Files under sandbox/workspace/ form the optional workspace seed for new runs.

​
Example

sandbox/workspace/
├── README.md
├── templates/
│   └── report.md
└── inputs/
    └── sample.json
Managed deployments package this directory into an immutable platform-owned seed.

​
New runs

When a new run starts:
  1. Salambo creates the sandbox from the active deployment.
  2. The seed is copied into an empty /workspace.
  3. /workspace becomes mutable state owned by the run.
  4. Successful turns checkpoint that workspace durably.

​
Existing runs

When an existing run moves to a newer deployment:
  1. Salambo checkpoints the existing workspace.
  2. It creates a replacement sandbox.
  3. It restores the run’s checkpoint into /workspace.
  4. It does not copy or merge the new deployment seed.
This prevents deployment changes from silently overwriting user or agent-generated files.

​
Decision rules

  • Put starter assets and templates in sandbox/workspace/.
  • Do not put secrets in seed files.
  • Treat seed changes as changes for new runs.
  • Use explicit runtime artifacts for files that should be downloadable from the run UI.
  • Use skills for immutable agent instructions, not mutable workspace documents.