Agentic Sandbox

• 

  Current post-lock recovery with human Packaging lock, stale-write rejection, and receipt-backed evidence.

• 

  Six narrow WebMCP Site Tools discovered in the live host.

• 

  Scenario comparison: same output, cheaper standard-supplier plan passes the cost cap.

• 

  Deterministic lock-bound proof: 9,252 < 10,937 under the human Packaging lock.

The problem

Factory planning decisions rarely happen in one place. They move through dashboards, spreadsheets, a simulation specialist, and an approval meeting, and each handoff loses context and authority. A generic assistant can make that worse by recommending a control that an operator has just taken off the table.

What it does

Agentic Sandbox makes the website itself the shared, inspectable decision surface. It is a deterministic factory decision lab where a human and a browser agent plan against the same versioned state.

The demo mission is concrete: increase good output by at least 20%, keep total cost within 8% of baseline, add no machine, and do not increase defects. The agent reads the line, creates two bounded hypotheses, simulates a 16-hour shift, and compares immutable receipts. Scenario A reaches 11,114 good units but costs €47,670.51 and fails the cost cap. Scenario B reaches the same 11,114 units for €45,170.51 and passes all four constraints.

Then comes the important moment: while the agent is working, the human locks Packaging. That click advances the factory revision and makes earlier evidence historical. The agent’s next write still carries the old revision, so it fails atomically with STALE_FACTORY; nothing is applied or silently rebased. The agent re-reads the authority state, replans with only controls that remain available, and receives an auditable answer: under the Packaging lock, at most 9,252 good units are possible while the mission requires 10,937. The target is proven infeasible by deterministic evidence, not by model prose.

That safe disagreement is the product. The human can change the admissible action space without restarting the conversation, and the agent can recover without overriding the new rule.

Why WebMCP is essential

Without WebMCP, the agent would have to infer state from pixels and click by coordinates, or the product would need a separate chatbot and backend with a second source of truth. Instead, the page exposes exactly six narrow Site Tools through document.modelContext.registerTool:

1. get_factory_snapshot
2. get_scenario_snapshot
3. create_scenario
4. apply_scenario_changes
5. run_factory_simulation
6. compare_simulation_runs

The human interface and these tools share one application-owned command bus. Schemas are closed, handlers validate independently, and every mutation carries a request ID plus expected factory, scenario, and lock revisions. There is deliberately no agent-accessible lock, unlock, force, arbitrary patch, optimizer, ERP, PLC, SCADA, or machine-control tool. Human authority stays human.

How it was built

Agentic Sandbox is a self-contained React 19 + TypeScript + Vite app deployed on Vercel. The deterministic engine models 64 fixed ticks, uses integer/fixed-point arithmetic, and computes production, defects, energy, cost, constraints, invariants, and bottleneck evidence in the page. Each simulation creates an immutable, content-addressed SHA-256 receipt with exact operands, accepted/rejected operations, tick-level state, and an optional lock-bound proof. No displayed KPI comes from the language model.

The hardest implementation problem was making a mid-plan disagreement trustworthy rather than dramatic: old authority must fail closed without erasing evidence that was valid when created. That required explicit revision precedence, atomic stale-write rejection, immutable receipts, and visible current-versus-historical states. The submitted flow was replayed against the public deployment in a supported WebMCP host, including discovery, comparison, the human lock, stale rejection, re-read, replan, and proof.

What I learned

WebMCP is most useful when a website already owns meaningful state, rules, and actions. Exposing those capabilities directly is more reliable than asking an agent to reconstruct them from pixels. A refusal can be more valuable than another recommendation: STALE_FACTORY proves that human authority survived concurrency, and 9252 < 10937 proves why the target cannot be met under the active lock.

Potential impact and what’s next

The first users I have in mind are plant planners, industrial engineers, and continuous-improvement teams working on line balancing, shift planning, and supplier what-if analysis. A production version could connect this exact capability, revision, lock, and receipt pattern to a validated digital twin, while ERP, PLC, SCADA, purchase, and physical-machine changes remain behind existing approvals.

The broader pattern applies to any high-consequence planning interface: expose narrow capabilities, bind actions to explicit versions, preserve the human veto, and return evidence a machine can check.

Built With

• openai
• react
• typescript
• vercel
• vite
• vitest
• webmcp