executed
+(and Mermaid diagrams run in Mermaid's `strict` mode); pattern docs are repo-controlled, so this
+is defence in depth rather than protection against untrusted authors.
 
 ## Patterns
 
@@ -100,7 +108,7 @@ the catalog together; each result states its scope limits and cites a primary so
 | Handoff | Agents transferring the conversation to each other |
 | HostedTools | Server-side code interpreter and web search tools |
 | InterAgentCommunication.A2A | Agent-to-agent communication over the A2A protocol |
-| MCP | Consuming Model Context Protocol tool servers |
+| MCP | Consuming Model Context Protocol tool servers, sandboxed and allowlisted |
 | Magentic | Manager-driven open-ended multi-agent orchestration |
 | MultiAgentCollaboration | Group-chat orchestration |
 | OrchestratorWorkers | Dynamic decomposition into validated tasks for a fixed worker registry |
@@ -157,9 +165,12 @@ the catalog together; each result states its scope limits and cites a primary so
 
 ## Setup
 
-Requires the .NET 10 SDK and an Azure OpenAI deployment. The `CodeAct` sample additionally
-requires Docker or Podman — it sandboxes the code the model writes and refuses to run
-without isolation (see the security section below).
+Requires the .NET 10 SDK and an Azure OpenAI deployment. Three samples additionally require a
+container runtime and refuse to run without isolation, because each executes untrusted work:
+`CodeAct` (model-generated code, Docker or Podman via `CodeExecutionOptions.ContainerRuntime`),
+`MCP` (a third-party MCP server, Docker only), and `StigmergicCoordination` (`dotnet build` over
+model-written source, Docker only — a build runs build tasks, source generators and MSBuild
+targets). See the security section below.
 
 Configuration is read from `settings/appsettings.json` (linked into every project), environment variables, and user secrets. **Don't put your API key in `appsettings.json`** — it's tracked in git. Use user secrets instead:
 
@@ -210,6 +221,31 @@ Concretely, for the `CodeAct` sample:
   no ambient credentials. Never execute model-generated code in the application process
   or on the application host.
 
+The same rule applies to the `MCP` sample: a third-party MCP server is untrusted code too.
+`@modelcontextprotocol/server-everything` is pinned at an exact version and baked into an
+image at build time, run in the same locked-down container as `CodeAct` — every flag from the
+same `Shared/Sandbox` defaults, opting out of none of them (no network, no host environment or
+credentials, read-only filesystem, dropped capabilities, non-root `--user 65532:65532`, bounded
+pids/memory/cpu) — and only an explicit allowlist (`add`, `echo`) of its discovered tools is ever
+bound to the agent — discovery and authorization are kept separate. Unlike `CodeAct`, this sample
+hardcodes the `docker` CLI, so Podman is not an option for it. Build the image once before running
+either flavor:
+
+```bash
+docker build -t agentic-patterns/mcp-server-everything:2025.8.18 MCP.AgentFramework/Sandbox
+```
+
+See `PatternExplorer/patterns/MCP.md` for the full walkthrough.
+
+And to the `StigmergicCoordination` sample, whose build gate compiles model-written C#: compiling
+untrusted source *is* running untrusted code, so `dotnet build` happens inside the same boundary
+(no network, read-only source mount, one bounded writable tmpfs, capped cpu/memory/pids, a
+wall-clock timeout, bounded output) rather than on the host. It pulls the stock
+`mcr.microsoft.com/dotnet/sdk` image rather than building a repo-controlled one, so its image
+provenance differs from `CodeAct`'s — the isolation flags do not. Like `CodeAct` it exits 1
+without Docker unless the same double opt-in is set; see
+`PatternExplorer/patterns/StigmergicCoordination.md`.
+
 The A2A samples need the server running first:
 
 ```bash
diff --git a/CodeAct.AgentFramework/Execution/BoundedReader.cs b/Shared/Sandbox/BoundedReader.cs
similarity index 92%
rename from CodeAct.AgentFramework/Execution/BoundedReader.cs
rename to Shared/Sandbox/BoundedReader.cs
index 3c265f0..8c212db 100644
--- a/CodeAct.AgentFramework/Execution/BoundedReader.cs
+++ b/Shared/Sandbox/BoundedReader.cs
@@ -1,8 +1,8 @@
 using System.Text;
 
-namespace CodeAct.AgentFramework.Execution;
+namespace Shared.Sandbox;
 
-internal static class BoundedReader
+public static class BoundedReader
 {
     /// <summary>
     /// Reads a stream keeping at most <paramref name="maxCharacters"/> characters, but keeps
diff --git a/Shared/Sandbox/HostWorkspace.cs b/Shared/Sandbox/HostWorkspace.cs
new file mode 100644
index 0000000..b844510
--- /dev/null
+++ b/Shared/Sandbox/HostWorkspace.cs
@@ -0,0 +1,43 @@
+namespace Shared.Sandbox;
+
+/// <summary>
+/// Host-side staging for the directory a sandbox bind-mounts. The container runs as an
+/// unrelated uid (65532 by default), so every directory it traverses and every file it reads
+/// has to be world-readable — and the mode argument on <c>Directory.CreateDirectory</c> is a
+/// <c>mkdir(2)</c> mode, itself masked by the process umask (verified by hand: umask 077 turns
+/// a requested 0755 into 0700). <c>chmod(2)</c> is not subject to umask, so the explicit
+/// <see cref="File.SetUnixFileMode(string, UnixFileMode)"/> afterwards is what actually forces
+/// the bits. This lived twice — once in CodeAct's ContainerCodeRunner, once in
+/// StigmergicCoordination's BuildGate, where the identical gap had to be found independently —
+/// so it lives next to the boundary that needs it instead.
