4 commits

Author	SHA1	Message	Date
trvon	c3a6c1b7d1	feat(adoption): harden Pi harness sessions ... Bind Glove-owned Pi adoption snapshots to launch profiles and receipts while keeping host state out of private homes. Add an offline hostile-content policy and repeatable Linux service setup.	2026-08-02 18:10:55 -04:00
0xkite	497e703e70	feat(runtime): manage sandboxed agent sessions ... Keep credentials and network access behind authenticated, audited brokers while binding launch adapters, immutable closures, recovery identities, receipts, and cleanup to the approved plan. Add Apple Container and Linux release lanes without weakening the outer sandbox.	2026-07-30 08:49:42 -04:00
0xkite	36b6e4c030	feat(host): derive immutable runtime closure ... Resolve safe shebang interpreters and exact package roots during staging so operators do not need broad manual grants. Credential homes remain outside the generated closure and unsupported interpreter shapes fail closed.	2026-07-29 17:33:02 -04:00
0xkite	bf53ba4a48	feat(host): guide managed harness setup ... Detect and bind operator-installed harnesses through explicit, digest-bound runtime policy. Keep macOS and Linux shipping lanes capability-aware and fail closed when isolation evidence is absent.	2026-07-29 16:15:04 -04:00