A diff I could actually review

The agent changed seven files. The command log made the change look like forty-three unrelated events.

Some commands only inspected the repository. A formatter rewrote lines the model never discussed. A package script generated an ignored cache. One failed patch left no filesystem change. The final summary named three files and omitted a configuration edit.

I could replay the terminal output and still not answer the reviewer's first question: what, exactly, is different from the workspace I approved?

N17Q needed a sandbox for containment. It needed snapshots to make the result reviewable.

A command history was not a change set

Shell events described attempts over time. Review was about state.

Inferring state from commands was unreliable because tools could write indirectly, processes could fail after partial output, and the same command meant different things in different directories. A formatter invoked through a package script did not enumerate its edits. A build could create files while returning a nonzero status.

N17Q retained bounded command evidence for diagnosis, but stopped treating it as the authoritative account of workspace mutation. The sandbox filesystem became an observed product boundary.

Every run started from a named base and ended with a measured state transition.

The base snapshot identified the thing being changed

“Current repository” was too vague for a durable task. Files could change between planning, approval, execution, and review.

Before agent work began, N17Q recorded the source revision when available, then created a content manifest for the permitted workspace. Each entry included canonical path, type, executable bit, size, content digest, and safe metadata needed for restoration. Symlinks were represented as links rather than followed beyond the boundary.

The manifest received a snapshot identity. Context, policies, patches, test results, and approvals referred to it. A later live checkout with the same branch name did not become the original base.

The snapshot answered both provenance and concurrency: which exact tree did the agent receive?

Isolation defined the observed boundary

The workspace contained more than tracked source. It had ignored files, generated artifacts, package caches, local configuration, and sometimes nested repositories.

N17Q classified paths before execution. Source and task artifacts were captured. Dependency stores could be mounted read-only or provided as disposable caches. Credentials and host configuration were absent. Output directories were writable but declared. Paths outside the workspace were not merely excluded from the diff; the sandbox could not reach them.

This classification made the snapshot meaningful. A manifest of only version-controlled files would miss a generated file later consumed by tests. A manifest of the whole home directory would collect irrelevant and sensitive state.

Review began with a deliberately bounded world.

Filesystem modification times changed for reasons unrelated to semantic edits. Archive extraction, dependency installation, and formatter passes could touch timestamps without changing bytes.

N17Q compared content digest, path, type, mode, and link target. Time remained diagnostic metadata and did not define change. Directories were derived from entries rather than reported as noisy mutations.

For large files, the snapshotter used streaming hashes and size limits. Unsupported special files caused the workspace to be rejected or explicitly excluded before execution. It never interpreted a device or socket as ordinary content.

The resulting diff was quiet enough that each entry deserved attention.

Two manifests could prove that one path disappeared and another appeared with identical content. Calling that a rename was useful presentation, not a fundamental filesystem event.

N17Q stored additions and deletions as facts, then derived rename candidates using content identity and bounded similarity. The review interface labeled uncertain matches. Approval bound the canonical add-delete patch, not the heuristic label.

This mattered when one file was copied to several destinations or renamed while heavily edited. A confident but incorrect rename display could hide duplication or removal.

The interface used interpretation to reduce cognitive load without letting it rewrite evidence.

Generated files needed an explicit policy

The first snapshot diff included thousands of build outputs. Hiding all ignored files fixed the visual problem and created an integrity problem: a generated schema committed by the project could drift while an ignored runtime artifact influenced tests.

N17Q classified generated paths by project rules. Some were excluded and deleted with the disposable sandbox. Some were retained as test evidence but not proposed for delivery. Others were expected source artifacts and appeared in the review patch.

The run report named large excluded classes and their measured footprint. Unexpected writes to an undeclared generated directory became a policy finding instead of disappearing.

“Generated” described origin. It did not decide whether the output mattered.

The post-run snapshot happened after process settlement

Capturing the tree as soon as the main command returned missed child processes and delayed writes. Waiting indefinitely for a quiet filesystem allowed a runaway task to hold the workflow open.

The sandbox supervisor tracked process groups, open execution leases, and declared background services. Finalization stopped or joined them according to contract, flushed relevant filesystem buffers through the environment, and then sealed writes before taking the snapshot.

Late write attempts failed and entered the trace. A short observation window caught processes that violated shutdown expectations without turning “quiet” into a timing guess.

The after-state was taken at an explicit transition from executable workspace to sealed artifact.

The model could help summarize intended changes, but it was not the observer of record. Its context might omit files, tools could write outside its attention, and a malicious instruction could tell it not to mention an edit.