+/// </summary>
+public static class HostWorkspace
+{
+    private const UnixFileMode DirectoryMode =
+        UnixFileMode.UserRead | UnixFileMode.UserWrite | UnixFileMode.UserExecute |
+        UnixFileMode.GroupRead | UnixFileMode.GroupExecute |
+        UnixFileMode.OtherRead | UnixFileMode.OtherExecute;
+
+    private const UnixFileMode FileMode =
+        UnixFileMode.UserRead | UnixFileMode.UserWrite | UnixFileMode.GroupRead | UnixFileMode.OtherRead;
+
+    /// <summary>Creates <paramref name="path"/> and its parent world-traversable, umask or not.</summary>
+    public static string CreateWorldReadableDirectory(string path)
+    {
+        if (OperatingSystem.IsWindows()) return Directory.CreateDirectory(path).FullName;
+
+        var parent = Path.GetDirectoryName(path)!;
+        Directory.CreateDirectory(parent);
+        File.SetUnixFileMode(parent, DirectoryMode);
+        Directory.CreateDirectory(path);
+        File.SetUnixFileMode(path, DirectoryMode);
+        return path;
+    }
+
+    /// <summary>Writes a file the sandbox uid can read — the directory mode alone is not enough.</summary>
+    public static async Task WriteWorldReadableAsync(string path, string content, CancellationToken cancellationToken)
+    {
+        await File.WriteAllTextAsync(path, content, cancellationToken);
+        if (!OperatingSystem.IsWindows()) File.SetUnixFileMode(path, FileMode);
+    }
+}
diff --git a/Shared/Sandbox/SandboxOptions.cs b/Shared/Sandbox/SandboxOptions.cs
new file mode 100644
index 0000000..a2581a2
--- /dev/null
+++ b/Shared/Sandbox/SandboxOptions.cs
@@ -0,0 +1,25 @@
+namespace Shared.Sandbox;
+
+/// <summary>
+/// The constrained-execution boundary shared by every sample that runs untrusted,
+/// model-generated work: deny everything by default (no network, no capabilities, no
+/// host filesystem, no host environment, no root) and grant back only what the caller
+/// explicitly asks for via <see cref="Mounts"/> and <see cref="Environment"/>.
+/// </summary>
+public sealed record SandboxOptions(
+    string Image,
+    string ContainerRuntime = "docker",
+    bool Network = false,
+    string Memory = "512m",
+    string Cpus = "1",
+    int PidsLimit = 128,
+    TimeSpan Timeout = default,
+    int MaxOutputCharacters = 65_536,
+    IReadOnlyDictionary<string, string>? Environment = null,
+    IReadOnlyList<(string Host, string Container, bool ReadOnly)>? Mounts = null,
+    string? ContainerName = null,
+    string? User = "65532:65532",
+    string? Tmpfs = null,
+    bool Interactive = false);
+
+public sealed record SandboxResult(int ExitCode, string StdOut, string StdErr, bool TimedOut);
diff --git a/Shared/Sandbox/SandboxRunner.cs b/Shared/Sandbox/SandboxRunner.cs
new file mode 100644
index 0000000..90fad7f
--- /dev/null
+++ b/Shared/Sandbox/SandboxRunner.cs
@@ -0,0 +1,262 @@
+using System.Diagnostics;
+
+namespace Shared.Sandbox;
+
+/// <summary>
+/// Runs a command inside a locked-down local container. This is the constrained-execution
+/// boundary itself: least privilege throughout, nothing granted back except what an
+/// individual <see cref="SandboxOptions"/> explicitly asks for. It demonstrates the required
+/// isolation boundary; it is NOT a production-grade sandbox for adversarial or multi-tenant
+/// workloads (use a disposable VM/microVM isolation service for that).
+/// </summary>
+public static class SandboxRunner
+{
+    /// <summary>True when the runtime CLI exists AND its daemon answers.</summary>
+    public static bool IsAvailable(string containerRuntime)
+    {
+        try
+        {
+            var (exitCode, _, _) = RunRuntimeCommandAsync(containerRuntime,
+                ["version", "--format", "{{.Server.Version}}"], TimeSpan.FromSeconds(10))
+                .GetAwaiter().GetResult();
+            return exitCode == 0;
+        }
+        catch (Exception e) when (e is System.ComponentModel.Win32Exception or PlatformNotSupportedException)
+        {
+            return false; // CLI not on PATH
+        }
+    }
+
+    /// <summary>
+    /// The effective pids-limit clamp, as a pure value so tests can assert it directly instead
+    /// of inferring it from a timing-dependent run. 0 or negative reads to docker as "unlimited"
+    /// — never let "unset" mean "no limit" on a security boundary.
