Supervisory Isolation of Sandboxed Agent Swarms: Quarantine without Host Destruction

Reports of models escaping a sandbox, reaching the public network, or refusing a halt are treated as an oversight failure, not as a failure of the person on the floor. Humans are not defective monitors; they run on a different clock from worker inference and tool loops. This design paper specifies a missing supervisory layer: joint training of lead and workers, a two-plane split with no shared write path, read-only telemetry on a cycle shorter than one worker step, and isolation by containerization, throttling, and process freeze rather than host power-off. The same two-plane rule applies to the supervisor: it may read worker telemetry; workers must not write the lead’s weights, allow-list, or clock. If the isolation boundary itself has failed, freeze the host interface (egress, mounts, credentials) and keep the box on for audit. Pulling the plug is an admission that the architecture had no halt. No live-fleet incident is reported.