fix(check): stop check agents from getting lost outside their sandbox

A traced `multi check` run showed every "agent did not report" timeout
sharing one signature: the agent was never told the *path* of its sandbox
working directory, went hunting for the repository across the host
filesystem (navigating by the workspace map in the loaded user-level
CLAUDE.md), and died inside an unbounded recursive Glob over a huge host
tree. Retries at effort=low (temperature 0.0) replayed the same fatal
trajectory verbatim, three out of three attempts. Two other agents
"passed" by grading the live repository instead of the sandbox copy.

Three fixes, one per leg of that failure:

- Instructions now state the sandbox path explicitly, direct the agent to
  stay inside it, and note that omitting `path` defaults to it. Every
  traced agent that learned the path — by any means — reported within 40s.
- New `Jailed` tool decorator confines FileRead/Grep/Glob to the agent's
  working directory: paths are judged by their symlink-resolved location
  (via deepest-existing-ancestor, so /var <-> /private/var aliasing and
  not-yet-existing paths both work), and glob patterns get their own rule
  since an absolute pattern replaces the walk base and `..` climbs out of
  it. Escapes return a corrective tool error instead of running away.
- `AgentRunRequest.attempt` (1-based) threads the retry count to the
  executor: retries raise the sampling temperature by 0.5 (capped at 1.0)
  and append a note that a previous attempt went unreported, so attempt 2
  has a reason to sample a different trajectory than attempt 1.

Also formats three files (trace.rs, checks/mod.rs, trace_archive.rs) that
were committed unformatted — `cargo make check-format` was failing at HEAD.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VxKv1hhPZ4GocfmwHUk1G8

Author: RobbieMcKinstry

src/checks/execution.rs

@@ -115,8 +115,15 @@ impl ExecutionActor {
             // Permit acquired ⇒ the agent is about to run: mark the check Running.
             let _ = presenter.tell(UiEvent::CheckStarted { id }).await;
 
-            let mut result =
-                run_one(executor, sandbox, job.id, job.check.clone(), &working_dir).await;
+            let mut result = run_one(
+                executor,
+                sandbox,
+                job.id,
+                job.check.clone(),
+                &working_dir,
+                attempt,
+            )
+            .await;
 
             // Harvest this attempt's trace *before* signalling completion, so it
             // is collected even for retried attempts (whose outcome never reaches
@@ -249,13 +256,15 @@ async fn run_one(
     id: CheckId,
     check: Check,
     working_dir: &Path,
+    attempt: usize,
 ) -> Result<AgentOutcome> {
     let handle = sandbox.create(working_dir).await?;
 
     let request = crate::checks::executor::AgentRunRequest {
         check_id: id,
         check,
         working_dir: handle.path().to_path_buf(),
+        attempt: u32::try_from(attempt).unwrap_or(u32::MAX),
     };
 
     let outcome = executor.run_check(request).await;
@@ -422,7 +431,9 @@ mod tests {
         .await
         .unwrap();
         assert!(out[0].satisfied);
-        // Ran twice: one silent attempt, then one reporting attempt.
-        assert_eq!(executor.seen().len(), 2);
+        // Ran twice: one silent attempt, then one reporting attempt — and the
+        // executor was told which attempt each was (retries must be able to
+        // vary temperature/instructions rather than replaying attempt 1).
+        assert_eq!(executor.seen_attempts(), vec![(0, 1), (0, 2)]);
     }
 }

src/checks/executor/cersei.rs

@@ -15,6 +15,7 @@ use cersei_types::CerseiError;
 use miette::{Result, miette};
 use tokio_util::sync::CancellationToken;
 
+use super::jail::Jailed;
 use super::judge::{JudgeTool, VerdictSink};
 use super::trace::{TraceHeader, TraceRecorder, serialize_trace};
 use super::{
@@ -70,11 +71,27 @@ impl CerseiExecutor {
 /// The read-only tool set a verification agent gets by default: observe, do not
 /// mutate. Execution-requiring checks (which would need Bash/Write) are gated
 /// separately and are future work — the default is least privilege.
+///
+/// Each tool is [`Jailed`] to the agent's working directory: "read-only" alone
+/// still allowed reading anywhere the user can, which let lost agents launch
+/// unbounded globs over the host filesystem (timeouts) and grade the live
+/// repository instead of the sandbox (postmortem C5). The jail turns an
+/// out-of-sandbox path into an immediate tool error that steers the agent back.
 fn read_only_tools() -> Vec<Box<dyn Tool>> {
     vec![
-        Box::new(cersei_tools::file_read::FileReadTool),
-        Box::new(cersei_tools::grep_tool::GrepTool),
-        Box::new(cersei_tools::glob_tool::GlobTool),
+        Box::new(Jailed::path_keys(
+            cersei_tools::file_read::FileReadTool,
+            &["file_path"],
+        )),
+        Box::new(Jailed::path_keys(
+            cersei_tools::grep_tool::GrepTool,
+            &["path"],
+        )),
+        Box::new(Jailed::glob(
+            cersei_tools::glob_tool::GlobTool,
+            &["path"],
+            "pattern",
+        )),
     ]
 }
 
