fix: address PR review feedback for BYOC cookbook

- Add agent_api/environment_service_key.txt and agent_api/*.txt to .gitignore
- Add kokiy author entry to authors.yaml
- Update Python version requirement from 3.8 to 3.11 in prerequisites
- Fix registry.yaml: capitalize title, update description and date
- Add security warning about --sandbox-backend=none in runner section
- Add .env setup instructions with required env vars documentation

Author: claude

.gitignore

@@ -156,3 +156,5 @@ tool_use/demo_memory/
 tool_use/memory_storage/
 tool_use/.env
 agent_api/claude-environment-runner_*/
+agent_api/environment_service_key.txt
+agent_api/*.txt

agent_api/byoc_environments.ipynb

@@ -63,16 +63,7 @@
   {
    "cell_type": "markdown",
    "metadata": {},
-   "source": [
-    "## 2. Setup & Installation {#setup}\n",
-    "\n",
-    "### Prerequisites\n",
-    "\n",
-    "- Python 3.8 or higher\n",
-    "- Anthropic API key with BYOC access from [console.anthropic.com](https://console.anthropic.com/)\n",
-    "- [Claude Code](https://docs.anthropic.com/en/docs/claude-code) CLI installed on your runner infrastructure\n",
-    "- Infrastructure to run the BYOC worker (VM, container, etc.)"
-   ]
+   "source": "## 2. Setup & Installation {#setup}\n\n### Prerequisites\n\n- Python 3.11 or higher\n- Anthropic API key with BYOC access from [console.anthropic.com](https://console.anthropic.com/)\n- [Claude Code](https://docs.anthropic.com/en/docs/claude-code) CLI installed on your runner infrastructure\n- Infrastructure to run the BYOC worker (VM, container, etc.)"
   },
   {
    "cell_type": "code",
@@ -91,9 +82,7 @@
   {
    "cell_type": "markdown",
    "metadata": {},
-   "source": [
-    "### Configure API Key"
-   ]
+   "source": "### Configure API Key\n\nCreate a `.env` file in this directory with the following environment variables:\n\n```\nANTHROPIC_API_KEY=sk-ant-...       # Your Anthropic API key\nANTHROPIC_SERVICE_KEY=...          # Environment service key (generated in Console)\nANTHROPIC_ORG_ID=...               # Your Anthropic organization ID\n```\n\n- **`ANTHROPIC_API_KEY`** - Required for all API calls. Get yours from [console.anthropic.com](https://console.anthropic.com/).\n- **`ANTHROPIC_SERVICE_KEY`** - Required to authenticate the Environment Runner. Generate this in the Console under your environment settings.\n- **`ANTHROPIC_ORG_ID`** - Required to identify your organization when running the Environment Runner."
   },
   {
    "cell_type": "code",
@@ -326,20 +315,7 @@
   {
    "cell_type": "markdown",
    "metadata": {},
-   "source": [
-    "### Starting the Runner\n",
-    "\n",
-    "The runner uses `orchestrator` mode to poll for work and process sessions. Key flags:\n",
-    "\n",
-    "| Flag | Description |\n",
-    "|------|-------------|\n",
-    "| `--organization-id` | Your Anthropic organization ID |\n",
-    "| `--environment-id` | The BYOC environment to serve |\n",
-    "| `--service-key-file` | Path to the environment service key file |\n",
-    "| `--sandbox-backend` | Sandbox type (`none` for macOS dev, `srt` for Linux production) |\n",
-    "\n",
-    "> **Note:** On macOS, use `--sandbox-backend=none` since the Linux sandbox runtime (`srt`) is not available. In production Linux environments, omit this flag to use the default sandbox for security isolation."
-   ]
+   "source": "### Starting the Runner\n\nThe runner uses `orchestrator` mode to poll for work and process sessions. Key flags:\n\n| Flag | Description |\n|------|-------------|\n| `--organization-id` | Your Anthropic organization ID |\n| `--environment-id` | The BYOC environment to serve |\n| `--service-key-file` | Path to the environment service key file |\n| `--sandbox-backend` | Sandbox type (`none` for macOS dev, `srt` for Linux production) |\n\n> **Security Warning:** The `--sandbox-backend=none` flag **disables all security isolation** for code execution. This means agent-generated code runs directly on your host machine without any sandboxing. **Only use this for local development and testing.** In production, always use the default sandbox backend (`srt` on Linux) to ensure that agent sessions are isolated from your host system and from each other.\n\n> **Note:** On macOS, use `--sandbox-backend=none` since the Linux sandbox runtime (`srt`) is not available. In production Linux environments, omit this flag to use the default sandbox for security isolation."
   },
   {
    "cell_type": "code",

registry.yaml

@@ -603,9 +603,9 @@
   date: '2026-01-23'
   categories:
   - Agent Patterns
-- title: BYOC (Bring Your Own Compute) environments
-  description: Run Claude agent workloads on your own infrastructure using self-hosted
-    environments and the official Environment Runner.
+- title: BYOC (Bring Your Own Compute) Environments
+  description: Meet compliance and data residency requirements by running Claude agents
+    on your own infrastructure while Anthropic handles orchestration.
   path: agent_api/byoc_environments.ipynb
   authors:
   - kokiy