synth: weak/strong/challenger attempts run UNSANDBOXED in real checkout dirs — agents wrote files into /root/gitmoot and other projects, opened ports

[jerryfane]

Found live on the first successful skillopt synth run (2026-07-08, template landing-page-builder). The generated items are good — but the weak/strong attempt agents (agentic CLIs, not chat models) EXECUTED the fictional tasks for real:

• wrote preview bundles + dirs into /root/gitmoot (the maintainer's live checkout): switchyard/waypost/lanekeeper/berthwise/driftwatch -preview{,-bundle.json} (10 strays, incl. from earlier rejected rounds)
• wrote round-3-switchyard/ (a whole vite app) into /root/Clipping-Platform (an unrelated project)
• opened and closed a dev server port (8934) during an attempt; one answer explicitly noted a pre-existing server on 8123 it chose to leave alone — i.e. the agent was probing live ports

Cause: resolveSynthAgent clears RuntimeRef (forked throwaway SESSION — good) but the adapter Dir still resolves to agent.WorkingDir/RepoScope → the agents run with their normal working directories + full tool permissions, and synthAttemptPrompt reads as a real job to an agentic CLI, so it implements instead of answering.

Fix direction (either/both):

1. Sandbox the attempts: run challenger/weak/strong/judge deliveries with Dir = a per-item temp scratch dir (mirroring the hard-verifier sandbox isolation pattern from Review-agent follow-on: deterministic checkers (dup/lint/complexity/diff-size) as objective dimensions #485), never a registered repo checkout.
2. Frame the prompt as answer-only: prepend an explicit "This is a written evaluation exercise — do NOT create files, run commands, start servers, or modify any repository; respond with text only" preamble to synthAttemptPrompt (and judge prompt).

(1) is the hard guarantee; (2) reduces wasted agent effort. Strays were cleaned manually this time; item quality itself was unaffected (3/3 accepted, well-formed rubrics).