N17Q measured the entire permitted writable boundary independently. The final model summary was compared with the resulting manifest diff. Omitted substantive files appeared as discrepancies.

This was useful even without adversarial behavior. Agents naturally described the files central to their reasoning and overlooked lockfiles, snapshots, or formatter changes.

The product could use the model's explanation while retaining a complete mechanical inventory.

A snapshot was not automatically a patch

The after-state could contain changes that should never leave the sandbox: logs, temporary fixtures, experimental edits, or a file produced by a failed approach.

N17Q derived a candidate patch from policy-eligible changes. The agent could propose selecting or reverting entries inside the disposable workspace. Tests ran against the exact candidate state. The reviewer saw excluded changes separately with reasons.

Only after selection and verification did the system materialize an immutable patch artifact tied to base snapshot and target state digest.

The snapshot described what happened. The patch described what the workflow proposed to preserve.

A clean diff could still be unsafe if applied to a workspace that had moved.

The patch named its base snapshot and relevant path digests. Applying it to another target required matching preconditions or an explicit rebase workflow. N17Q did not silently use fuzzy context to place a security-sensitive edit somewhere plausible.

For non-overlapping user changes, the system could prepare a new candidate against the current tree and run verification again. That was a new artifact with new evidence, not the old patch being “close enough.”

Review stayed attached to the bytes and state the reviewer had actually seen.

The visual diff reflected semantic risk

A flat alphabetical list gave a one-line dependency change the same prominence as a documentation correction. N17Q grouped entries by product role and risk signals: executable behavior, dependency graph, configuration, data migration, generated output, tests, and prose.

Within a file, ordinary text diff remained the evidence. Additional views could render structured configuration, syntax-aware movement, or image comparison, but never replaced the raw artifact.

The interface surfaced mode changes, new executable files, symlink changes, and unusually large binaries before line-level review. Hidden whitespace had an optional explicit view.

Hierarchy helped a person allocate attention without claiming to decide correctness.

Binary changes received their own evidence

Displaying “binary files differ” was technically accurate and practically useless.

For supported formats, N17Q produced bounded derived previews and metadata: dimensions and visual comparison for images, table-of-contents and page renders for documents, entry manifests for archives. Each derivative linked to the exact content digest and named the renderer version.

Unsupported binaries showed size, type detection, digest, origin command, and policy status. They could require manual handling or be excluded. The system never embedded unknown active content directly into the review surface.

Derived views improved understanding while the original bytes remained the approved object.

An agent could run tests, modify a file afterward, and still report the earlier green result. A command log made that chronology discoverable but easy to miss.

N17Q recorded the sealed snapshot digest for every verification attempt. A test result was eligible evidence only if its declared inputs matched the candidate artifact. Subsequent relevant mutations made the result stale in the review view.

Focused checks and broad checks remained distinct. Cached results named the cache key and environment. Failure output linked to the exact state it observed.

“Tests passed” became a relationship between a command, environment, and tree—not a reusable sentence.

Review comments attached to immutable locations

Line numbers drifted as the agent revised a candidate. Attaching feedback only to file:42 caused comments to move or disappear.

N17Q anchored a comment to patch identity, path, hunk context, and content digest. A later revision could map the anchor when evidence supported it and otherwise marked the comment outdated. The original remained available.

Resolving feedback generated a descendant candidate state. The reviewer could compare the response with the exact earlier concern.

This small provenance chain prevented a polished final diff from erasing the reason a line had changed.

Reverting inside the sandbox was observable

The agent tried an approach, edited three files, ran a failing check, and reverted two of the files. The final snapshot correctly showed only one change, while the trace retained the abandoned path.

That was the right split. Reviewers usually needed the proposed state, not every temporary keystroke. Diagnosing a surprising decision still required the causal history.

N17Q kept intermediate snapshots only at meaningful checkpoints or on policy-triggered events, rather than after every write. Commands and patch operations referenced those checkpoints. Storage used content addressing so unchanged blobs were shared.

The final diff stayed readable without making the exploration unaccountable.

A sandboxed process could copy a permitted secret from memory into a writable file if the workflow exposed it. Snapshot isolation alone would faithfully preserve the leak.

N17Q minimized secret access, marked sensitive inputs, scanned candidate additions through bounded detectors, and enforced path and content policies before materializing a patch. Suspected credentials quarantined the artifact and blocked normal preview where rendering might spread them.

