Keep agents in a route-less network namespace and pass only private-loopback connections over an inherited Unix descriptor channel. The host relay targets the per-run authenticated proxy, preserving exact allowlists and audit evidence without exposing host networking.
Detect and bind operator-installed harnesses through explicit, digest-bound runtime policy. Keep macOS and Linux shipping lanes capability-aware and fail closed when isolation evidence is absent.
