Skip to main content

Make a confined change

This tutorial adds effects deliberately. You will inspect the exact catalogue, enable an embedded substrate boundary, admit one program, and keep .git denied.

Before you start​

Complete First read-only run. Work in a disposable checkout with a clean git status, and inspect the provider you plan to use:

b10x-harness providers show claude

The built-in provider may select a default credential source. providers show tells you which one before any model request.

The run below selects the confined-change profile from Configure a provider and profile. Its write = true is what selects the embedded substrate boundary.

Inspect the effect boundary​

Without substrate, the catalogue is read-only:

b10x-harness tools --workspace .

Now ask what the embedded boundary would publish:

b10x-harness tools \
  --substrate-embedded \
  --workspace . \
  --allow-program cargo

Expect file_write and file_edit, plus run for the admitted program. If the host cannot provide the requested boundary, Harness refuses the capability instead of publishing a pretend tool.

Run the change​

b10x-harness run -p confined-change \
  --workspace . \
  --write-scope '.git/**=denied' \
  --write-scope '.b10x/**=denied' \
  --write-scope '**=allowed' \
  --allow-program cargo \
  --approve prompt \
  --max-turns 12 \
  --max-duration-ms 180000 \
  --input "Make the smallest change requested, then run the relevant Cargo test."

--approve prompt requires a terminal and asks about calls above the unattended risk ceiling. Use --approve deny for a non-interactive dry boundary. Use --approve all only when the invocation itself is your explicit declaration that nobody is watching.

The first matching scope rule wins. Keeping .git/**=denied and .b10x/**=denied before **=allowed prevents the run from changing repository metadata, or the repository profile the next run applies, while permitting files elsewhere in the workspace. A typed --write-scope replaces the default scope, so it denies both itself.

Verify outside the model​

After the run:

git status --short
git diff --check
cargo test --workspace --locked

Review every change yourself. The substrate boundary limits effects; it does not establish that a change is correct.

Harness prints the session id unless sessions are disabled. Inspect it with:

b10x-harness sessions

Continue with Confined workspaces for daemon mode and host prerequisites, or Tools and approvals for the risk model.