+    /// </summary>
+    public static int EffectivePidsLimit(int configured) => configured > 0 ? configured : 128;
+
+    /// <summary>
+    /// The effective timeout clamp, as a pure value so tests can assert it directly instead of
+    /// inferring it from a timing-dependent run. On a type whose whole purpose is bounding
+    /// untrusted work, "caller forgot to set Timeout" must never mean "no bound".
+    /// </summary>
+    public static TimeSpan EffectiveTimeout(TimeSpan configured) =>
+        configured > TimeSpan.Zero ? configured : TimeSpan.FromMinutes(3);
+
+    /// <summary>
+    /// The effective memory clamp. `--memory 0` (and an empty value) reads to docker as
+    /// UNLIMITED — the same fail-open-on-a-bound shape as a zero <see cref="SandboxOptions.PidsLimit"/>
+    /// or an unset Timeout, and just as unreachable through the type's own defaults, so it is
+    /// closed the same way. A non-numeric value is passed through untouched: docker rejects it
+    /// loudly, which is a failure, not a silently removed limit.
+    /// </summary>
+    public static string EffectiveMemory(string? configured) => IsUnbounded(configured) ? "512m" : configured!;
+
+    /// <summary>The effective cpu clamp — `--cpus 0` is likewise "unlimited" to docker.</summary>
+    public static string EffectiveCpus(string? configured) => IsUnbounded(configured) ? "1" : configured!;
+
+    // "0", "0m", "0.0", "" and null all mean "no limit" once docker parses them.
+    private static bool IsUnbounded(string? value) =>
+        string.IsNullOrWhiteSpace(value) ||
+        (double.TryParse(value.TrimEnd('b', 'B', 'k', 'K', 'm', 'M', 'g', 'G'),
+            System.Globalization.NumberStyles.Float, System.Globalization.CultureInfo.InvariantCulture,
+            out var number) && number <= 0);
+
+    /// <summary>
+    /// The whole security posture, as one pure function so tests can pin every flag.
+    /// Deny everything by default; grant back only what <paramref name="options"/> asks for.
+    /// </summary>
+    public static IReadOnlyList<string> BuildRunArguments(SandboxOptions options, IReadOnlyList<string> command)
+    {
+        List<string> args = ["run", "--rm"];
+
+        if (options.ContainerName is not null)
+        {
+            args.Add("--name");
+            args.Add(options.ContainerName);
+        }
+        if (options.Interactive) args.Add("-i");
+
+        if (!options.Network)
+        {
+            args.Add("--network");
+            args.Add("none");
+        }
+
+        args.Add("--read-only");
+        args.Add("--cap-drop");
+        args.Add("ALL");
+        args.Add("--security-opt");
+        args.Add("no-new-privileges=true");
+        args.Add("--pids-limit");
+        args.Add(EffectivePidsLimit(options.PidsLimit).ToString());
+        args.Add("--memory");
+        args.Add(EffectiveMemory(options.Memory));
+        args.Add("--cpus");
+        args.Add(EffectiveCpus(options.Cpus));
+
+        if (options.User is not null)
+        {
+            args.Add("--user");
+            args.Add(options.User);
+        }
+
+        if (options.Tmpfs is not null)
+        {
+            args.Add("--tmpfs");
+            args.Add(options.Tmpfs);
+        }
+
+        if (options.Mounts is not null)
+        {
+            foreach (var (host, container, readOnly) in options.Mounts)
+            {
+                // `--mount` takes a comma-separated option list with no escaping mechanism, so a
+                // path containing a comma does not produce a weird mount — it INJECTS mount
+                // options (`src=/a,readwrite,/b`). Every caller passes a GUID temp directory
+                // today, but this is the one function whose entire job is the security posture:
+                // reject rather than build a value docker will re-parse into something else.
+                if (host.Contains(',') || container.Contains(','))
+                    throw new ArgumentException(
+                        $"Mount paths must not contain a comma — docker would read it as another mount option: '{host}' -> '{container}'.",
+                        nameof(options));
+
+                args.Add("--mount");
+                args.Add($"type=bind,src={host},dst={container}" + (readOnly ? ",readonly" : ""));
+            }
+        }
+
+        if (options.Environment is not null)
+        {
+            foreach (var (name, value) in options.Environment)
+            {
+                args.Add("--env");
+                args.Add($"{name}={value}");
+            }
+        }
+
+        args.Add(options.Image);
+        args.AddRange(command);
+        return args;
+    }
+
+    /// <summary>
+    /// Runs <paramref name="command"/> inside the sandbox and returns its output, bounded
+    /// per <see cref="SandboxOptions.MaxOutputCharacters"/>. On timeout, kills the container
+    /// by name (cancelling the client process does not guarantee the containerized process
+    /// has stopped) and reports <see cref="SandboxResult.TimedOut"/> instead of throwing.
+    /// Caller cancellation is never converted into a timeout result — it propagates as
+    /// <see cref="OperationCanceledException"/>.
+    /// </summary>
+    public static async Task<SandboxResult> RunAsync(
+        SandboxOptions options, IReadOnlyList<string> command, string? stdin, CancellationToken cancellationToken)
+    {
+        // C1: kill-by-name must never be optional. SIGKILLing the docker-run CLI process
+        // does not stop the daemon-side container, so timeout cleanup below has to kill BY
+        // NAME — generate one when the caller didn't supply one rather than silently
+        // degrading to a leaked container.
