Complete procedures with a way back.

Upload bounded datasets to an isolated Python container, validate generated summaries and files, preserve analysis evidence, control downloads, reconcile provider objects, and test sandbox failure modes.

Install and authenticate Codex CLI, establish project trust, write layered AGENTS.md instructions, create read-only and workspace-write profiles, constrain network access and approvals, and verify the effective configuration before real changes.

Threat-model every untrusted source and sensitive sink, minimize capabilities and context, enforce typed tools and egress, sandbox code, bind approvals, red-team end to end, and rehearse containment.

Evaluate an MCP server as executable supply chain and delegated authority, pin its identity, constrain a local runtime or verify a remote trust endpoint, configure a positive tool allowlist, review OAuth scopes, observe real effects, test prompt injection, set per-tool approvals and rehearse complete removal.

Measure the current unit, add compatible filesystem and privilege restrictions, validate application paths, and roll out hardening without breaking package upgrades.