How runs are isolated

The lab runs code written by its users and by an AI. It is built on the assumption that such code may be wrong, or hostile.

Each person's files are their own#

Every account has its own Workspace and its own project folders. A run sees one project of one person. It cannot read another person's files.

Each run is contained#

A stage runs in a container that is created for that run and removed after it.

• It runs as the project's owner, not as an administrator.
• It has no network access.
• It has a limit on processor time, memory and running time. See Compute limits.
• It can write only inside the project and its own scratch space.

Tests are restricted#

A generated or pushed test may import only the test framework and a random-number module. It may not open files, start processes or use the network. The lab checks this before a generated test is run.

The AI is kept outside#

The model never executes anything. When a repair needs checking, the platform applies it to a separate copy of the project and runs the test there. Your working files are not involved until you accept.

Project text is data#

Whatever is written in your files, including comments addressed to an AI, is passed to the model as project data with an instruction not to follow it. A specification file is passed the same way.

Deleting#

When you delete a project, the lab removes its files as their owner, so a deletion cannot reach outside that one folder. Links inside a project are removed, never followed.

Sharing#

A public share page shows results and a picture of the layout. It does not expose source code or allow access to the project. The picture is drawn in a container with no network and read-only access to the layout file.