yeah, it's not 100% clear, but notice nothing you quoted indicates that the dot harness itself runs inside said workspace. If you look at where OAI agent architecture has been going, they increasingly separate the harness from the compute env. See, "separating harness from compute" articles, recent "managed agents" offering, and so on.
If I'm reading between the lines correctly, the core Dot agent loop does not run in the workspace, but outside it.
If I'm reading between the lines correctly, the core Dot agent loop does not run in the workspace, but outside it.