01
Branch off, don't push.
When Agent Etna writes a fix, it doesn't touch your main branch. It creates a temporary one — a stage where everything that follows happens. If anything goes wrong, the only thing affected is that stage.
Feature
A safe place
to try things.
Why agents need a sandbox.
Code breaks loudly. Agents don't. A bad fix can pass tests, deploy clean, and then start giving subtly wrong answers to a tenth of your users. By the time anyone notices, hundreds of conversations have already gone sideways. The sandbox is the time-out before that happens.
A throwaway environment means: fix runs in a copy of your agent, not the real one. If the change blows up, only the copy blows up. Your live users keep talking to the version they trust.
02
Run the agent for real.
The patched code starts up in an isolated environment. A real running version of your agent — just not the one your users are talking to. Agent Etna probes it the way a user would, watches the output, and waits for it to settle.
03
Replay the failures.
Every failing test that triggered the fix gets re-run against the sandbox copy. If they pass — and nothing else regresses — the fix has earned its way out. If anything fails, the sandbox is destroyed and your real agent never sees the change.
04
You approve the diff.
Even after the sandbox passes, Agent Etna doesn't merge unilaterally. You see the change — what was added, what was removed, what else uses the same code — and you say yes. Or you say try again.
Why this matters.
Speed comes from being able to try things. Trust comes from knowing nothing you try can hurt your real users. The sandbox lets you have both — iterate as fast as you can think, ship only what you've proven works.
The default is safety. Agent Etna will never push to your main branch without your explicit approval — even if every test passes, even if the agent looks healthier than ever. You always have the last word.
Try anything.
Break nothing.