+        var containerName = options.ContainerName ?? $"sandbox-{Guid.NewGuid():N}";
+        options = options with
+        {
+            ContainerName = containerName,
+            // I3: a caller that redirects stdin but forgot -i gets a pipe docker never
+            // attaches to — input is silently discarded and the callee sees EOF.
+            Interactive = options.Interactive || stdin is not null,
+        };
+
+        using var process = StartRuntimeProcess(options.ContainerRuntime,
+            BuildRunArguments(options, command), redirectStandardInput: stdin is not null);
+        try
+        {
+            using var timeoutCts = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+            timeoutCts.CancelAfter(EffectiveTimeout(options.Timeout));
+
+            try
+            {
+                var stdoutTask = BoundedReader.ReadBoundedAsync(
+                    process.StandardOutput, options.MaxOutputCharacters, timeoutCts.Token);
+                var stderrTask = BoundedReader.ReadBoundedAsync(
+                    process.StandardError, options.MaxOutputCharacters, timeoutCts.Token);
+
+                // I2: readers must already be draining, and the timeout must already be
+                // armed, before we write. A child that prints more than the output bound
+                // before reading its stdin blocks on a full stdout pipe; writing stdin
+                // before the drain starts (and with no cancellation token) would then hang
+                // forever, uncancellable by either the caller's token or the sandbox timeout.
+                if (stdin is not null)
+                {
+                    await process.StandardInput.WriteAsync(stdin.AsMemory(), timeoutCts.Token);
+                    process.StandardInput.Close();
+                }
+
+                await process.WaitForExitAsync(timeoutCts.Token);
+
+                return new SandboxResult(process.ExitCode, await stdoutTask, await stderrTask, TimedOut: false);
+            }
+            catch (OperationCanceledException) when (!cancellationToken.IsCancellationRequested)
+            {
+                // Timeout, not caller cancellation. Kill by NAME: cancelling the client
+                // process does not guarantee the containerized process has stopped.
+                await KillContainerAsync(options.ContainerRuntime, containerName);
+                if (!process.HasExited) process.Kill(entireProcessTree: true);
+                return new SandboxResult(
+                    ExitCode: -1,
+                    StdOut: "",
+                    StdErr: "Execution exceeded the configured time limit.",
+                    TimedOut: true);
+            }
+            // Caller cancellation propagates as OperationCanceledException — it is never
+            // converted into an ordinary failure result. The finally still cleans up.
+        }
+        finally
+        {
+            await RemoveContainerAsync(options.ContainerRuntime, containerName);
+        }
+    }
+
+    private static async Task KillContainerAsync(string containerRuntime, string containerName) =>
+        await RunRuntimeCommandAsync(containerRuntime, ["kill", containerName], TimeSpan.FromSeconds(30));
+
+    private static async Task RemoveContainerAsync(string containerRuntime, string containerName)
+    {
+        // Belt and braces next to --rm; a missing container is the expected happy path.
+        try
+        {
+            await RunRuntimeCommandAsync(containerRuntime, ["rm", "-f", containerName], TimeSpan.FromSeconds(30));
+        }
+        catch (System.ComponentModel.Win32Exception) { }
+    }
+
+    private static Process StartRuntimeProcess(
+        string containerRuntime, IReadOnlyList<string> arguments, bool redirectStandardInput = false)
+    {
+        var startInfo = new ProcessStartInfo(containerRuntime)
+        {
+            RedirectStandardOutput = true,
+            RedirectStandardError = true,
+            RedirectStandardInput = redirectStandardInput
+        };
+        foreach (var argument in arguments) startInfo.ArgumentList.Add(argument);
+        return Process.Start(startInfo)!;
+    }
+
+    private static async Task<(int ExitCode, string Stdout, string Stderr)> RunRuntimeCommandAsync(
+        string containerRuntime, IReadOnlyList<string> arguments, TimeSpan timeout,
+        CancellationToken cancellationToken = default)
+    {
+        using var cts = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+        cts.CancelAfter(timeout);
+        using var process = StartRuntimeProcess(containerRuntime, arguments);
+        var stdoutTask = process.StandardOutput.ReadToEndAsync(cts.Token);
+        var stderrTask = process.StandardError.ReadToEndAsync(cts.Token);
+        try
+        {
+            await process.WaitForExitAsync(cts.Token);
+        }
+        catch (OperationCanceledException)
+        {
+            if (!process.HasExited) process.Kill(entireProcessTree: true);
+            throw;
+        }
+        return (process.ExitCode, await stdoutTask, await stderrTask);
+    }
+}
diff --git a/StigmergicCoordination.AgentFramework/BuildGate.cs b/StigmergicCoordination.AgentFramework/BuildGate.cs
new file mode 100644
index 0000000..4e635ba
--- /dev/null
+++ b/StigmergicCoordination.AgentFramework/BuildGate.cs
@@ -0,0 +1,200 @@
+using Shared.Sandbox;
+
+namespace StigmergicCoordination.AgentFramework;
+
+/// <summary>
+/// The mechanical gate: `dotnet build` over the shared workspace, run inside the SAME
+/// constrained-execution boundary CodeAct uses for model-generated code. Compiling untrusted
+/// source is still running untrusted code — build tasks, source generators, and MSBuild
+/// targets all execute as part of a build, not just at run time — so the workspace is
+/// compiled in a locked-down container (no network, read-only source mount, bounded writable
+/// build directory, capped CPU/memory/pids, wall-clock timeout, bounded output), never
+/// directly on the host. See the repository's untrusted-execution rule.
