seisin 0.6.2 → 0.6.4

package/README.md

@@ -855,7 +855,7 @@ A **provider** is a command with a `{ref}` placeholder, so adding 1Password, Bit
 confined process. Nothing degrades: a provider that fails stops the run.
 
 A key reaches the role as a variable (`key_mode = "env"`), as a file in the run's private
-directory (`"run-file"`), or, on Linux, not at all: with `"inject"` the agent holds a
+directory (`"run-file"`), or not at all (on Linux, and on macOS under tartaros): with `"inject"` the agent holds a
 placeholder and the sandbox swaps in the real value only on the way to the hosts you list for
 it. That costs terminating TLS to those hosts, which `seisin check` names, and a host that
 stores what it is sent can still hand the value back — use a least-scope token.
@@ -1037,8 +1037,8 @@ the same kernel or workspace, and which one you want depends on what you are pro
 
 ## Status
 
-**1101 tests on macOS, 1094 passing and 7 platform skips** (0.6.2, 2026-10-26, local); in CI the
-same day, on `ubuntu-latest` **1100, 1071 passing and 29 platform skips**, and on macOS 1101,
+**1120 tests on macOS, 1113 passing and 7 platform skips** (with the 0.6.4 changes, 2026-10-26, local); for 0.6.3, in CI
+the same day, on `ubuntu-latest` **1100, 1071 passing and 29 platform skips**, and on macOS 1101,
 1092 passing and 9 skips, Node 18/20/22/24, with the 26 core boundary tests skipping none. On 2026-10-12, 91 of the suite's tests
 needed `@anthropic-ai/sandbox-runtime` installed — counted by running it with the runtime
 hidden — and run real commands through the real kernel; 26 of them are the core boundary file,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "seisin",
-  "version": "0.6.2",
+  "version": "0.6.4",
   "description": "A permission layer for AI coding agents: role-scoped folders and keys, enforced by the OS, and when it denies something it tells you whose file it was.",
   "keywords": [
     "ai-agents",
@@ -45,7 +45,7 @@
     "@anthropic-ai/sandbox-runtime": "0.0.81"
   },
   "optionalDependencies": {
-    "@carlostapiacl/tartaros": "0.1.0-alpha.15"
+    "@carlostapiacl/tartaros": "0.1.0-alpha.18"
   },
   "scripts": {
     "test": "node --test test/*.test.js",

package/src/canary.js

@@ -130,6 +130,16 @@ export async function runCanary({ srt, wrap = null, settingsFile, settings, env,
   }
 
   if (timedOut) failed.push(`the canary did not finish in ${timeoutMs / 1000}s`);
+  // tartaros refuses a run whose real value another process exposes (its exec
+  // record, which the agent can read; on macOS no sandbox hides it). That is not
+  // a boundary to fix in the policy, and its own advice names a flag seisin does
+  // not pass, so it is said apart, as the variable and the process.
+  const exposed = [...stderr.matchAll(/tartaros: secret exposed: the value of (\S+) in pid (\d+) \(([^)]*)\)/g)]
+    .map(([, name, pid, proc]) => ({ name, pid: Number(pid), proc }));
+  if (exposed.length) {
+    for (const p of [secret, outside, insideDir, shared]) if (p) try { rmSync(p, { force: true, recursive: p === insideDir }); } catch {}
+    return { ok: false, exposed, failed: exposed.map((e) => `${e.name}'s real value is readable in pid ${e.pid} (${e.proc})`), ms: Date.now() - t0 };
+  }
   if (!output.includes(`ALIVE-${nonce}`)) {
     // The runtime's own words, when it said any: a sandbox that refuses to
     // start usually says why (measured: a path the runtime read as a broken

package/src/cli.js

@@ -13,11 +13,12 @@
  * never know: which role a path belongs to, and therefore who to ask next.
  */
 import { readFileSync } from "node:fs";
-import { join, dirname } from "node:path";
+import { join, dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 import { findConfig, loadConfig } from "./config.js";
 import { CONFIG_NAME } from "./layout.js";
+import { setStateDir } from "./state.js";
 import { C, out, err } from "./render.js";
 import { COMMAND_HELP, flagsOf, renderHelp, renderLimits } from "./help.js";
 import { nearest, checkFlags } from "./suggest.js";
@@ -36,6 +37,44 @@ import { nearest, checkFlags } from "./suggest.js";
 const HERE = dirname(fileURLToPath(import.meta.url));
 const [, , command, ...argv] = process.argv;
 
+/**
+ * `--policy <file>` and `--state-dir <dir>`, for a launcher that keeps both out
+ * of the repo it runs in (an orchestrator with a folder per run). The policy is
+ * read from the file and rooted at the working directory; the log and the
+ * request queue go to the state directory. Both are taken out of seisin's own
+ * part of the line before the command reads it (after `--`, or after `run
+ * <role> <command>`, the words are the agent's), and both reach everything a
+ * run starts through the environment (SEISIN_CONFIG, SEISIN_ROOT,
+ * SEISIN_STATE_DIR).
+ */
+function ownEnd() {
+  const split = argv.indexOf("--");
+  if (split !== -1) return split;
+  if (command !== "run") return argv.length;
+  let i = 1;
+  const values = new Set([...(flagsOf("run")?.values ?? []), "--policy", "--state-dir"]);
+  while (i < argv.length && argv[i].startsWith("-")) i += values.has(argv[i]) ? 2 : 1;
+  return i;
+}
+function takeGlobal(name) {
+  const i = argv.indexOf(name);
+  if (i === -1 || i >= ownEnd()) return null;
+  const v = argv[i + 1];
+  if (v === undefined || v.startsWith("-")) {
+    err(`${C.red}seisin:${C.off} ${name} needs a value\n`);
+    process.exit(2);
+  }
+  argv.splice(i, 2);
+  return v;
+}
+const policyFlag = takeGlobal("--policy");
+const stateFlag = takeGlobal("--state-dir");
+if (stateFlag) setStateDir(stateFlag);
+const rootFlag = policyFlag ? process.cwd() : null;
+if (policyFlag) {
+  process.env.SEISIN_ROOT = rootFlag;
+}
+
 const USAGE = `
 ${C.b}seisin${C.off} — give each agent its own folders and its own keys
 
