Enforce read-only runs with the macOS sandbox - #39

Merged

elkaix merged 6 commits into

mainfrom

feat/enforce-read-only

Sep 12, 2026

Commits on Sep 12, 2026

feat: enforce read-only runs with the macOS sandbox
elkaix
committed
7995a62
fix: close sandbox escapes found in adversarial review
elkaix
committed
46b41e3
refactor: share the confinement refusal between cold and warm runs
elkaix
committed
9198344
fix: close the second review's gaps in read-only confinement
elkaix
committed
3396a7b
fix: do not fingerprint a root inside agy's state directory
elkaix
committed
4ed599b
fix: leave agy's state out of git and relative-path fingerprints
elkaix
committed
7541383