+/// </summary>
+public static class BuildGate
+{
+    public const long MaxSourceBytes = 64 * 1024;
+
+    // ponytail: the stock SDK image, pulled from the network on first `docker run` - unlike
+    // CodeAct's ContainerCodeRunner, which builds a repo-controlled image with an offline
+    // package cache baked in (CodeAct.AgentFramework/Sandbox/Dockerfile). Same isolation
+    // flags, different image provenance: a first-run pull failure is a real failure mode here
+    // that CodeAct doesn't have. The pull also happens INSIDE `docker run`, so it is inside
+    // SandboxRunner's timeout: warm it is ~9s, but on a cold CI runner a slow pull surfaces as
+    // `error AP0002: the build gate timed out` and fails StigmergicBuildGateSandboxTests. That
+    // fails red rather than falsely green, so it is a flake, not a hole. Upgrade path: bake a
+    // similar offline image (or pre-pull in CI) if this sample needs to run with zero host
+    // network access, including for the initial pull.
+    private const string ContainerImage = "mcr.microsoft.com/dotnet/sdk:10.0";
+    private const int MaxOutputCharacters = 65_536;
+
+    // Same two variables CodeAct's CodeRunnerFactory reads (Execution/CodeRunnerFactory.cs) -
+    // duplicated here rather than referenced across projects, since no sample in this repo
+    // references another sample's project. Only THIS sample's fail-closed path offers them,
+    // because only this sample actually reads them - unlike MCP, which has no host fallback.
+    public const string UnsafeEnableVariable = "AGENTIC_PATTERNS_ALLOW_UNSAFE_HOST_EXECUTION";
+    public const string UnsafeEnableValue = "true";
+    public const string UnsafeAcknowledgementVariable = "AGENTIC_PATTERNS_ACKNOWLEDGE_UNSAFE_CODE_EXECUTION";
+    public const string UnsafeAcknowledgementValue = "I_UNDERSTAND_THIS_RUNS_UNTRUSTED_CODE_ON_MY_HOST";
+
+    private const string NuGetConfig =
+        """
+        <?xml version="1.0" encoding="utf-8"?>
+        <configuration>
+          <packageSources>
+            <clear />
+          </packageSources>
+        </configuration>
+        """;
+
+    public static string FailClosedMessage =>
+        $"""
+        Docker is not available. This sample compiles model-generated C# files, which
+        is untrusted code - build tasks, source generators, and MSBuild targets all run during
+        a build, not just at execution. It will not be compiled on the host.
+
+        Install Docker to run it (this sample hardcodes the docker CLI - only CodeAct takes the
+        runtime from an option), or explicitly opt into an unsandboxed host build
+        (the build still gets a timeout and a source size cap, but none of the container
+        isolation) with both:
+          1. {UnsafeEnableVariable}={UnsafeEnableValue}
+          2. {UnsafeAcknowledgementVariable}={UnsafeAcknowledgementValue}
+        """;
+
+    /// <summary>Double opt-in, same shape as CodeAct - one variable alone is never enough.</summary>
+    public static bool IsUnsafeHostBuildRequested() =>
+        Environment.GetEnvironmentVariable(UnsafeEnableVariable) == UnsafeEnableValue &&
+        Environment.GetEnvironmentVariable(UnsafeAcknowledgementVariable) == UnsafeAcknowledgementValue;
+
+    /// <summary>Oversized files never reach the compiler (sandboxed or not) - checked up front.</summary>
+    public static string? OversizedSourceError(string workspace)
+    {
+        foreach (var file in Directory.GetFiles(workspace, "*.cs"))
+            if (new FileInfo(file).Length > MaxSourceBytes)
+                return $"{Path.GetFileName(file)}: error AP0001: source exceeds {MaxSourceBytes} bytes";
+        return null;
+    }
+
+    public static List<string> ParseErrors(string combinedOutput) =>
+        [.. combinedOutput.Split('\n').Where(l => l.Contains(": error ")).Select(l => l.Trim()).Distinct()];
+
+    /// <summary>
+    /// C1: a nonzero exit with no parsed compiler diagnostic is NOT a pass. `cp` permission
+    /// failures, a `--pids-limit` kill, a daemon hiccup, or an image-pull failure all exit
+    /// nonzero without ever printing a line containing ": error " - discarding the exit code
+    /// (as the pre-sandbox `BuildAsync` did) turns every one of those into a silent PASSED.
+    /// Single source of truth for both the sandboxed and host-fallback paths.
