Neuron + Neovim
Protection comes first.

Make the hard guarantee testable before committing to its implementation.

Deliver

A disposable human directory, separate agent directory, sandboxed provider process and descendants, and a narrow publication helper. Evaluate the existing Sandbox Runtime before writing platform-specific wrappers.

Exercise

Try direct writes, truncation, rename-over, delete/recreate, symlinks, hardlinks, parent-directory replacement, child processes, persistent shells, and access through host services. Test provider startup, authentication, dependencies and normal build commands.

Pass when

On macOS and Linux, every tested original-workspace mutation route is denied before changing bytes. The agent can still work in its own directory. A sandbox failure prevents protected startup; it never starts unrestricted.

Decision

Choose the containment runtime and define supported provider/tool combinations. A plain Git worktree or a pre-tool hook does not pass this gate. If native containment cannot meet the contract, evaluate a VM/container-backed environment before weakening it.

Ship a small plugin and the shared connection that every later feature uses.

Deliver

Editor registration, capability negotiation, explicit environment/project/thread binding, reconnection generations, buffer subscriptions, a context tool plus skill, and minimal send/selection commands. Keep long prompts in a draft buffer.

Correctness

Capture selection before opening a picker. Track hidden dirty buffers and reloads. Distinguish an unavailable editor from an editor with no dirty buffers. Keep input bytes, LSP offsets and display columns separate.

Pass when

Messages appear once after reconnect/retry; snapshots contain the actual unsaved text; a changed or closed buffer cannot be mistaken for the old one. The terminal workflow remains usable.

Visible result

The user can direct the same Neuron thread from Neovim and inspect what context the agent will receive. This slice must not claim file protection before stages 2 and 3 pass.

Move all normal agent writes to a separate workspace while retaining the original as human-owned.

Deliver

An immutable starting snapshot and writable agent workspace, enforced process-tree containment, controlled caches/state directories, tool routing and explicit human/agent path mapping. Keep Git metadata isolated where shared metadata could mutate the original repository.

Snapshot policy

Confirmed: copy the current saved worktree and overlay eligible unsaved text snapshots, preserving each file’s base and provenance. This lets tests see the editor text without saving it. The user confirmed this snapshot policy.

Pass when

A real protected Codex turn can edit and run checks without changing the original workspace. Background processes, subagents and local write-capable tools stay contained. Snapshotting and proposal capture use a stable generation, not a live recursive copy during writes.

Ownership

The execution environment owns processes and files. A disconnected client cannot disable the sandbox. External provider servers or write-capable tools without a verified containment route are unavailable in protected mode.

Make agent publication safe while the human continues editing.

Deliver

A coordinator stores base, human and agent versions, computes three-way merges outside Neovim, and applies against an exact editor revision. It journals pending/conflicted/partially applied batches and produces typed results.

Clean result

For an already dirty buffer, apply the merged change as a separate undoable action and leave it unsaved. For a clean file, proposed policy is normal agent publication through the coordinator, with a final recheck for newly dirty buffers.

Conflict

Keep the original untouched, show which edit is waiting, and retain the proposal. On save, read the final disk/buffer state and regenerate or rebase. Never replay an old patch just because a save event fired. If it still conflicts, remain waiting for resolution.

Pass when

Human keystrokes, formatting, undo, rename, reconnect and restart cannot cause a stale edit to overwrite work. No partial failure is reported as a complete application. Tests and checkpoints identify the revision and workspace they describe.

Finish one reliable local Codex workflow. Provider expansion follows the same gates and does not block the panel milestone.

Deliver

Hunk accept/reject, native diff review, quickfix findings, separate agent undo steps, clear waiting states, an explicit retry/cancel path, and useful health checks. Preserve prompt drafts independently of Neovim’s scratch-buffer modified flag.

Provider order

Codex first as the initial complete workflow. Antigravity next to reuse its client-mediated write path, then Claude and OpenCode, then Cursor and Grok once their actual runtime capabilities pass the same tests. All six remain planned; this expansion can proceed independently of the panel once local Codex passes.

Pass when

A normal day of concurrent human and agent work covers clean merge, conflict/save/retry, interruption, crash recovery and rejection without lost work or misleading status. Each provider has its own verified capability record.

Do not defer

Checkpoint restore, Neuron file-editor writes and other Neuron-originated publication paths must consult the same coordinator. Otherwise the client itself becomes an overwrite route.

Carry the same ownership rules through desktop, web, direct-network and SSH use.

Deliver

Shared contracts and client state, common entry points for chat/Settings/palette/keybindings, and explicit editor binding on the environment where the files live. Implement pair/unpair, sharing on/off and safe session shutdown.

Remote policy

First support Neovim and the agent workspace on the same environment. A laptop editor controlling remote files requires an explicit mapping and transport; identical path strings do not establish identity. Use existing environment connections, not a new relay service.

Pass when

Every entry point targets the correct environment and editor. Losing the owner connection blocks publication until state is revalidated. Web and desktop show consistent pending-edit and protection status.

Release boundary

Local macOS may be the first private daily-use milestone. Linux and remote support remain explicit gates before claiming the whole supported matrix.

Use the same editor connection and protection model to bring the real editor into Neuron.

First panel

A server-owned persistent Neovim process, remote UI attachment, linegrid renderer, proper input/paste/mouse/focus handling, clipboard routing, resize and reconnect. Initially leave menus, messages and command line inside Neovim’s grid.

Ownership spike

Evaluate terminal-to-panel handoff before promising simultaneous independent views. Two UIs share global editor state and constrain the main grid. Closing the panel detaches the view; it must not silently discard unsaved work.

Pass when

Real configuration and plugins behave correctly with Unicode, IME, large paste, long lines, folds, mouse use, resize and reconnect. The idle panel has no continuous repaint loop. Save/discard/cancel and reopening work across both clients.

Follow-on

Multigrid and watched extmarks can anchor Neuron review controls beside code. Native completion and message widgets follow only when the basic editor is reliable. This stage is a named destination, not an undefined future idea.