Bounded by design.

The server records and verifies an agent lifecycle. It does not become a general-purpose executor.

Default controls

Dedicated local state, path confinement, secret-shaped value redaction, hash-linked ledgers, hard budget reservations, default denial of external and destructive action classes, and Ed25519 workspace signatures.

Signature meaning

A valid trace signature proves the bytes match one local installation key. It does not prove publisher identity, account ownership, or hardware identity.

Report a vulnerability

Use GitHub Security Advisories. Do not publish exploit details before a fix is available.