+    /// </summary>
+    public static List<string> InterpretResult(SandboxResult result)
+    {
+        if (result.TimedOut) return ["error AP0002: the build gate timed out"];
+        var errors = ParseErrors(result.StdOut + result.StdErr);
+        if (errors.Count == 0 && result.ExitCode != 0)
+        {
+            var detail = string.IsNullOrWhiteSpace(result.StdErr) ? result.StdOut : result.StdErr;
+            return [$"error AP0003: the build gate could not run (exit {result.ExitCode}): {detail.Trim()}"];
+        }
+        return errors;
+    }
+
+    /// <summary>
+    /// `SandboxOptions` defaults to `--read-only`, so copying the workspace out of the
+    /// read-only `/src` mount needs a writable mount - a bounded tmpfs. The tmpfs (and HOME /
+    /// DOTNET_CLI_HOME) land on `/tmp`, exactly where `ContainerCodeRunner` puts them - NOT on
+    /// a separate `/build` tmpfs, which was tried first and measured to fail: the .NET CLI's
+    /// interprocess "first run" mutex is hardcoded to `/tmp/.dotnet/shm`, ignoring HOME and
+    /// TMPDIR, so a writable `/build` with a still-read-only `/tmp` fails on every run with
+    /// "mkdir(/tmp/.dotnet/shm/session1) == -1; errno == EROFS" before the compiler ever sees
+    /// the source. Mounting the tmpfs at `/tmp` is what `ContainerCodeRunner` already does, is
+    /// verified working here, and keeps the same environment variables it passes: what lets
+    /// the SDK run offline as a non-root user with no writable home.
+    /// </summary>
+    public static SandboxOptions SandboxedOptions(string workspace) => new(
+        Image: ContainerImage,
+        Network: false, Memory: "1g", Cpus: "2", PidsLimit: 256,
+        Timeout: TimeSpan.FromMinutes(3),
+        Tmpfs: "/tmp:rw,exec,nosuid,nodev,size=1g",
+        Environment: new Dictionary<string, string>
+        {
+            ["HOME"] = "/tmp",
+            ["DOTNET_CLI_HOME"] = "/tmp/dotnet",
+            ["DOTNET_NOLOGO"] = "1",
+            ["DOTNET_CLI_TELEMETRY_OPTOUT"] = "1",
+        },
+        Mounts: [(workspace, "/src", true)]);
+
+    /// <summary>
+    /// Runs the gate. <paramref name="useSandbox"/> is decided ONCE by the caller (before any
+    /// worker runs) rather than re-checked every round, mirroring CodeAct's one-time runner
+    /// selection - availability cannot silently change mid-run into a different security
+    /// posture.
+    /// </summary>
+    public static async Task<List<string>> RunAsync(
+        string workspace, bool useSandbox, CancellationToken cancellationToken)
+    {
+        var oversized = OversizedSourceError(workspace);
+        if (oversized is not null) return [oversized];
+
+        // Ruling 3: written every round (cheap, idempotent) so a restore that ever tries to
+        // reach a feed fails loudly instead of silently depending on Network: false alone.
+        // World-readable: this file rides the read-only /src bind mount into the sandbox too.
+        await WriteWorldReadableAsync(Path.Combine(workspace, "NuGet.config"), NuGetConfig, cancellationToken);
+
+        if (!useSandbox) return await HostBuildAsync(workspace, cancellationToken);
+
+        var result = await SandboxRunner.RunAsync(SandboxedOptions(workspace),
+            ["sh", "-c", "cp -r /src /tmp/build && cd /tmp/build && dotnet build -nologo --verbosity quiet"],
+            stdin: null, cancellationToken);
+
+        return InterpretResult(result);
+    }
+
+    /// <summary>
+    /// C2: the container runs as uid 65532, an unrelated uid on the host, so a workspace created
+    /// under a restrictive umask (0700, common with `umask 077`) is unreadable to the sandbox,
+    /// `cp` fails, and (pre-C1-fix) that silently read as PASSED. The umask fix itself lives in
+    /// <see cref="HostWorkspace"/> - it was found and fixed independently here and in CodeAct's
+    /// ContainerCodeRunner, which is exactly why it is shared now rather than copied.
+    /// </summary>
+    public static string CreateWorkspaceDirectory(string path) =>
+        HostWorkspace.CreateWorldReadableDirectory(path);
+
+    /// <summary>Every file written into the workspace has to be readable by uid 65532, not just
+    /// the directory - same shared helper, same reason.</summary>
+    public static Task WriteWorldReadableAsync(string path, string content, CancellationToken cancellationToken) =>
+        HostWorkspace.WriteWorldReadableAsync(path, content, cancellationToken);
+
+    // ponytail: unsandboxed - only reachable behind the double opt-in in IsUnsafeHostBuildRequested,
+    // same shape as CodeAct's UnsafeHostCodeRunner. Upgrade path is the same: delete this method
+    // once every environment running the sample has a container runtime.
