Bounded by design.

The server records and verifies an agent lifecycle. It does not become a general-purpose executor.

Default controls

Dedicated local state, path confinement, secret-shaped value redaction, hash-linked ledgers, hard budget reservations, default denial of external and destructive action classes, and Ed25519 workspace signatures.

Signature meaning

A valid trace signature proves the bytes match one local installation key. It does not prove publisher identity, account ownership, or hardware identity.

Report a vulnerability

Use the private GitHub vulnerability-reporting form. It is enabled on the official Community repository and accepts reports affecting Community or Complete Local. Do not publish exploit details before a fix is available.