sandcastle-runner
Installation
SKILL.md
sandcastle-runner
The Pi-CEO ↔ Sandcastle bridge. One subprocess boundary. Every other Wave 5 skill builds on this primitive.
Why this exists
Pi-CEO's existing AFK pipeline runs code in /tmp/pi-ceo-workspaces/{sid}/ git clones — branch isolation only, no container, no resource limits, no permission gating. Acceptable for low-risk autonomy; insufficient for real AFK execution against real production secrets.
Matt Pocock's Sandcastle ships container isolation + a parallel-implementer pattern + provider-pluggable agents. We treat it as a binary: one npx sandcastle run per code-executing job, parsed via JSON stdout, stdout streamed into existing session.logs so the dashboard SSE keeps working unchanged.