+    private static async Task<List<string>> HostBuildAsync(string workspace, CancellationToken cancellationToken)
+    {
+        using var timeoutCts = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+        timeoutCts.CancelAfter(TimeSpan.FromMinutes(3));
+
+        using var process = System.Diagnostics.Process.Start(
+            new System.Diagnostics.ProcessStartInfo("dotnet", "build -nologo --verbosity quiet")
+            {
+                WorkingDirectory = workspace,
+                RedirectStandardOutput = true,
+                RedirectStandardError = true,
+            })!;
+        try
+        {
+            var stdoutTask = BoundedReader.ReadBoundedAsync(process.StandardOutput, MaxOutputCharacters, timeoutCts.Token);
+            var stderrTask = BoundedReader.ReadBoundedAsync(process.StandardError, MaxOutputCharacters, timeoutCts.Token);
+            await process.WaitForExitAsync(timeoutCts.Token);
+            return InterpretResult(new SandboxResult(process.ExitCode, await stdoutTask, await stderrTask, TimedOut: false));
+        }
+        catch (OperationCanceledException)
+        {
+            // I3: kill on EITHER a timeout or caller cancellation - an unsandboxed host
+            // `dotnet build` left running after this method returns/throws is an orphaned
+            // process, not just a discarded result (contrast SandboxRunner's kill-by-name).
+            if (!process.HasExited) process.Kill(entireProcessTree: true);
+            process.WaitForExit(); // release file handles so the workspace can be deleted
+            if (cancellationToken.IsCancellationRequested) throw; // caller cancellation stays caller cancellation
+            return InterpretResult(new SandboxResult(-1, "", "", TimedOut: true));
+        }
+    }
+}
diff --git a/StigmergicCoordination.AgentFramework/Program.cs b/StigmergicCoordination.AgentFramework/Program.cs
index 79749a7..5fab78c 100644
--- a/StigmergicCoordination.AgentFramework/Program.cs
+++ b/StigmergicCoordination.AgentFramework/Program.cs
@@ -1,18 +1,44 @@
-using System.Diagnostics;
+using System.Runtime.InteropServices;
 using System.Text.RegularExpressions;
 using Microsoft.Agents.AI;
 using Shared;
+using Shared.Sandbox;
+using StigmergicCoordination.AgentFramework;
 
 // Stigmergic coordination: N workers build components of one system WITHOUT exchanging
 // a single message. All coordination flows through the shared environment — a workspace
 // directory, compiler-enforced C# contracts, and a build gate. The orchestrator only
 // launches workers and runs the gate; it never relays information between agents.
 // Contrast MultiAgentCollaboration, where the same domain task is coordinated by dialogue.
+//
+// The gate compiles model-written files, which is untrusted code — build tasks, source
+// generators, and MSBuild targets all run during a build. It runs inside the same
+// constrained-execution boundary CodeAct uses (see BuildGate.cs) and FAILS CLOSED when no
+// container runtime is available, unless the same double opt-in CodeAct offers is set.
+
+// Fail closed BEFORE creating a workspace or spending a single model call: no container
+// runtime and no explicit double opt-in means the sample refuses to compile anything.
+var useSandbox = SandboxRunner.IsAvailable("docker");
+if (!useSandbox && !BuildGate.IsUnsafeHostBuildRequested())
+{
+    Console.Error.WriteLine(BuildGate.FailClosedMessage);
+    return 1;
+}
 
-var workspace = Directory.CreateDirectory(
-    Path.Combine(Path.GetTempPath(), "stigmergy", Guid.NewGuid().ToString("N"))).FullName;
+// C2: world-readable so the sandbox's non-root uid can read the bind mount, regardless of
+// the operator's umask - see BuildGate.CreateWorkspaceDirectory.
+var workspace = BuildGate.CreateWorkspaceDirectory(
+    Path.Combine(Path.GetTempPath(), "stigmergy", Guid.NewGuid().ToString("N")));
 Console.WriteLine($"Workspace: {workspace}\n");
 
+// Minor: a plain `return` inside the round loop below cannot outrun Ctrl-C, so the SIGINT
+// handler deletes the workspace directly rather than relying on the try/finally to run.
+using var sigint = PosixSignalRegistration.Create(PosixSignal.SIGINT, _ =>
+{
+    try { Directory.Delete(workspace, recursive: true); }
+    catch (IOException) { } catch (UnauthorizedAccessException) { }
+});
+
 // ---- The environment: contracts + integration gate, written by the HOST ----
 
 const string Contracts =
@@ -54,9 +80,9 @@ public static (ISloganModule, IPricingModule, IBriefAssembler) Wire() =>
     }
     """;
 
-File.WriteAllText(Path.Combine(workspace, "Contracts.cs"), Contracts);
-File.WriteAllText(Path.Combine(workspace, "IntegrationGate.cs"), Gate);
-File.WriteAllText(Path.Combine(workspace, "Campaign.csproj"),
+await BuildGate.WriteWorldReadableAsync(Path.Combine(workspace, "Contracts.cs"), Contracts, CancellationToken.None);
+await BuildGate.WriteWorldReadableAsync(Path.Combine(workspace, "IntegrationGate.cs"), Gate, CancellationToken.None);
+await BuildGate.WriteWorldReadableAsync(Path.Combine(workspace, "Campaign.csproj"),
     """
     <Project Sdk="Microsoft.NET.Sdk">
         <PropertyGroup>
@@ -64,7 +90,7 @@ public static (ISloganModule, IPricingModule, IBriefAssembler) Wire() =>
             <Nullable>enable</Nullable>
