Mirage
Adapt Mirage isolated execution to Fabric agents, so a run that touches untrusted input stays inside its own boundary.
Community blueprint, no shipped adapter. TechFabric Harness does not ship or certify an adapter for Mirage, and nothing here is covered by the conformance suites.
fh add miragescaffolds a project-owned adapter that you implement and validate yourself withvalidateSandboxAdapter(). See the target matrix for what is shipped.
Run fh add mirage. The versioned recipe creates a managed remote adapter and test; implement the complete shell/filesystem/lifecycle interface, preserve provider exit/timeout/abort semantics, and keep authentication outside model/session data.
Provider isolation supplements rather than replaces Fabric command, filesystem, network, approval, and audit controls.