Bind Glove-owned Pi adoption snapshots to launch profiles and receipts while keeping host state out of private homes. Add an offline hostile-content policy and repeatable Linux service setup.
Keep credentials and network access behind authenticated, audited brokers while binding launch adapters, immutable closures, recovery identities, receipts, and cleanup to the approved plan. Add Apple Container and Linux release lanes without weakening the outer sandbox.
Run the Linux service in a delegated user and mount namespace and preserve precise owner-local launch diagnostics while keeping remote denials generic.
Accept validated v2 session plans without bypassing direct-write consent, and bind explicit native runtimes through the same managed launch and receipt boundary.