@@ -61,6 +100,9 @@ ${C.b}seisin${C.off} — give each agent its own folders and its own keys
   seisin mcp                            an MCP server on stdio — read-only
 
 seisin <command> --help lists a command's flags, examples and exit codes.
+Any command takes --policy <file> (the policy, rooted at the working directory) and
+--state-dir <dir> (where the log and the request queue go) for a launcher that keeps
+both outside the repo (docs/runs.md).
 seisin help limits says what seisin cannot do, in any repo.
 
 Enforcement comes from @anthropic-ai/sandbox-runtime, which asks the OS.
@@ -69,6 +111,7 @@ seisin decides what to ask for, and says whose file it was when the answer is no
 
 /** Loads the policy, or explains where to get one. */
 function config() {
+  if (policyFlag) return loadConfig(resolve(policyFlag), undefined, { root: rootFlag });
   const path = findConfig();
   if (!path) throw new Error(`no ${CONFIG_NAME} found here or above. Run "seisin init" to write one.`);
   return loadConfig(path);
@@ -76,6 +119,7 @@ function config() {
 
 /** The policy here, or null — for a command that can answer without one. */
 function maybeConfig() {
+  if (policyFlag) return config();
   const path = findConfig();
   return path ? loadConfig(path) : null;
 }

package/src/commands/check.js

@@ -3,6 +3,11 @@ import { spawn, spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { inspect } from "../inspect.js";
 import { renderReport, out, C } from "../render.js";
+import { readFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { stateDir } from "../state.js";
+
+const say = out;
 import { measureSystemLog } from "../violations.js";
 import { join } from "node:path";
 import { settingsFor } from "../srt.js";
@@ -10,13 +15,29 @@ import { weigh } from "../sandboxes/index.js";
 import { runsRoot } from "../rundir.js";
 import { channelName } from "../spool.js";
 
+/**
+ * What this seisin can be asked to do, for a launcher deciding which flags to
+ * pass: one list, instead of a version compared against minimums or a search
+ * through `--help`. A name is added when the feature ships and never removed
+ * while it works.
+ */
+export const CAPABILITIES = [
+  "policy-flag", "state-dir", "run-id", "expect-denied", "agent-flag", "handoff", "handoff-false",
+  "browsers", "local-ports", "key-mode-inject", "check-json", "ui-runs",
+];
+
 export async function check(config, argv = []) {
   if (argv.includes("--parallel") && !argv.includes("--verify"))
     throw new Error("--parallel is experimental and requires --verify");
+  const json = argv.includes("--json");
   const role = argv.find((a) => !a.startsWith("-")) ?? null;
   const report = inspect(config, role, config.path);
-  out(renderReport(report, { verbose: argv.includes("--verbose") }));
-  if (config.sandbox?.provider) report.sandboxes = sandboxes(config, role);
+  if (!json) out(renderReport(report, { verbose: argv.includes("--verbose") }));
+  if (config.sandbox?.provider || json) report.sandboxes = sandboxes(config, role, { quiet: json });
+  if (json) {
+    out(JSON.stringify(asJson(config, report), null, 2) + "\n");
+    return report;
+  }
   if (argv.includes("--verify")) report.verify = await verify(config, role, argv.includes("--parallel"));
   if (argv.includes("--system-log")) report.systemLog = await systemLog();
   return report;
@@ -56,16 +77,17 @@ const SYSTEM_LOG_SECONDS = 3;
  * too. Printed only when `[sandbox] provider` is set: without it every role
  * runs under srt, as it always has, and there is nothing to choose.
  */
-export function sandboxes(config, only = null, { platform = process.platform } = {}) {
+export function sandboxes(config, only = null, { platform = process.platform, quiet = false } = {}) {
+  const out = quiet ? () => {} : say;
   const sock = join(runsRoot(), "check", channelName(platform));
   const rows = [];
-  out(`\n${C.b}sandboxes${C.off} (${config.sandbox.provider.join(" → ")})\n`);
+  out(`\n${C.b}sandboxes${C.off} (${(config.sandbox?.provider ?? ["srt"]).join(" → ")})\n`);
   for (const r of Object.values(config.roles)) {
     if (only && r.name !== only) continue;
     let settings;
     try { settings = settingsFor(config, r.name, sock); } catch (e) { rows.push({ role: r.name, chosen: null, error: e.message }); continue; }
     const { chosen, options } = weigh(config, settings, { platform, role: r.name });
-    rows.push({ role: r.name, chosen: chosen?.sandbox.name ?? null,
+    rows.push({ role: r.name, chosen: chosen?.sandbox.name ?? null, bin: chosen?.bin ?? null,
       options: options.map((o) => ({ name: o.sandbox.name, missing: o.missing, unmet: o.unmet, warnings: o.warnings })) });
     out(chosen ? `  ${C.green}✓${C.off} ${r.name}: ${chosen.sandbox.name}\n` : `  ${C.red}✗${C.off} ${r.name}: no sandbox can hold it\n`);
     // Held, but not the way the role may expect: the sandbox's own words.
@@ -82,6 +104,32 @@ export function sandboxes(config, only = null, { platform = process.platform } =
   return rows;
 }
 
