Forkable Agent Sandbox

Problem

Real environments accumulate side effects that plain re-execution cannot undo. A migration has already altered the schema, a process has already written a lock file, a form has already been submitted in the browser session. Backtracking therefore means rebuilding the environment from scratch and replaying every earlier action, which is slow and not always faithful. Full-state duplication is the obvious alternative, but copying an entire sandbox costs hundreds of milliseconds to seconds per operation, which is far too slow to sit in the inner loop of a deep search or a large fan-out. So the agent either explores one path timidly or pays for a fresh environment per branch.

Solution

Give the sandbox a lifecycle rather than only a lifetime. A snapshot captures the complete machine state — filesystem, memory pages, process groups, and where it applies the GUI or browser session — as a restorable object. Forking that snapshot creates N branch contexts, each with an independent view of the filesystem and its own process group, sharing unmodified pages copy-on-write so a fork costs a delta rather than a full copy; measured implementations land in the low tens of milliseconds for a checkpoint and single-digit milliseconds for a rollback, which is what makes branching affordable inside a search loop. Each branch runs to a verdict: it commits, promoting its changes back into the parent, or it aborts and its state is discarded whole. When several siblings are exploring the same subproblem, the first successful commit wins and the runtime invalidates the rest, so no merge conflict has to be resolved by the model. Commit can be selective, promoting a chosen subset of changes rather than the whole branch, and contexts nest so a branch can itself fork for a sub-decision. Actions with effects outside the snapshot boundary are routed through a separate gate, because no rollback can retract them.

When to use

• The environment is expensive to rebuild — seeded databases, long installs, long-running processes, an authenticated browser or desktop session — and cannot be re-derived from a prompt.
• The agent runs a search, a best-of-N sampling loop or a reinforcement-learning rollout that needs frequent state restoration.
• Actions under consideration are destructive or hard to reverse, and trying one should not commit the whole run to it.
• Several candidate paths address the same subproblem and only one of them needs to survive.