Founder rule, 2026-08-27: no AI agent process ever runs directly on the host, no exceptions. Today the dev agent is caged but the read-only roles (reviewer, prosecutor, judge, and ticket drafting) run on the host, bounded cooperatively by CLI flags and a temporary settings file (D15).
Target:
- Reviewer/prosecutor/judge run in the same container cage as the dev turn, with the worktree mounted read-only (:ro): the read-only bound becomes structural (kernel-enforced) instead of cooperative, strictly stronger than D15.
- Ticket drafting and any future agent role follow the same rule.
- install.sh stops installing claude-code on the host once nothing host-side needs it (the cage bootstraps its own copy).
- Direct (uncaged) isolation mode becomes an explicit opt-out for local development only, never a default anywhere.
Sequencing: after the H-dogfood e2e; pairs naturally with the orchestrator/micro-VM direction where everything moves into disposable VMs anyway.
Founder rule, 2026-08-27: no AI agent process ever runs directly on the host, no exceptions. Today the dev agent is caged but the read-only roles (reviewer, prosecutor, judge, and ticket drafting) run on the host, bounded cooperatively by CLI flags and a temporary settings file (D15).
Target:
Sequencing: after the H-dogfood e2e; pairs naturally with the orchestrator/micro-VM direction where everything moves into disposable VMs anyway.