Status Summary
SandboxAgentWorkflow validates the numeric loss-injection boundary before provisioning, but it does not validate the selected provider. When injectLossAfterNCalls is used with a non-local provider, the workflow can provision a production sandbox, execute the requested number of tool calls, and create a checkpoint before InjectSandboxLossActivity rejects the provider. A development/test-only option can therefore leave real partial tool effects before reporting that the configuration is unsupported.
How to fix
Validate loss injection against the resolved provider before the first caller tool dispatch or checkpoint. Reject an explicitly selected non-local provider before provisioning when possible, and ensure a non-local default provider cannot execute caller work before rejection. Preserve deterministic, single-use local injection and normal cleanup. Add focused coverage for explicit and defaulted non-local provider selection that proves no tool or snapshot activity runs.
Delete when
A non-local loss-injection request fails before any caller tool-call or snapshot effect for both explicit and default provider selection, focused tests prove that no partial workload runs, and the local reconstruction demonstration still injects and recovers exactly once.
Status Summary
SandboxAgentWorkflowvalidates the numeric loss-injection boundary before provisioning, but it does not validate the selected provider. WheninjectLossAfterNCallsis used with a non-local provider, the workflow can provision a production sandbox, execute the requested number of tool calls, and create a checkpoint beforeInjectSandboxLossActivityrejects the provider. A development/test-only option can therefore leave real partial tool effects before reporting that the configuration is unsupported.How to fix
Validate loss injection against the resolved provider before the first caller tool dispatch or checkpoint. Reject an explicitly selected non-local provider before provisioning when possible, and ensure a non-local default provider cannot execute caller work before rejection. Preserve deterministic, single-use local injection and normal cleanup. Add focused coverage for explicit and defaulted non-local provider selection that proves no tool or snapshot activity runs.
Delete when
A non-local loss-injection request fails before any caller tool-call or snapshot effect for both explicit and default provider selection, focused tests prove that no partial workload runs, and the local reconstruction demonstration still injects and recovers exactly once.