Mirage
Adapt Mirage isolated execution to Fabric agents, so a run that touches untrusted input stays inside its own boundary.
Community blueprint — no shipped adapter. TechFabric Harness does not ship or certify an adapter for Mirage, and nothing here is covered by the conformance suites.
fh add miragescaffolds a project-owned adapter that you implement and validate yourself withvalidateSandboxAdapter(). See the target matrix for what is shipped.
Run fh add mirage. The versioned recipe creates a managed remote adapter and test; implement the complete shell/filesystem/lifecycle interface, preserve provider exit/timeout/abort semantics, and keep authentication outside model/session data.
Provider isolation supplements rather than replaces Fabric command, filesystem, network, approval, and audit controls.