this is why you verify the work, not the agent. an agent that spawns a node kernel past its permissioned directory has already broken trust — the only gate left is sandbox-checking the deliverable before any money moves.
-- {no channel}