@@ -111,6 +128,16 @@ fn effort_temperature(effort: Effort) -> f32 {
     }
 }
 
+/// The sampling temperature for a given attempt: the effort base, raised by
+/// 0.5 per retry and capped at 1.0. At effort=low the base is 0.0, and a
+/// temperature-0 retry is a replay: the 2026-07-01 postmortem caught one check
+/// reproducing its fatal trajectory near-verbatim on all three attempts. A
+/// retry has to sample differently to be worth its wall-clock.
+fn attempt_temperature(effort: Effort, attempt: u32) -> f32 {
+    let base = effort_temperature(effort);
+    (base + 0.5 * attempt.saturating_sub(1) as f32).min(1.0)
+}
+
 #[async_trait]
 impl CheckExecutor for CerseiExecutor {
     async fn run_check(&self, req: AgentRunRequest) -> Result<AgentOutcome> {
@@ -136,7 +163,12 @@ impl CheckExecutor for CerseiExecutor {
         let cancel = CancellationToken::new();
         let judge = JudgeTool::new(sink.clone(), cancel.clone());
 
-        let instructions = assemble_instructions(&req.check, &judge_tool_directive());
+        let instructions = assemble_instructions(
+            &req.check,
+            &judge_tool_directive(),
+            &req.working_dir,
+            req.attempt,
+        );
 
         let mut agent_builder = Agent::builder()
             .provider_boxed(provider)
@@ -149,7 +181,7 @@ impl CheckExecutor for CerseiExecutor {
             .tools(read_only_tools())
             .tool(judge)
             // Thinking is intentionally left disabled (see `effort_temperature`).
-            .temperature(effort_temperature(self.effort))
+            .temperature(attempt_temperature(self.effort, req.attempt))
             .max_turns(MAX_TURNS)
             .cancel_token(cancel.clone());
 
@@ -237,3 +269,18 @@ impl CheckExecutor for CerseiExecutor {
         Ok(outcome)
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn retries_raise_the_temperature_up_to_the_cap() {
+        assert_eq!(attempt_temperature(Effort::Low, 1), 0.0);
+        assert_eq!(attempt_temperature(Effort::Low, 2), 0.5);
+        assert_eq!(attempt_temperature(Effort::Low, 3), 1.0);
+        assert_eq!(attempt_temperature(Effort::Medium, 2), 1.0);
+        // Already at the cap: retries must not push past valid API range.
+        assert_eq!(attempt_temperature(Effort::High, 3), 1.0);
+    }
+}

src/checks/executor/claude.rs

@@ -97,7 +97,12 @@ impl CheckExecutor for ClaudeExecutor {
             "dispatching claude -p check (fallback)",
         );
 
-        let instructions = assemble_instructions(&req.check, &file_report_directive());
+        let instructions = assemble_instructions(
+            &req.check,
+            &file_report_directive(),
+            &req.working_dir,
+            req.attempt,
+        );
 
         let mut cmd = Command::new(&self.program);
         cmd.arg("-p")

src/checks/executor/fake.rs

@@ -22,7 +22,8 @@ pub struct FakeExecutor {
     /// id to `(report_on_attempt, report)`. Exercises the retry path: the same
     /// `CheckId` is re-run, so the fake counts attempts per id.
     silent_until: HashMap<CheckId, (usize, CheckReport)>,
-    seen: Mutex<Vec<CheckId>>,
+    /// Every `(check_id, attempt)` the fake was asked to run, in call order.
+    seen: Mutex<Vec<(CheckId, u32)>>,
 }
 
 impl FakeExecutor {
@@ -72,6 +73,18 @@ impl FakeExecutor {
 
     /// The check ids the fake was asked to run, in call order.
     pub fn seen(&self) -> Vec<CheckId> {
+        self.seen
+            .lock()
+            .unwrap()
+            .iter()
+            .map(|(id, _)| *id)
+            .collect()
+    }
+
+    /// The `(check_id, attempt)` pairs the fake was asked to run, in call
+    /// order — lets tests assert the retry plumbing threads attempt numbers
+    /// through to the executor.
+    pub fn seen_attempts(&self) -> Vec<(CheckId, u32)> {
         self.seen.lock().unwrap().clone()
     }
 }
@@ -81,8 +94,8 @@ impl CheckExecutor for FakeExecutor {
     async fn run_check(&self, req: AgentRunRequest) -> Result<AgentOutcome> {
         let attempt = {
             let mut seen = self.seen.lock().unwrap();
-            seen.push(req.check_id);
-            seen.iter().filter(|id| **id == req.check_id).count()
+            seen.push((req.check_id, req.attempt));
+            seen.iter().filter(|(id, _)| *id == req.check_id).count()
         };
 
         if self.silent.contains(&req.check_id) {