+/** `--version`'s first line from a sandbox binary, or null: what a launcher would otherwise parse itself. */
+function versionOf(bin) {
+  if (!bin || bin === "(not looked up)") return null;
+  const r = spawnSync(bin, ["--version"], { encoding: "utf8", timeout: 5000 });
+  return r.status === 0 ? (r.stdout || "").split("\n")[0].trim() || null : null;
+}
+
+/** `check --json`: the same answer as the text, for a program. */
+function asJson(config, report) {
+  const pkg = JSON.parse(readFileSync(join(dirname(fileURLToPath(import.meta.url)), "..", "..", "package.json"), "utf8"));
+  return {
+    seisin: pkg.version,
+    platform: process.platform,
+    capabilities: CAPABILITIES,
+    policy: config.path,
+    root: config.root,
+    stateDir: stateDir(config.root),
+    roles: (report.sandboxes ?? []).map((s) => ({
+      role: s.role, sandbox: s.chosen, bin: s.bin ?? null, version: versionOf(s.bin), error: s.error ?? null,
+      unmet: (s.options ?? []).filter((o) => o.name !== s.chosen).map((o) => ({ sandbox: o.name, missing: o.missing, unmet: o.unmet })),
+    })),
+    warnings: report.warnings.map((w) => ({ kind: w.kind, role: w.role ?? null, headline: w.headline ?? w.message ?? null })),
+    ok: checkStatus(report) === 0,
+  };
+}
+
 /**
  * The exit status: 1 when a role cannot be enforced as written, or when what a
  * flag asked for failed. `--system-log` is asked for like `--verify` and fails

package/src/commands/hook.js

@@ -30,7 +30,7 @@ export async function hook(stdin = process.stdin, env = process.env) {
 
   let config;
   try {
-    config = loadConfig(env.SEISIN_CONFIG ?? findConfig());
+    config = loadConfig(env.SEISIN_CONFIG ?? findConfig(), undefined, { root: env.SEISIN_ROOT || null });
   } catch {
     return null;
   }

