Source view
A digest-pinned program tree copied into an ordinary directory.
Filesystem isolation research · 2026-08-10
Ordinary filesystems.Private dirt.
A macOS-first experiment in giving trusted coding agents pinned, writable views of one program state—without requiring Git worktrees, containers, privileged mounts, or cloud services.
research interfacefull-copy
$ pdb-env create alpha
→ base a8cd…807ff
→ root /…/alpha/root
$ pdb-env run alpha -- codex
PDB_ENV=alpha
cwd=/…/alpha/root
$ pdb-env create beta
→ same base, different dirt
$ pdb-env list
alpha dirty private
beta clean private60/60Node workload runs
2real coding agents
1pinned base digest
0cross-visible dirty files
The question
Can the filesystem be the interface without being the authority?
Agents expect a normal repository tree. They run language servers, package managers, watchers, build tools, local databases, and shell commands. The research asks whether each agent can get that familiar interface while its writable state stays invisible to its siblings.
The selected shape
One immutable idea.
Many ordinary directories.
Full-copy is deliberately boring. That makes it the correctness oracle: if an optimized backend cannot reproduce its visible tree and exact changes, the optimization loses.
program sourcefiltered treeexcludes administrative roots
scan twice→
immutable basea8cd…807ffcontent-addressed manifest
copycopy
environment alphaCodex dirtordinary native directory
environment betaClaude dirtordinary native directory
Dependencies
Private mutable graphs; shared caches are inputs, never shared node_modules.
Runtime
Processes, ports, sockets, databases, and temp paths remain separate concerns.
Authority
A workspace cannot publish or advance a canonical head by itself.
Evidence, not vibes
The dirty-state proof passed.
Every failure stayed in the record. No retry was converted into a pass, and full-copy remained the reference oracle.
CODEX≠CLAUDE
Same paths. Different results.
Both agents edited shared.txt, deleted and renamed the same base files, created nested files and symlinks, and changed an executable bit. Claude ran after Codex was dirty and still saw none of Codex's output.
createeditdeleterenamesymlinkchmodwatchre-enter
npm environments
TypeScript, tsserver, Vite, Next.js, Jest, and Vitest watcher updates.
- install p50
- 3.7s
- workload p95
- 10.7s
pnpm environments
Private node_modules graphs with shared immutable cache inputs.
- install p50
- 3.5s
- workload p95
- 11.7s
Base stayed pinned
Source checksums remained unchanged while both private views diverged.
Open the complete research trail →Backend bake-off
The fastest idea did not win.
Correctness and observable fallback behavior came before benchmark theater.
| Backend | Decision | Strength | Blocking tradeoff |
|---|---|---|---|
| full-copynative directory | selected | Portable, inspectable, native watchers | Copies bytes; disk cost is real |
| APFS clonecopy-on-write | experimental | Promising startup and physical growth | Must prove forced clone success without silent fallback |
| AgentFS 0.6.4SQLite + NFS | rejected | Portable delta and session model | Timed out twice before mutation on the tested macOS profile |
| Git worktreeVCS workspace | optional | Familiar branching and tooling | Requires Git and couples workspace mechanics to VCS state |
Important boundary
Workspace isolation is not hostile-code containment.
These agents are trusted and cooperative. Private directories prevent accidental overwrites and cross-visible dirt. They do not stop a same-user process from reading another path, opening a socket, or accessing credentials. Containers and microVMs solve a different problem.
This research separates:
- WorkspaceWhich files are visible and writable?
- DependenciesWhich mutable package graph is private?
- RuntimeWhich processes, ports, sockets, and temp paths collide?
- AuthorityWho may checkpoint, merge, or publish?
- SecurityWhat can untrusted code reach?
Open research artifact