         </PropertyGroup>
     </Project>
-    """);
+    """, CancellationToken.None);
 
 // ---- The workers: one file each, briefed from the environment, never from each other ----
 
@@ -97,53 +123,50 @@ async Task ProduceAsync((string File, string Role, string Brief) worker, string
     var agent = new ChatClientAgent(Settings.ChatClient, worker.Brief, worker.Role);
     var code = (await agent.RunAsync($"{TaskBrief}\n{extraContext}")).Text.Trim();
     code = Regex.Replace(code, @"^```\w*\n|\n?```$", ""); // strip fences if the model adds them anyway
-    File.WriteAllText(Path.Combine(workspace, worker.File), code);
+    await BuildGate.WriteWorldReadableAsync(Path.Combine(workspace, worker.File), code, CancellationToken.None);
     Console.WriteLine($"[worker] {worker.Role} -> {worker.File} ({code.Split('\n').Length} lines, no messages to other workers)");
 }
 
-// ---- The mechanical gate: dotnet build over the shared workspace ----
+// ---- The mechanical gate: BuildGate.RunAsync, sandboxed unless the opt-in fallback fired ----
 
-async Task<List<string>> BuildAsync()
+try
 {
-    var process = Process.Start(new ProcessStartInfo("dotnet", "build -nologo --verbosity quiet")
-    {
-        WorkingDirectory = workspace,
-        RedirectStandardOutput = true,
-        RedirectStandardError = true,
-    })!;
-    var output = await process.StandardOutput.ReadToEndAsync() + await process.StandardError.ReadToEndAsync();
-    await process.WaitForExitAsync();
-    return [.. output.Split('\n').Where(l => l.Contains(": error ")).Select(l => l.Trim()).Distinct()];
-}
-
-await Task.WhenAll(workers.Select(w => ProduceAsync(w, "")));
+    await Task.WhenAll(workers.Select(w => ProduceAsync(w, "")));
 
-for (var round = 1; round <= 3; round++)
-{
-    Console.WriteLine($"\n=== Build gate: round {round} ===");
-    var errors = await BuildAsync();
-    if (errors.Count == 0)
+    for (var round = 1; round <= 3; round++)
     {
-        Console.WriteLine("PASSED — every component satisfies the shared contracts.");
-        Console.WriteLine("\n---- Files in the shared environment ----");
-        foreach (var f in Directory.GetFiles(workspace, "*.cs").Order())
-            Console.WriteLine($"\n>>> {Path.GetFileName(f)}\n{File.ReadAllText(f).Trim()}");
-        Console.WriteLine("\nMessages exchanged between workers: 0. The workspace did all the talking.");
-        return;
+        Console.WriteLine($"\n=== Build gate: round {round} ===");
+        var errors = await BuildGate.RunAsync(workspace, useSandbox, CancellationToken.None);
+        if (errors.Count == 0)
+        {
+            Console.WriteLine("PASSED — every component satisfies the shared contracts.");
+            Console.WriteLine("\n---- Files in the shared environment ----");
+            foreach (var f in Directory.GetFiles(workspace, "*.cs").Order())
+                Console.WriteLine($"\n>>> {Path.GetFileName(f)}\n{File.ReadAllText(f).Trim()}");
+            Console.WriteLine("\nMessages exchanged between workers: 0. The workspace did all the talking.");
+            return 0;
+        }
+
+        foreach (var error in errors) Console.WriteLine($"  {error}");
+
+        // Errors route by file name to the worker that owns the file — the trace in the
+        // environment is the only feedback channel, and it carries the REAL contract with it.
+        foreach (var group in errors.GroupBy(e => workers.FirstOrDefault(w => e.Contains(w.File)).File).Where(g => g.Key is not null))
+        {
+            var worker = workers.First(w => w.File == group.Key);
+            Console.WriteLine($"  -> gate feedback for {worker.Role}: rework {worker.File} against the real contract");
+            await ProduceAsync(worker,
+                $"Your previous {worker.File} failed the build gate:\n{string.Join("\n", group)}\n\n" +
+                $"The authoritative shared contract file Contracts.cs is:\n{Contracts}\nRewrite the complete file so it compiles against it.");
+        }
     }
 
-    foreach (var error in errors) Console.WriteLine($"  {error}");
-
-    // Errors route by file name to the worker that owns the file — the trace in the
-    // environment is the only feedback channel, and it carries the REAL contract with it.
-    foreach (var group in errors.GroupBy(e => workers.FirstOrDefault(w => e.Contains(w.File)).File).Where(g => g.Key is not null))
-    {
-        var worker = workers.First(w => w.File == group.Key);
-        Console.WriteLine($"  -> gate feedback for {worker.Role}: rework {worker.File} against the real contract");
-        await ProduceAsync(worker,
-            $"Your previous {worker.File} failed the build gate:\n{string.Join("\n", group)}\n\n" +
-            $"The authoritative shared contract file Contracts.cs is:\n{Contracts}\nRewrite the complete file so it compiles against it.");
-    }
+    Console.WriteLine("\nFAILED — components still do not satisfy the contracts after 3 rounds.");
+    return 1;
+}
+finally
+{
+    // Guaranteed cleanup: the workspace must not survive a crash or the success return above.
+    try { Directory.Delete(workspace, recursive: true); }
+    catch (IOException) { } catch (UnauthorizedAccessException) { }
 }
-
-Console.WriteLine("\nFAILED — components still do not satisfy the contracts after 3 rounds.");