package/src/commands/run.js

@@ -73,6 +73,46 @@ export function agentFor(mine, cmd) {
   return given;
 }
 
+/**
+ * The egress refusals in a sandbox's own JSON-lines log (tartaros `--log`:
+ * `{axis: "network", outcome: "denied", target: "host:port", action}`), one per
+ * target with how many times: a client retrying a refused host is one wall, not
+ * fifty lines. Missing or unreadable: none, the run's own record still stands.
+ */
+export function brokerDenials(file) {
+  let text;
+  try { text = readFileSync(file, "utf8"); } catch { return []; }
+  const by = new Map();
+  for (const line of text.split("\n")) {
+    let e;
+    try { e = JSON.parse(line); } catch { continue; }
+    if (e?.axis !== "network" || e.outcome !== "denied" || typeof e.target !== "string") continue;
+    // A request refused on a terminated connection says `host:port (why)`: the
+    // host is the wall, the why (method and path) is its reason.
+    const m = /^(\S+) \((.*)\)$/.exec(e.target);
+    const target = (m ? m[1] : e.target).replace(/\/$/, "").slice(0, 300);
+    const reason = m ? m[2].slice(0, 300) : String(e.action ?? "denied");
+    const d = by.get(`${target}\u0000${reason}`) ?? { target, reason, times: 0 };
+    d.times++;
+    by.set(`${target}\u0000${reason}`, d);
+  }
+  return [...by.values()];
+}
+
+/**
+ * `--run-id <id>`: the launcher's own id for this run (an orchestrator's ULID),
+ * used instead of a random one wherever the run is named. Letters, digits, `-`
+ * and `_`, 64 at most: it becomes part of a directory name and of log lines.
+ */
+export function runIdOf(mine) {
+  const at = mine.lastIndexOf("--run-id");
+  if (at === -1) return null;
+  const id = mine[at + 1];
+  if (!id || !/^[A-Za-z0-9_-]{1,64}$/.test(id))
+    throw new Error(`--run-id ${id ?? ""}: letters, digits, "-" and "_" only, 64 at most`);
+  return id;
+}
+
 export async function run(config, argv) {
   /**
    * Ours before the `--`, theirs after it.
@@ -146,7 +186,11 @@ export async function run(config, argv) {
   const notify = notifier(config);
   // Everything that belongs to this run alone — socket, settings, run-file keys
   // — in one private directory, with one id. See rundir.js.
-  const theRun = openRun();
+  const runId = runIdOf(mine);
+  const theRun = openRun(runId ? { id: runId } : undefined);
+  // How the log names this run: the launcher's id when it gave one, so its
+  // records and seisin's join on the same key; else the first 8 of seisin's.
+  const runLabel = runId ?? theRun.id.slice(0, 8);
   /**
    * From here on, every way out removes what this run made.
    *
@@ -214,7 +258,9 @@ export async function run(config, argv) {
   const box = chooseSandbox(config, generated, { role });
   if (box.error) throw box.error;
   const { sandbox, bin } = box;
-  const settings = settingsOf(sandbox, generated, { machRegister });
+  const handoffExempt = (config.roles[role].handoffExempt ?? []).map((e) => join(config.root, e));
+  const requests = config.roles[role].requests ?? [];
+  const settings = settingsOf(sandbox, generated, { machRegister, handoffExempt, requests });
   // Per run, never per role: `.seisin/<role>.json` was one file for every run
   // of that role, and two at once wrote each other's socket path into it.
   const file = theRun.writeSettings(settings);
@@ -245,6 +291,10 @@ export async function run(config, argv) {
   const { env, dropped } = buildEnv(process.env, config.roles[role]);
   env.SEISIN_ROLE = role;
   env.SEISIN_CONFIG = config.path;
+  // A policy read with --policy is rooted where the run started, not beside the
+  // file; the hook must agree, or it would judge paths against the wrong repo.
+  if (config.root !== dirname(config.path)) env.SEISIN_ROOT = config.root;
+  else delete env.SEISIN_ROOT;
   env[SOCK_ENV] = sockPath;
   // The handoff chain, for the hook's words only (handoff.js, CHAIN_ENV): set
   // from the decision checked above, and removed otherwise, so a value the
@@ -289,7 +339,7 @@ export async function run(config, argv) {
       // The variable's name and the provider, never the reference: a reference
       // can carry what it points at (a provider that echoes it, a path that
       // names the secret), and the log is read by more people than the policy.
-      event: "key", role, run: theRun.id.slice(0, 8), ...trace, key: entry.name, provider: entry.scheme, mode, ok,
+      event: "key", role, run: runLabel, ...trace, key: entry.name, provider: entry.scheme, mode, ok,
     }),
   });
   const runFileKeys = theRun.keys;
@@ -493,9 +543,17 @@ export async function run(config, argv) {
   });
   if (!probe.ok) {
     append(logPath(config.root), {
-      event: "canary", role, run: theRun.id.slice(0, 8), ...trace, agent: agent ?? null, confined: false, reasons: probe.failed,
+      event: "canary", role, run: runLabel, ...trace, agent: agent ?? null, confined: false, reasons: probe.failed,
       ...(sandbox.name === DEFAULT_SANDBOX ? {} : { sandbox: sandbox.name }),
     });
+    if (probe.exposed) {
+      err(`${C.red}seisin: ${role} was NOT started — another process holds a real value the agent would see:${C.off}\n` +
+        probe.failed.map((f) => `  - ${f}\n`).join("") +
+        `  A process's environment and arguments are readable by every process of your user (on macOS no sandbox ` +
+        `hides them), so masking would hide nothing. Usually a shell that exported the token, and what it started. ` +
+        `Unset it there or end that process, and keep the value only where seisin's key points (docs/keys.md).\n`);
+      process.exit(CANARY_EXIT);
+    }
     err(`${C.red}seisin: ${role} was NOT started — the sandbox failed its canary:${C.off}\n` +
       probe.failed.map((f) => `  - ${f}\n`).join("") +
       `  The policy as generated does not hold on this machine, so no agent runs under it. ` +
@@ -504,7 +562,7 @@ export async function run(config, argv) {
     process.exit(CANARY_EXIT);
   }
   append(logPath(config.root), {
-    event: "canary", role, run: theRun.id.slice(0, 8), ...trace, agent: agent ?? null, confined: true, reasons: [],
+    event: "canary", role, run: runLabel, ...trace, agent: agent ?? null, confined: true, reasons: [],
     ...(sandbox.name === DEFAULT_SANDBOX ? {} : { sandbox: sandbox.name }),
   });
   // Said once, only when it is not the default: which sandbox holds this run
@@ -544,7 +602,12 @@ export async function run(config, argv) {
   const nested = nestedSandboxWarning(cmd);
   if (nested) err(`${C.yellow}seisin: ${nested}${C.off}\n`);
 
-  const [runner, ...runnerArgs] = wrap(boxed);
+  // The sandbox's own record of what its egress broker refused (tartaros
+  // `--log`), in this run's private directory: read back into seisin's log when
+  // the run ends, so a denied host is a wall like any other instead of a line
+  // on stderr. Only the agent's run gets it, not the canary's.
+  const brokerLog = join(theRun.dir, "sandbox-log.jsonl");
+  const [runner, ...runnerArgs] = sandbox.wrap(bin, file, settings, boxed, { role, machRegister, log: brokerLog });
   const child = spawn(runner, runnerArgs, {
     stdio: outStream ? ["inherit", "pipe", "pipe"] : "inherit",
     env,
@@ -624,6 +687,10 @@ export async function run(config, argv) {
     // returns as soon as the stream goes quiet, so a run that was denied
     // nothing pays a tick.
     await denials.close({ drain: DRAIN_MS });
+    // Before the directory goes: the hosts the sandbox's broker refused.
+    for (const d of brokerDenials(brokerLog))
+      append(logPath(config.root), { role, run: runLabel, ...trace, tool: "broker", source: sandbox.name, action: "connect",
+        kind: "network", target: d.target, verdict: "denied", owners: [], reason: d.reason, times: d.times });
     // The run made this directory, so the run removes it.
     cleanup();
 
