Examples

The sandbox contract has a small compile-tested Go construction example. It shows the explicit OperationRequest shape and finite ResourceLimits; it does not start a sandbox because no public control transport or backend is composed yet.

Durable Chat now has a loopback web UI and terminal UI at examples/durable-chat. It uses only the public Go SDK/HTTP contract to create/resume Sessions, queue input, reconnect events by cursor, inspect state, and cancel Turns. Its web server owns the local SDK bearer so the browser never receives it.

All three loopback example web UIs protect their browser mutations with an ephemeral per-process CSRF token, exact same-HTTP-Origin validation, and a bounded form body. Reload the loopback page to obtain a current form; posting from another origin, omitting the token, or exceeding the form bound is refused before the public SDK is called. Each UI process also assigns request IDs safely when concurrent browser requests arrive.

The example is not a Codex subscription canary. The official production subscription Model surface remains blocked, so no example may label its model path subscription-verified until the protected live canary is retained.

Durable Chat, Workspace Agent, and Research Dossier are public-contract applications. Research Dossier is available as a loopback web or terminal binary. It creates a durable Session, queues ordered research steps, resumes Product events from an opaque Cursor, lists only caller-authorized Artifact metadata, and downloads each retained dossier Artifact through the same public SDK contract. Its citation index is derived from retained Artifact bytes; the browser never receives the runtime bearer credential.

See the Research Dossier tutorial for commands, the durable recovery model, and the boundary between public application calls and operator-composed model/tool workers. A local UI does not authorize an undeclared external tool or bypass the runtime Tool broker.

Workspace Agent currently has a public-SDK approval inbox slice: it lists, inspects, approves, denies, and cancels the Turn behind an owner-scoped Approval without exposing action arguments, capability material, or sandbox descriptors. It runs as a loopback web or terminal binary through the real public HTTP/SDK contract. Follow the Workspace approval tutorial to run that narrow loopback inbox. Its Workspace sandbox execution remains unavailable until the protected Firecracker profile has Linux/KVM evidence; this is not a runnable Workspace Agent completion claim.

Research Dossier has local public-contract evidence only. Its local fixture does not attest production deployment, a live provider subscription, or a Linux/KVM sandbox.