Apache-2.0 agent-native sandbox (Linux FUSE/Landlock, macOS APFS clones+Seatbelt) gives agents a confined FS view with unified text diffs, binary markers, and per-task or per-tool-call commit/abort—optional JSON-RPC adapters for Pi and policy for secrets/network.
Google’s open AX runtime declares Task/Workspace/Model manifests on Agent Substrate: sandboxed agent jobs with git/MCP/skills pre-wired, suspend/resume, and ax ssh—aimed at high-throughput cluster runs of autonomous agents, not one laptop session.
Apache-2.0 terminal/VS Code/Zed agent (ACP) runs commands under Seatbelt/bubblewrap so writes stay in project+temp+caches, network is closed unless allowlisted, edits ask first, team policy can't be loosened by a cloned repo, and an outside hash-chained audit log verifies with /audit verify.