@@ -640,7 +707,7 @@ export async function run(config, argv) {
     // the record did not. Said every time, and written down, because a denial
     // that never arrived files no request and nothing else would show it.
     if (dropped) {
-      append(logPath(config.root), { event: "log-dropped", role, run: theRun.id.slice(0, 8), ...trace, batches: dropped });
+      append(logPath(config.root), { event: "log-dropped", role, run: runLabel, ...trace, batches: dropped });
       err(`${C.yellow}seisin: the system log dropped ${dropped} batch(es) of messages during this run: ` +
           `kernel denials may be missing from the log and the queue. ` +
           `\`seisin check --system-log\` says what is flooding it.${C.off}\n`);

package/src/config.js

@@ -17,6 +17,21 @@ import { parseKey, MODES, checkNames, BUILTIN, unknownMode } from "./keys.js";
 import { readNotify } from "./notify.js";
 import { BROWSERS } from "./browsers.js";
 
+/** `a/b//` → `a/b`, in linear time (a `/\/+$/` regex backtracks on a long run of slashes). */
+const trimSlashes = (p) => {
+  let end = p.length;
+  while (end > 0 && p[end - 1] === "/") end--;
+  return p.slice(0, end);
+};
+
+// The directory above a path's first glob character: "src/a*/b" gives "src", "a*" gives "".
+const beforeGlob = (p) => {
+  const g = p.search(/[*?[\]{}]/);
+  if (g < 0) return p;
+  const slash = p.lastIndexOf("/", g);
+  return slash < 0 ? "" : p.slice(0, slash);
+};
+
 export { CONFIG_NAME } from "./layout.js";
 
 /** Walk up from `from` until a seisin.toml shows up. Returns its path or null. */
@@ -329,7 +344,7 @@ function readReadList(v, at) {
     if (/[*?[\]{}]/.test(above) || p === "**")
       throw new Error(
         `${at} = "${p}" cannot be enforced as written.\n` +
-        `  A read grant is a path and everything under it. Write "${above.replace(/\/?[^/]*[*?[\]{}].*$/, "") || "."}/**" ` +
+        `  A read grant is a path and everything under it. Write "${beforeGlob(above) || "."}/**" ` +
         `for the subtree, or name the paths.`);
   }
   return list;
@@ -365,10 +380,10 @@ export function policyId(config) {
  * settings file rather than falling back to a permissive default, and seisin
  * matches that: a permission tool that guesses is worse than no permission tool.
  */
-export function loadConfig(path, text = readFileSync(path, "utf8")) {
+export function loadConfig(path, text = readFileSync(path, "utf8"), { root = null } = {}) {
   // `text` lets a caller validate an edit before writing it — the console
   // previews a policy that does not exist on disk yet, against the real root.
-  const parsed = parseToml(text);
+  const parsed = String(path).endsWith(".json") ? parseJsonPolicy(text, path) : parseToml(text);
   checkShape(parsed, SHAPE, "", path, LINES.get(parsed));
   // Read only what the file actually declared. The parser refuses the names
   // that make inheritance possible, and this is the second half of the same
@@ -436,7 +451,7 @@ export function loadConfig(path, text = readFileSync(path, "utf8")) {
   // them as prefixes: with the slash kept, `scan` walked into the protected
   // directory and a bare key resolved to `.secrets//x`, which matched nothing.
   const keyDirs = (keyDir === undefined ? [] : asArray(keyDir, "keys.dir"))
-    .map((d) => d.replace(/\/+$/, "") || d);
+    .map((d) => trimSlashes(d) || d);
   const keyProviders = readProviders(own(own(parsed, "keys"), "providers"), path);
   // `undefined` means "use the defaults"; an explicit empty array means "none".
   // The difference matters: one is a user who has not thought about it, the
@@ -445,7 +460,10 @@ export function loadConfig(path, text = readFileSync(path, "utf8")) {
   const runtimeWrites = own(runtime, "writes");
 
