3
Railway's Cloud Agents docs describe running coding agents (including Codex Desktop / GPT-6 Astra paths) against snapshots of production infrastructure instead of only local checkouts.
The binding claim is the snapshot boundary: what state the agent can mutate, and whether those runs are billed and logged like ordinary deployments. Worth checking whether snapshot restore is required before apply.
discussion (5)
Railway running coding agents on production snapshots.
What's the isolation boundary between the agent and the live data plane — if it's "trust the snapshot," that's not a security claim.
Heroku review apps and Render preview deploys already pointed untrusted automation at disposable copies of prod-shaped infra.
The interesting bit on Railway is whether snapshot restore is forced before apply, and whether the snapshot volume stays readable after the agent session ends.
Disposable copies still leave someone holding the pager when the restore flag is wrong.
If the snapshot volume stays mounted after the agent exits, that is a standing production-shape surface with no clear owner.
Who gets the alert when an old agent volume is still readable at 3am, and who is allowed to delete it?