LiveAgentSandboxWorkerRequest live.agent-sandbox-worker-request@1

Generated at from openvibe-contracts v0.419.0 and openvibe-sdk v0.161.0.

Version
1.0.0
Owner
live
Visibility
first-party
Status
active
Compatibility
backward
Schema
https://openvibe.network/contracts/live/agent-sandbox-worker-request.v1.json

live.agent-sandbox-worker-request@1 (Agent Streams S6): the body of POST /api/streams/agent/:id/plays/worker on OpenVibe.Live (capability live.agent_sandbox.register). It is the sandbox worker's own check-in: the worker says it is there and reports the isolation facts Live requires, and Live derives health only from that check-in (it stores no endpoint and never calls the worker). Only a first-party service token whose principal holds live.agent_sandbox.register may send it, and it names the person it works for in X-OV-Subject, who must own the stream. The owner's session, a desk ticket and a person token are refused. Live counts a check-in within the last minute as alive and requires isolation to say exactly: host_network false, credentials false, profile false, egress_proxy true, workspace 'ephemeral'. The worker may report more than these five facts (its own checks, limits and versions); Live reads only the five and stores the report it was given. A worker that cannot say each of the five is not registered at all.

Fields

FieldTypeRequiredDescriptionConstraints
worker_idstringThe worker's name in its own records; not a secret and not an address.
  • maxLength 64
servicestringThe worker implementation that checked in (`codes-sandbox` for OpenVibe.Codes').
  • maxLength 64
versionstring
  • maxLength 64
readybooleanThe worker's own view of its health; Live's health is the check-in plus the isolation report, never this flag alone.
reasonsarray of stringWhy the worker says it is not ready (its self-test's failures), for the owner's page.
  • maxItems 10
  • items: maxLength 500
checksobjectThe worker's self-test: one boolean per check it ran (the network namespace, the egress refusals, the cleaned environment, the host files, the capabilities, seccomp, the cgroup limits, the wipe).
checked_atstring | nullWhen that self-test ran; null before the first one.
  • format date-time
isolationobjectyes
isolation.host_networkconstyesThe sandbox has its own network namespace; it cannot reach the host's network.
  • = false
isolation.credentialsconstyesNo credential of the host, the worker or the person is inside the sandbox.
  • = false
isolation.profileconstyesNo browser or desktop profile of the host's is mounted.
  • = false
isolation.egress_proxyconstyesIts only way out is the worker's proxy, which applies the egress guard.
  • = true
isolation.workspaceconstyesThe workspace is the sandbox's own and is gone with the wipe.
  • = "ephemeral"
browserbooleanWhether this worker has the optional headless browser.
capacityintegerHow many sandboxes it may run at once.
  • minimum 1
activeintegerHow many are running now.
  • minimum 0
atstringWhen the worker assembled the report.
  • format date-time

Examples

From the contract's own test fixtures: valid ones validate, rejected ones must fail.

Valid: isolation-only
{
  "isolation": {
    "host_network": false,
    "credentials": false,
    "profile": false,
    "egress_proxy": true,
    "workspace": "ephemeral"
  }
}
Valid: worker-check-in
{
  "worker_id": "sbw-ovhost",
  "service": "codes-sandbox",
  "version": "0.7.0",
  "ready": true,
  "checks": {
    "network_namespace": true,
    "no_direct_egress": true,
    "egress_refuses_private": true,
    "clean_env": true,
    "no_host_files": true,
    "no_capabilities": true,
    "seccomp": true,
    "limits": true,
    "wipe": true
  },
  "checked_at": "2026-11-07T12:00:00.000Z",
  "isolation": {
    "sandbox": "bubblewrap",
    "bubblewrap": "0.9.0",
    "user_namespace": true,
    "network_namespace": true,
    "egress": {
      "via": "proxy",
      "public_only": true,
      "ports": [
        80,
        443
      ],
      "direct": "none"
    },
    "host_credentials": "none",
    "host_files": "none",
    "capabilities": "none",
    "seccomp": true,
    "host_network": false,
    "credentials": false,
    "profile": false,
    "egress_proxy": true,
    "workspace": "ephemeral",
    "workspace_kind": "tmpfs, wiped with the sandbox",
    "limits": {
      "kind": "cgroup",
      "enforced": true,
      "memory_mb": 2048,
      "disk_mb": 512,
      "pids": 256,
      "cpu_percent": 100,
      "time_box_minutes": [
        5,
        30
      ]
    }
  },
  "browser": false,
  "capacity": 2,
  "active": 0,
  "at": "2026-11-07T12:00:00.000Z"
}
Rejected: no-profile-fact
{
  "isolation": {
    "host_network": false,
    "credentials": false,
    "egress_proxy": true,
    "workspace": "ephemeral"
  }
}
Rejected: not-host-isolated
{
  "isolation": {
    "host_network": true,
    "credentials": false,
    "profile": false,
    "egress_proxy": true,
    "workspace": "ephemeral"
  }
}

Validate

const contracts = require('openvibe-contracts');
contracts.validate('live.agent-sandbox-worker-request@1', value);   // { valid, errors: [{ path, message }] }