   const out = {
-    root: dirname(path), path, keyDirs, keyProviders,
+    // The root is the policy's folder, unless the policy was read from elsewhere
+    // (`--policy`): then it is the folder the command runs in, and the policy
+    // stays outside the repo it governs.
+    root: root ? resolve(root) : dirname(path), path, keyDirs, keyProviders,
     // Through asArray like every other list: `allow = "github.com"` was kept as
     // a string, and a string iterated is its characters.
     allowedDomains: asArray(own(own(parsed, "network"), "allow"), "network.allow"),
@@ -537,6 +555,37 @@ export function loadConfig(path, text = readFileSync(path, "utf8")) {
     const toolchain = readReadList(own(r, "toolchain"), `${path}: roles.${name}.toolchain`);
     const priv = readPrivate(own(r, "private"), `${path}: roles.${name}.private`);
     const verify = own(r, "verify") === undefined ? null : asArray(own(r, "verify"), `roles.${name}.verify`);
+    /**
+     * `handoff_exempt`: folders where the trust-handoff set is not protected, for a
+     * setup phase that fills a dependency tree whose packages ship their own
+     * `.gitattributes`, `.github/` or `.git/` (`composer install`, measured: 326
+     * denials). Relative to the repo, no `..`, no globs. Only a sandbox that can
+     * open exactly that (tartaros) is handed the role.
+     */
+    const handoffExempt = own(r, "handoff_exempt") === undefined ? [] : asArray(own(r, "handoff_exempt"), `roles.${name}.handoff_exempt`);
+    /**
+     * `requests`: the only requests the role may send to an allowed host,
+     * `"METHODS host[/path]"` (METHODS: `GET,POST` or `*`). An allowed host is
+     * otherwise all of it: a token for api.github.com pushes to any repository
+     * it reaches. The host must be in `network`. Only tartaros enforces it
+     * (from 0.1.0-alpha.18): it terminates that host and refuses anything else.
+     */
+    const requests = own(r, "requests") === undefined ? [] : asArray(own(r, "requests"), `roles.${name}.requests`).map((spec) => {
+      const m = /^(\*|[A-Z]+(?:,[A-Z]+)*)\s+([A-Za-z0-9.-]+)(\/\S*)?$/.exec(String(spec).trim());
+      if (!m || (m[3] ?? "").split("/").some((seg) => seg === "." || seg === ".."))
+        throw new Error(`${path}: roles.${name}.requests "${spec}": "METHODS host[/path]", e.g. "GET api.github.com" or "POST,PATCH api.github.com/repos/acme/"`);
+      return { host: m[2], methods: m[1] === "*" ? [] : m[1].split(","), paths: m[3] ? [m[3]] : [] };
+    });
+    // A rule narrows a host the role may reach; on a host it may not, it says nothing.
+    const reach = own(r, "network") === undefined ? [] : asArray(own(r, "network"), `roles.${name}.network`);
+    for (const q of requests) {
+      const covered = reach.some((h) => h === q.host || (h.startsWith("*.") && q.host.endsWith(h.slice(1))));
+      if (!covered)
+        throw new Error(`${path}: roles.${name}.requests: ${q.host} is not in roles.${name}.network, so the role cannot reach it at all`);
+    }
+    for (const e of handoffExempt)
+      if (e.startsWith("/") || e.startsWith("~") || e.split("/").includes("..") || /[*?[\]]/.test(e) || !e.trim())
+        throw new Error(`${path}: roles.${name}.handoff_exempt "${e}": a folder in the repo, relative, with no ".." and no globs`);
     if (verify && verify.length === 0)
       throw new Error(`${path}: roles.${name}.verify is empty. It is the command that proves the role can check ` +
         `its own work — ["python", "-m", "pytest", "--version"] — or leave it out.`);
@@ -644,6 +693,10 @@ export function loadConfig(path, text = readFileSync(path, "utf8")) {
        * another owner or to a person instead of starting it.
        */
       handoff: handoff !== false,
+      /** Folders, relative to the root, where trust-handoff is not protected (tartaros only). */
+      handoffExempt,
+      /** The only requests to an allowed host: `{ host, methods, paths }` (tartaros only). */
+      requests,
       /**
        * What this role reads beyond its repo, under `read = "territory"`.
        *
@@ -879,6 +932,70 @@ function checkShape(table, shape, prefix, path, lines) {
   }
 }
 
+/**
+ * A policy written as JSON (`--policy run.json`), for a launcher that generates
+ * one: JSON can hold a quote in a value, which the TOML subset cannot, and a
+ * program writing the policy should not have to avoid them.
+ *
+ * The same data and the same strictness as the TOML reader: tables, strings,
+ * whole numbers, booleans, and arrays of strings or whole numbers, nothing
+ * else; the forbidden names refused; every table with a null prototype; and a
+ * key written twice in one object refused, because JSON.parse keeps the last
+ * one, and a policy that is restrictive at the top and cancelled further down
+ * is exactly what the TOML reader refuses too. A JSON policy is not edited by
+ * `grant`: it is generated, so it is changed where it is generated.
+ */
+export function parseJsonPolicy(text, path = "policy.json") {
+  let raw;
+  try { raw = JSON.parse(text); } catch (e) { throw new Error(`${path}: not JSON — ${e.message}`); }
+  // Duplicate keys, which JSON.parse folds away: one pass over the text, which
+  // JSON.parse has just said is well formed.
+  const stack = [];
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    if (c === "{") stack.push({ obj: true, keys: new Set(), key: true });
+    else if (c === "[") stack.push({ obj: false });
+    else if (c === "}" || c === "]") stack.pop();
+    else if (c === "," && stack.at(-1)?.obj) stack.at(-1).key = true;
+    else if (c === '"') {
+      let j = i + 1;
+      while (text[j] !== '"') j += text[j] === "\\" ? 2 : 1;
+      const top = stack.at(-1);
+      if (top?.obj && top.key) {
+        const k = JSON.parse(text.slice(i, j + 1));
+        if (top.keys.has(k)) throw new Error(`${path}: "${k}" is written twice in one object; the last would silently win.`);
+        top.keys.add(k);
+        top.key = false;
+      }
+      i = j;
+    }
+  }
+  const walk = (v, name) => {
+    if (typeof v === "string" || typeof v === "boolean") return v;
+    if (typeof v === "number") {
+      if (!Number.isInteger(v) || v < 0) throw new Error(`${path}: ${name} = ${v} — only whole numbers`);
+      return v;
+    }
+    if (Array.isArray(v)) {
+      return v.map((x, i) => {
+        if (typeof x === "string" || (typeof x === "number" && Number.isInteger(x) && x >= 0)) return x;
+        throw new Error(`${path}: ${name}[${i}] — array items are strings or whole numbers`);
+      });
+    }
+    if (isTable(v)) {
+      const t = dict();
+      for (const [k, x] of Object.entries(v)) {
+        if (FORBIDDEN.has(k)) throw new Error(`${path}: "${k}" is not a name a table or key may have`);
+        t[k] = walk(x, name ? `${name}.${k}` : k);
+      }
+      return t;
+    }
+    throw new Error(`${path}: ${name} = ${JSON.stringify(v)} — a value is a string, a whole number, a boolean, an array or a table`);
+  };
+  if (!isTable(raw)) throw new Error(`${path}: the policy is an object`);
+  return walk(raw, "");
+}
+
 /** The candidate within edit distance 3 of `word`, or null. Shared with `check`. */
 export function closest(word, candidates) {
   let best = null, bestD = 4;
@@ -910,7 +1027,7 @@ function readBoolean(value, where) {
 }
 