Detection was imperfect and therefore one layer. Live secrets were absent from ordinary coding sandboxes, network was constrained, and review required explicit handling of flagged content.

The snapshot made every written byte observable. Policy decided whether those bytes could travel farther.

Dependency state remained reproducible enough to question

The sandbox mounted a package cache for speed, but a mutable cache could introduce undeclared differences between runs. Copying the entire dependency tree into every snapshot was expensive and still failed to identify registry behavior.

N17Q recorded lockfile digest, runtime and package-manager versions, install policy, relevant cache manifest, and network mode. For high-value scenarios, dependencies came from a sealed image or content-addressed store. The workspace snapshot referred to that environment identity.

This did not make the broader software supply chain timeless. It made enough of the execution context explicit to explain why a result should or should not be comparable.

Source diff and environment diff were shown separately.

Naively copying every workspace before and after every attempt was slow and wasteful. Skipping snapshots under pressure would make the most complex runs least reviewable.

N17Q used content-addressed blobs, incremental manifests, bounded checkpoint frequency, and retention classes. Large declared artifacts could live in a separate store while the manifest preserved identity. Quotas were checked before execution, with reserved space for the final state and diagnostic evidence.

When limits were reached, the run paused before losing the ability to account for further changes. The user could reduce scope or discard expendable checkpoints.

Observability had a resource cost, so the system budgeted it as part of execution rather than treating it as optional logging.

The most instructive run ended after a formatter succeeded and a test process exhausted its memory budget. The agent never reached its cleanup step.

The supervisor sealed the workspace, captured the after-state, and marked the candidate incomplete. The review showed intended-looking source changes, an unexpected generated file, stale verification, and the exact failure boundary. Nothing was automatically offered for delivery.

I could preserve the useful patch into a new task or discard the entire sandbox. Either choice started from known bytes.

A failed run no longer meant choosing between a terminal transcript and blind trust in a dirty directory.

User-owned changes stayed outside the sandbox lineage

The host checkout could already contain unfinished work. Copying that tree into a sandbox without recording its state made the agent's base appear cleaner than it was. Applying the result back could overwrite edits that had continued while the run was active.

N17Q captured the selected base exactly, including eligible uncommitted content, and labeled its provenance as user-owned. The agent's descendant snapshot did not convert those bytes into agent authorship. On return, application compared current host paths with the base manifest and stopped on overlapping movement.

Non-overlapping changes could be composed through a new candidate snapshot. Conflicts remained explicit artifacts for review. The system never reset the host to make its patch fit.

Snapshot lineage preserved both ownership and concurrency without demanding an artificially clean checkout.

Deletion deserved more attention than absence

A missing file could be an intentional removal, a cleanup side effect, a path-normalization error, or evidence that the snapshotter crossed a mount boundary incorrectly.

N17Q grouped deletions separately and showed the last known type, size, digest, references from tracked manifests, and originating command when available. Removing configuration, fixtures, migrations, or access-control files raised review priority. Directory disappearance was derived from its entries rather than hiding them beneath one collapsed row.

The reviewer could restore a deletion inside the sandbox and create a descendant candidate without rerunning the whole task.

Treating deletion as a first-class change prevented the cleanest-looking diff from being the one that silently removed its own constraints.

Archive formats and version-control objects were useful implementation tools, but neither defined all the states N17Q needed. Depending directly on one representation would make permissions, links, large artifacts, and fixture environments difficult to evolve.

The product used a versioned manifest schema with canonical paths and content references. Importers could read repository trees or sealed archives. Exporters could materialize a review patch or a diagnostic bundle. Schema migrations were pure, tested transformations that never invented missing bytes.

This indirection also made old runs inspectable after the sandbox engine changed. The durable contract was the bounded state model, not the storage backend that happened to capture it.

Portability came from owning the meaning of a snapshot.

The seven-file change became one artifact

After the snapshot work, N17Q reran the original scenario from the same base. The agent inspected and edited through dozens of commands. The formatter still touched an extra file, and the failed experiment still created a temporary artifact.

The sealed diff identified seven source changes, one excluded cache, and one reverted branch visible only in history. The agent selected five files for the candidate, explained them, and ran checks against that exact state. The interface elevated the configuration change its summary had omitted.

The reviewer approved one immutable patch with a known base, not forty-three terminal events and a promise.

Sandboxing answered where the agent was allowed to act. The snapshot answered what action left behind.

Together they turned execution from a stream of plausible activity into a bounded state transition a person could inspect, test, reject, preserve, and explain.