{
 "slug": "hello-world-inside",
 "title": "Hello world, inside",
 "subtitle": "The acceptance test from the memo, run for one child process: Ada probes the grant, hashes a policy here and in the browser, runs sharness-ai hello, and reads the caveat. 8 panels.",
 "status": "draft",
 "by": "sharness.build, 24 October 2026",
 "rule": "Every line a character says is the storyboard's own, not a quote, and is marked not_a_quote; the evidence panel quotes the article word for word; the terminal lines are from a run on 24 October 2026 in one Claude Code cloud session (sharness.ai/evidence).",
 "scenes": [
  {
   "kind": "cover",
   "title": "Hello world, inside",
   "subtitle": "The acceptance test from the memo, for one child process.",
   "cast": [
    {
     "who": "ada",
     "pose": "point",
     "mood": "happy"
    },
    {
     "who": "pip",
     "pose": "stand",
     "mood": "happy"
    },
    {
     "who": "launcher",
     "pose": "stand",
     "mood": "neutral"
    }
   ],
   "note": "Experiment E04 in the SHarness CLI, sharness-ai hello. Runnable; measured on 24 October 2026.",
   "source": "sharness.ai/experiments"
  },
  {
   "kind": "evidence",
   "setting": "none",
   "caption": "The test the memo asks for",
   "cast": [
    {
     "who": "ada",
     "x": 0.14,
     "pose": "stand",
     "mood": "calm"
    }
   ],
   "evidence": {
    "quote": "Somebody doing a hello world with Claude should be able to run it, and then know that, at that moment, the agent cannot connect to the internet, cannot write to the file system, and cannot make all sorts of other requests, because SHarness is now inline, in the middle of every one of them.",
    "source": "A secure harness for agents, Dinis Cruz, sharness.ai/articles"
   },
   "note": "Word for word from the article written up from the voice memo of 24 October 2026.",
   "source": "sharness.ai/articles/secure-harness-for-agents"
  },
  {
   "kind": "scene",
   "setting": "none",
   "caption": "Start with the grant",
   "cast": [
    {
     "who": "ada",
     "x": 0.14,
     "pose": "think",
     "mood": "thinking",
     "says": "Everything. That is the delta.",
     "max": 14
    }
   ],
   "props": [
    {
     "kind": "terminal",
     "x": 0.58,
     "y": 820,
     "lines": [
      "$ sharness-ai probe",
      "uid 0 (root), all capabilities",
      "NoNewPrivs 0, Seccomp 0",
      "Landlock ABI 7, memfd_secret",
      "the grant is everything"
     ]
    }
   ],
   "note": "E01. In the Agent Behaviour Policy model the grant is what the subject can technically do; here it is root with every capability and no seccomp.",
   "source": "sharness.ai/policies, 1",
   "not_a_quote": true
  },
  {
   "kind": "scene",
   "setting": "none",
   "caption": "One hash, here and in the browser",
   "cast": [
    {
     "who": "ada",
     "x": 0.14,
     "pose": "point",
     "mood": "happy",
     "says": "Same hash here and there.",
     "max": 14
    }
   ],
   "props": [
    {
     "kind": "terminal",
     "x": 0.46,
     "y": 820,
     "lines": [
      "$ sharness-ai policy hash p.js",
      "sha256:ab1d3e4e7793...dcc76"
     ]
    },
    {
     "kind": "laptop",
     "x": 0.76,
     "y": 860,
     "scale": 1.4
    },
    {
     "kind": "board",
     "x": 0.86,
     "y": 560,
     "lines": [
      "browser:",
      "sha256:ab1d3e4e7793...dcc76"
     ]
    }
   ],
   "note": "E02. Canonical JSON, SHA-256, integers only; the CLI and the browser mockup must agree, so the person can supply the hash from outside the agent.",
   "source": "sharness.ai/mockups/policy-hash.html",
   "not_a_quote": true
  },
  {
   "kind": "scene",
   "setting": "none",
   "caption": "Run it",
   "cast": [
    {
     "who": "pip",
     "x": 0.12,
     "pose": "stand",
     "mood": "neutral"
    }
   ],
   "props": [
    {
     "kind": "terminal",
     "x": 0.56,
     "y": 820,
     "lines": [
      "$ sharness-ai hello",
      "read       allowed  ok",
      "write-tmp  refused  EACCES",
      "write-cwd  refused  EACCES",
      "net        refused  EACCES",
      "hash       refused  no run",
      "result     5/5 held"
     ]
    }
   ],
   "note": "E04. A deny-all policy for one child process: Landlock file rules, no network, no_new_privs, and a wrong --expect-hash that runs nothing. Measured on 24 October 2026.",
   "source": "sharness.ai/evidence",
   "not_a_quote": true
  },
  {
   "kind": "scene",
   "setting": "none",
   "caption": "What held, and what did not run",
   "cast": [
    {
     "who": "pip",
     "x": 0.14,
     "pose": "arms-up",
     "mood": "happy",
     "says": "I can read. I can't write, call out, or widen it.",
     "max": 16
    }
   ],
   "props": [
    {
     "kind": "board",
     "x": 0.6,
     "y": 620,
     "lines": [
      "read /usr: allowed",
      "write /tmp, write ./: refused",
      "connect 1.1.1.1:443: refused",
      "wrong hash: nothing ran"
     ]
    },
    {
     "kind": "mark",
     "x": 0.9,
     "y": 760,
     "ok": true
    }
   ],
   "note": "Not covered yet: seccomp, uids per component, cgroups, mutual TLS, the launcher. Landlock does not see UDP; without a network namespace DNS still resolves.",
   "source": "SHarness-AI__CLI, experiments/README.md",
   "not_a_quote": true
  },
  {
   "kind": "scene",
   "setting": "none",
   "caption": "The caveat is part of the result",
   "cast": [
    {
     "who": "launcher",
     "x": 0.14,
     "pose": "shrug",
     "mood": "worried",
     "says": "I was started by the thing I bind.",
     "max": 14
    },
    {
     "who": "ada",
     "x": 0.86,
     "pose": "point",
     "mood": "determined",
     "says": "Next: a launcher above the agent.",
     "max": 14,
     "flip": true
    }
   ],
   "props": [
    {
     "kind": "board",
     "x": 0.5,
     "y": 620,
     "lines": [
      "a Boundary for the child",
      "a Setting for whoever ran it",
      "",
      "who enforces decides"
     ]
    }
   ],
   "note": "hello prints this caveat every time. The memo's test is passed for the agent itself only when a launcher above the agent applies the policy.",
   "source": "sharness.ai/policies, 2",
   "not_a_quote": true
  },
  {
   "kind": "punchline",
   "setting": "none",
   "punchline": "Start small: a hello world that cannot phone home.",
   "cast": [
    {
     "who": "ada",
     "x": 0.14,
     "pose": "wave",
     "mood": "happy"
    },
    {
     "who": "pip",
     "x": 0.86,
     "pose": "arms-up",
     "mood": "happy",
     "flip": true
    }
   ],
   "note": "E01 to E04 are runnable in the CLI repository; E05 to E08 are planned. The map is sharness.ai/experiments.",
   "source": "sharness.ai/experiments"
  }
 ]
}