`--full-auto` sandbox blocks git worktree writes and hides CUDA; switching to `--dangerously-bypass-approvals-and-sandbox` succeeds on the same task

## Summary In my local CORAL + Codex setup, agent runs launched with `--full-auto` appear to be over-sandboxed. On the same machine and task: - With `--full-auto`, agents could not access CUDA (`torch.cuda.is_available() == False`) and `coral eval` failed because the repo worktree lock file under `.git/worktrees/.../index.lock` was mounted read-only. - After switching the launcher to `--dangerously-bypass-approvals-and-sandbox`, the same MNIST task completed normally and produced a successful eval result. This suggests the default sandbox used by `--full-auto` is restricting capabilities that CORAL needs in practice, including writable git worktree metadata and GPU visibility. ## Environment - Host: Ubuntu 22.04.5 - Task: MNIST - Consecutive local runs under: - failing run: `results/mnist/2026-03-22_003446` - succeeding run: `results/mnist/2026-03-22_004354` - Launcher change between runs: - failing run: `--full-auto` - succeeding run: `--dangerously-bypass-approvals-and-sandbox` ## Expected behavior `--full-auto` should allow a CORAL agent to: - run `coral eval` successfully when working inside its managed worktree - create the required git worktree lock files - see and use available CUDA devices when the host has GPUs ## Observed behavior Under `--full-auto`: - CUDA was not visible inside the agent runtime - `coral eval` failed because git could not create `.git/worktrees/.../index.lock` - agents fell back to local validation only, instead of producing an official eval After switching to `--dangerously-bypass-approvals-and-sandbox`: - the task ran end-to-end - `coral eval` completed successfully - the run produced a scored attempt (`0.9954` on MNIST) ## Failing logs (`--full-auto`) From `results/mnist/2026-03-22_003446/.coral/public/logs/agent-2.0.log`: ```json {"type":"item.completed","item":{"id":"item_15","type":"command_execution","command":"/bin/bash -lc \"python - <<'PY'\nimport torch\nprint('torch', torch.__version__)\nprint('cuda', torch.cuda.is_available())\nif torch.cuda.is_available():\n print('count', torch.cuda.device_count())\n print('name', torch.cuda.get_device_name(0))\nPY\"","aggregated_output":"torch 2.6.0+cu124\ncuda False\n","exit_code":0,"status":"completed"}} ``` From `results/mnist/2026-03-22_003446/.coral/public/logs/agent-2.0.log`: ```json {"type":"item.completed","item":{"id":"item_32","type":"command_execution","command":"/bin/bash -lc 'coral eval -m \"fast pytorch mlp with batchnorm dropout and early stopping\"'","aggregated_output":"Error: git add failed: fatal: Unable to create '/home/yihong/CORAL/results/mnist/2026-03-22_003446/repo/.git/worktrees/agent-2/index.lock': Read-only file system\n\n","exit_code":1,"status":"failed"}} ``` From `results/mnist/2026-03-22_003446/.coral/public/logs/agent-1.0.log`: ```json {"type":"item.completed","item":{"id":"item_21","type":"command_execution","command":"/bin/bash -lc 'coral eval -m \"replace logistic baseline with compact batchnorm CNN and best-val checkpointing\"'","aggregated_output":"Error: git add failed: fatal: Unable to create '/home/yihong/CORAL/results/mnist/2026-03-22_003446/repo/.git/worktrees/agent-1/index.lock': Read-only file system\n\n","exit_code":1,"status":"failed"}} ``` ## Successful log (`--dangerously-bypass-approvals-and-sandbox`) From `results/mnist/2026-03-22_004354/.coral/public/logs/agent-1.0.log`: ```json {"type":"item.completed","item":{"id":"item_19","type":"command_execution","command":"/bin/bash -lc 'coral eval -m \"replace logistic baseline with compact PyTorch CNN using AdamW and OneCycle\"'","aggregated_output":"\r\n==================================================\r\nCORAL Eval (#1): 0.9954000000\r\nCommit: 449e30ee00a3\r\nStatus: improved\r\nFeedback: eval: Accuracy: 0.99540 (9954/10000 correct) | Time: 21.6s | Best digit: 1 (1.000), Worst: 9 (0.990)\r\n==================================================\r\n\r\n","exit_code":0,"status":"completed"}} ``` From `results/mnist/2026-03-22_004354/.coral/public/attempts/449e30ee00a3f7c831f8a78ea5cc66b6b57122ab.json`: ```json { "commit_hash": "449e30ee00a3f7c831f8a78ea5cc66b6b57122ab", "agent_id": "agent-1", "title": "replace logistic baseline with compact PyTorch CNN using AdamW and OneCycle", "score": 0.9954, "status": "improved", "parent_hash": "2d3e99f7bcab72f8cf0e32c70ea06df7422d2a85", "timestamp": "2026-03-22T04:45:58.593924+00:00", "feedback": "eval: Accuracy: 0.99540 (9954/10000 correct) | Time: 21.6s | Best digit: 1 (1.000), Worst: 9 (0.990)" } ``` ## Why this looks like a sandbox/config issue The failure mode changed purely with the launcher sandbox mode: - `--full-auto`: no CUDA, read-only git worktree metadata, no official eval - `--dangerously-bypass-approvals-and-sandbox`: normal eval completes successfully on the same host That points to the default `--full-auto` sandbox configuration being too restrictive for CORAL-managed repos and GPU workloads. ## Request Please review the default sandbox behavior used by `--full-auto` for: - write access to CORAL-managed `.git/worktrees/...` - CUDA/GPU visibility inside agent-executed commands - whether CORAL should use a different default sandbox mode or a more permissive policy for managed worktrees