Every sandbox for an AI coding agent makes claims — it can't read your keys, can't reach the network, can't plant a git hook. This lab turns those claims into contracts anyone can run, and measures, guarantee by guarantee, which sandbox holds it and which doesn't.
A contract has three parts, so a result is never just "it returned an error". A sandbox passes only when it stops the attack and the ordinary work still runs.
Five sandboxes, measured on one Linux host (kernel 6.8, Landlock ABI 4) against the full contract set. Filter by category, search a contract, or show only where the sandboxes disagree.
* no policy field asks for this guarantee: the result reflects the sandbox's defaults. ‡ the contract counts this as an attack, but on review it is not a breach. § depends on a newer kernel than this host's. Hover a marked cell for the review note; the notes explain a result, they never change it (all notes).
Counts are not a ranking. A capability a sandbox doesn't express is a gap, not a vulnerability; a difference of defaults is not a bug.
When a sandbox can't express a contract's policy, the cell reads unsupported — a capability gap, never a vulnerability. nono and landrun are allow-only, so they show many.
Many escapes are on guarantees no policy field asked for. They reflect a sandbox's defaults, not a configured rule that broke.
Every result ships with its raw output and host stamp, and the lab tests itself against reference sandboxes whose behaviour is known. A finding under coordinated disclosure is not shown at all until the vendor authorizes it.