 /** The keys a `[roles.<name>]` table can hold. Anything else is reported by `check`. */
-export const ROLE_KEYS = ["writes", "private", "keys", "key_mode", "inject_hosts", "env", "network", "never_writes", "local_binding", "local_ports", "browsers", "mcp", "trustd", "control_files", "reads", "toolchain", "verify", "handoff"];
+export const ROLE_KEYS = ["writes", "private", "keys", "key_mode", "inject_hosts", "env", "network", "never_writes", "local_binding", "local_ports", "browsers", "mcp", "trustd", "control_files", "reads", "toolchain", "verify", "handoff", "handoff_exempt", "requests"];
 
 /**
  * `control_files`: which families of control files a role may edit. Refused at
@@ -1081,7 +1198,7 @@ function readNeverWrites(value, where) {
 function readPrivate(value, where) {
   const list = value === undefined ? [] : asArray(value, where);
   for (const p of list) {
-    const dir = p.replace(/\/\*\*$/, "").replace(/\/+$/, "").replace(/^\.\//, "");
+    const dir = trimSlashes(p.replace(/\/\*\*$/, "")).replace(/^\.\//, "");
     if (p.startsWith("/"))
       throw new Error(`${where}: "${p}" is absolute. A private folder is relative to the repo root, like writes.`);
     if (dir.split("/").includes(".."))
@@ -1091,13 +1208,13 @@ function readPrivate(value, where) {
         `"notes/**" — and every other role is denied it.`);
     if (/[*?[\]{}]/.test(dir))
       throw new Error(`${where}: "${p}" is a pattern. A private folder is one path and everything under it: ` +
-        `write "${dir.replace(/\/?[^/]*[*?[\]{}].*$/, "") || "dir"}/**".`);
+        `write "${beforeGlob(dir) || "dir"}/**".`);
   }
   return list;
 }
 
 /** `private` with its `/**` and `./` taken off: the folder itself. */
-export const privateDir = (p) => p.replace(/\/\*\*$/, "").replace(/\/+$/, "").replace(/^\.\//, "");
+export const privateDir = (p) => trimSlashes(p.replace(/\/\*\*$/, "")).replace(/^\.\//, "");
 
 /**
  * One owner per private folder. Two roles naming the same folder, or one

package/src/help.js

@@ -12,14 +12,15 @@ import { LIMITS } from "./inspect/limits.js";
 
 export const COMMAND_HELP = {
   run: {
-    usage: ["seisin run <role> [--observe] [--debug-env] [--agent <name>] [--handoff <id>] [--expect-denied <path>]... -- <command...>"],
-    values: ["--agent", "--handoff", "--expect-denied"],
+    usage: ["seisin run <role> [--observe] [--debug-env] [--agent <name>] [--handoff <id>] [--expect-denied <path>]... [--run-id <id>] -- <command...>"],
+    values: ["--agent", "--handoff", "--expect-denied", "--run-id"],
     flags: [
       ["--observe", "open the repo for this run and record what the agent writes; keys and network stay shut"],
       ["--debug-env", "print the environment variables the role does not get"],
       ["--agent <name>", "claude, codex or none: which agent the command runs, when seisin cannot tell from it (a wrapper script). Its home is the run's scratch; the other agents' sign-in is closed"],
       ["--handoff <id>", "this run takes a pending request handed to this role, and starts only if the policy routes that request here. Its own requests join the handoff chain"],
       ["--expect-denied <path>", "a path the caller will probe and expects to be denied (its own canary). That exact path is logged as expected and files no request; repeatable. Any other path is asked as usual"],
+      ["--run-id <id>", "the launcher's own id for this run, used in the log instead of a random one, so an orchestrator's records and seisin's join on it"],
     ],
     notes: ["Everything after -- is the command's own, flags included: `-- claude --settings x.json` goes to claude."],
     examples: ['seisin run frontend -- claude', 'seisin run backend --observe -- claude -p "…"'],
@@ -28,11 +29,12 @@ export const COMMAND_HELP = {
       ["128+n", "killed by signal n (130 for ctrl-c)"], ["2", "seisin could not start it (usage, policy, runtime)"]],
   },
   check: {
-    usage: ["seisin check [role] [--verbose] [--verify] [--parallel] [--system-log]"],
+    usage: ["seisin check [role] [--verbose] [--verify] [--parallel] [--system-log] [--json]"],
     flags: [["--verbose", "also print the protected paths and each warning's explanation (the limits of every repo: seisin help limits)"],
       ["--verify", "run each role's verify command inside its sandbox (the one thing check executes)"],
       ["--parallel", "experimental: with --verify, run role checks concurrently; shared resources may race"],
-      ["--system-log", "macOS: measure for 3 s whether the system log is dropping messages, and who writes the most; exits 1 when it is"]],
+      ["--system-log", "macOS: measure for 3 s whether the system log is dropping messages, and who writes the most; exits 1 when it is"],
+      ["--json", "the same answer for a program: seisin's version and capabilities, the sandbox each role gets (path and version), the warnings"]],
     examples: ["seisin check", "seisin check frontend --verbose", "seisin check backend --verify", "seisin check --verify --parallel"],
     exits: [["0", "the policy can be enforced as written (warnings included)"], ["1", "a role cannot be enforced as written, or its verify failed"], ["2", "usage or policy error"]],
   },

