---
title: "live.agent-sandbox-worker-request@1 · OpenVibe.Services"
canonical: "https://openvibe.services/docs/contracts/live.agent-sandbox-worker-request"
updated: null
---

# live.agent-sandbox-worker-request@1 · OpenVibe.Services

HTML: [live.agent-sandbox-worker-request@1 · OpenVibe.Services](https://openvibe.services/docs/contracts/live.agent-sandbox-worker-request)

# LiveAgentSandboxWorkerRequest `live.agent-sandbox-worker-request@1`

Generated at 2026-11-13 06:25:48 UTC from [`openvibe-contracts v0.419.0`](https://github.com/OpenVibers/OpenVibe.Contracts/tree/v0.419.0) and [`openvibe-sdk v0.161.0`](https://github.com/OpenVibers/OpenVibe.SDK/tree/v0.161.0).

- Version: 1.0.0
- Owner: live
- Visibility: first-party
- Status: active
- Compatibility: backward
- Schema: [`https://openvibe.network/contracts/live/agent-sandbox-worker-request.v1.json`](/docs/contracts/live.agent-sandbox-worker-request.json)

live.agent-sandbox-worker-request@1 (Agent Streams S6): the body of POST /api/streams/agent/:id/plays/worker on OpenVibe.Live (capability live.agent\_sandbox.register). It is the sandbox worker's own check-in: the worker says it is there and reports the isolation facts Live requires, and Live derives health only from that check-in (it stores no endpoint and never calls the worker). Only a first-party service token whose principal holds live.agent\_sandbox.register may send it, and it names the person it works for in X-OV-Subject, who must own the stream. The owner's session, a desk ticket and a person token are refused. Live counts a check-in within the last minute as alive and requires isolation to say exactly: host\_network false, credentials false, profile false, egress\_proxy true, workspace 'ephemeral'. The worker may report more than these five facts (its own checks, limits and versions); Live reads only the five and stores the report it was given. A worker that cannot say each of the five is not registered at all.

## Fields

| Field | Type | Required | Description | Constraints |
| --- | --- | --- | --- | --- |
| `worker_id` | string |  | The worker's name in its own records; not a secret and not an address. | - `maxLength 64` |
| `service` | string |  | The worker implementation that checked in (\`codes-sandbox\` for OpenVibe.Codes'). | - `maxLength 64` |
| `version` | string |  |  | - `maxLength 64` |
| `ready` | boolean |  | The worker's own view of its health; Live's health is the check-in plus the isolation report, never this flag alone. |  |
| `reasons` | array of string |  | Why the worker says it is not ready (its self-test's failures), for the owner's page. | - `maxItems 10`<br>- `items: maxLength 500` |
| `checks` | object |  | The worker's self-test: one boolean per check it ran (the network namespace, the egress refusals, the cleaned environment, the host files, the capabilities, seccomp, the cgroup limits, the wipe). |  |
| `checked_at` | string \| null |  | When that self-test ran; null before the first one. | - `format date-time` |
| `isolation` | object | yes |  |  |
| `isolation.host_network` | const | yes | The sandbox has its own network namespace; it cannot reach the host's network. | - `= false` |
| `isolation.credentials` | const | yes | No credential of the host, the worker or the person is inside the sandbox. | - `= false` |
| `isolation.profile` | const | yes | No browser or desktop profile of the host's is mounted. | - `= false` |
| `isolation.egress_proxy` | const | yes | Its only way out is the worker's proxy, which applies the egress guard. | - `= true` |
| `isolation.workspace` | const | yes | The workspace is the sandbox's own and is gone with the wipe. | - `= "ephemeral"` |
| `browser` | boolean |  | Whether this worker has the optional headless browser. |  |
| `capacity` | integer |  | How many sandboxes it may run at once. | - `minimum 1` |
| `active` | integer |  | How many are running now. | - `minimum 0` |
| `at` | string |  | When the worker assembled the report. | - `format date-time` |

## Examples

From the contract's own test fixtures: valid ones validate, rejected ones must fail.

 Valid: isolation-only

~~~~
{
  "isolation": {
    "host_network": false,
    "credentials": false,
    "profile": false,
    "egress_proxy": true,
    "workspace": "ephemeral"
  }
}
~~~~

Valid: worker-check-in

~~~~
{
  "worker_id": "sbw-ovhost",
  "service": "codes-sandbox",
  "version": "0.7.0",
  "ready": true,
  "checks": {
    "network_namespace": true,
    "no_direct_egress": true,
    "egress_refuses_private": true,
    "clean_env": true,
    "no_host_files": true,
    "no_capabilities": true,
    "seccomp": true,
    "limits": true,
    "wipe": true
  },
  "checked_at": "2026-11-07T12:00:00.000Z",
  "isolation": {
    "sandbox": "bubblewrap",
    "bubblewrap": "0.9.0",
    "user_namespace": true,
    "network_namespace": true,
    "egress": {
      "via": "proxy",
      "public_only": true,
      "ports": [
        80,
        443
      ],
      "direct": "none"
    },
    "host_credentials": "none",
    "host_files": "none",
    "capabilities": "none",
    "seccomp": true,
    "host_network": false,
    "credentials": false,
    "profile": false,
    "egress_proxy": true,
    "workspace": "ephemeral",
    "workspace_kind": "tmpfs, wiped with the sandbox",
    "limits": {
      "kind": "cgroup",
      "enforced": true,
      "memory_mb": 2048,
      "disk_mb": 512,
      "pids": 256,
      "cpu_percent": 100,
      "time_box_minutes": [
        5,
        30
      ]
    }
  },
  "browser": false,
  "capacity": 2,
  "active": 0,
  "at": "2026-11-07T12:00:00.000Z"
}
~~~~

Rejected: no-profile-fact

~~~~
{
  "isolation": {
    "host_network": false,
    "credentials": false,
    "egress_proxy": true,
    "workspace": "ephemeral"
  }
}
~~~~

Rejected: not-host-isolated

~~~~
{
  "isolation": {
    "host_network": true,
    "credentials": false,
    "profile": false,
    "egress_proxy": true,
    "workspace": "ephemeral"
  }
}
~~~~

## Validate

~~~~
const contracts = require('openvibe-contracts');
contracts.validate('live.agent-sandbox-worker-request@1', value);   // { valid, errors: [{ path, message }] }
~~~~