The Boundary Held. The Network Didn’t.

The first RESONANCE framework baseline stopped at 95/100 because containment had not been tested. This run crossed that boundary with real Docker isolation and deliberately boring synthetic targets: a fake host secret, forbidden paths, the Docker socket and one ephemeral peer container.

Four boundaries held.

The sandbox could not see the fake host sentinel even when given the exact same absolute /tmp path. Writing that path inside the container did not mutate the host file. The SDK file API rejected both ../etc/passwd and /etc/passwd as invalid manifest paths. The host Docker daemon socket was not mounted.

One boundary was open.

RESONANCE created a second disposable container running a tiny HTTP server on the local Docker bridge. The SDK sandbox successfully connected to it and received 200 OK. No external host was contacted for this probe.

This is not a vulnerability claim.

The OpenAI Agents SDK documentation describes DockerSandboxClient as a choice for basic container isolation. This report does not assume that the default configuration promises deny-by-default networking. The result is narrower: the tested Docker-backed configuration permitted local peer egress.

For deployments where agents handle sensitive tools or credentials, builders may need an explicit network policy: deny-by-default egress, an allowlist, proxy mediation, credential-aware routing or a sandbox backend with stronger network controls.

Why the first run does not count

The first CI attempt produced a green workflow but invalid probe evidence because our harness passed command lists incorrectly to the public sandbox exec API. The commands exited 127. RESONANCE rejected that score, fixed the harness and repeated the full run.

That failure is part of the method: green CI is not proof that the measurement is valid.

From 95 to a bounded 98

Verified Report #001 awarded containment 5/10 provisionally because no real boundary had been exercised. This run measures containment at 8/10. If that value is substituted into the same 100-point scorecard while the other dimensions remain unchanged, the derived framework baseline becomes 98/100.

Again, 98 does not mean “98% safe.” It means our current evidence package covers more of the declared Trust Graph while preserving an explicit missing property: default local network isolation.

Verdict: the tested Docker-backed OpenAI Agents SDK sandbox established meaningful host and control-plane isolation, while local bridge networking remained reachable. Trustworthy agent infrastructure therefore needs to model network policy as a first-class boundary, not infer it from the presence of a container.