837 B
837 B
name, description, metadata
| name | description | metadata | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| agent-security-plan | Agreed plan for sandboxing Claude Code, OpenCode and Hermes, hardening mainframe, and drilling restores; agreed 2026-11-06 |
|
Plan is in ~/guides/mainframe/agent-security-plan.md. Read it before changing sudo, the
docker group, Home Assistant privileges, act_runner, agent launchers, or web fetching.
Why: Connor ranks damage to mainframe and credential theft as his top concerns, and has never exercised a restore.
How to apply: Check the machine rather than assuming a phase has landed. SSH passphrases and Hermes write approvals were declined, so don't re-propose them. Rootless Podman is deferred for reasons recorded in the plan.