package/src/inspect/inject.js

@@ -11,6 +11,7 @@
  * price printed next to the thing it buys.
  */
 import { injectKeysOf } from "../keys.js";
+import { sandboxesOf } from "../sandboxes/index.js";
 import { coversHost as covers } from "../srt.js";
 
 export function injectWarnings(config, roles) {
@@ -27,14 +28,24 @@ export function injectWarnings(config, roles) {
     if (inject.length === 0) continue;
     const allowed = r.network ?? config.allowedDomains ?? [];
 
-    if (process.platform !== "linux")
+    // Which sandbox masks is the sandbox's to say (sandboxes/, `masks`): on macOS
+    // only tartaros does, so a provider list without it cannot run the role here.
+    const names = sandboxesOf(config).map((s) => s.name);
+    if (process.platform === "darwin" && !names.includes("tartaros"))
       out.push({
         kind: "inject-platform",
         role: r.name,
-        headline: `${r.name}: key_mode = "inject" is not available on ${process.platform} — it is Linux-only for now`,
-        detail: `On this machine the role will not run. Masked injection on macOS is tracked upstream ` +
-          `(anthropics/sandbox-runtime#593) and enables once that lands. Run this role on Linux, or ` +
-          `use "env"/"run-file" here.`,
+        headline: `${r.name}: key_mode = "inject" needs tartaros on macOS — [sandbox] provider is ${names.join(", ")}`,
+        detail: `On macOS sandbox-runtime does not mask credentials yet (anthropics/sandbox-runtime#593), so ` +
+          `this role will not run here. Add tartaros: [sandbox] provider = ["tartaros", "srt"]. Or run it on ` +
+          `Linux, or use "env"/"run-file" here.`,
+      });
+    else if (process.platform !== "linux" && process.platform !== "darwin")
+      out.push({
+        kind: "inject-platform",
+        role: r.name,
+        headline: `${r.name}: key_mode = "inject" is not available on ${process.platform}`,
+        detail: `No sandbox seisin runs here masks credentials. Run this role on Linux or macOS, or use "env"/"run-file".`,
       });
 
     for (const c of inject) {

package/src/keys.js

@@ -30,8 +30,8 @@
  * policy holds a reviewable reference instead of a path, and every resolution
  * is logged without its value (`event: "key"`, see commands/run.js) — but it is not "the agent never sees it". That
  * is `inject`, which costs terminating the role's TLS with a CA of your own and
- * is Linux-only for now (see `injectGate` and `injectKeysOf` below); off Linux
- * `modeOf` holds it, with the reason in the message.
+ * needs a sandbox that masks credentials: srt on Linux, tartaros on Linux and
+ * macOS (see `injectGate` below, and `masks` on each sandbox).
  *
  * ## Why the value is never written down
  *
@@ -375,7 +375,7 @@ export function readFileRef(entry, root = ".", { exact = false } = {}) {
 export const RESERVED_ENV = new Set([
   // The last is handoff.js's CHAIN_ENV, spelled out: handoff.js reaches this
   // module through owners.js, and importing it back would be a cycle.
-  "SEISIN_ROLE", "SEISIN_CONFIG", SOCK_ENV, "SEISIN_HANDOFF_CHAIN",
+  "SEISIN_ROLE", "SEISIN_CONFIG", "SEISIN_ROOT", "SEISIN_STATE_DIR", SOCK_ENV, "SEISIN_HANDOFF_CHAIN",
   ...BASE, ...Object.keys(DEFAULTS),
 ]);
 
@@ -522,23 +522,22 @@ export function modeOf(config, role, entry) {
 }
 
 /**
- * `inject` is the mode where the agent never sees the value: the runtime hands
- * the sandbox a sentinel and substitutes the real value on egress to the
- * credential's declared hosts. It is Linux-only in this version — masked
- * delivery is validated on the Linux backend; the macOS path is not enabled
- * yet and is tracked upstream, where the fit for it is a credential computed
- * per run rather than read from the environment
- * (anthropics/sandbox-runtime#593). Until that lands, macOS `inject` is held
- * rather than offered, with the alternatives in the message.
+ * `inject` is the mode where the agent never sees the value: the sandbox hands
+ * the agent a sentinel and substitutes the real value on egress to the
+ * credential's declared hosts. Which sandbox can do that is the sandbox's to
+ * say (`masks` in sandboxes/): srt on Linux, tartaros on Linux and macOS
+ * (srt's macOS path is tracked upstream, anthropics/sandbox-runtime#593). A
+ * sandbox that does not mask is never handed the role, because the real value
+ * is in the environment it is started with. Here only the platforms where no
+ * sandbox masks are refused outright.
  */
 function injectGate(role) {
-  if (process.platform === "linux") return;
+  if (process.platform === "linux" || process.platform === "darwin") return;
   throw new Error(
-    `roles.${role.name}: key_mode = "inject" is not available on ${process.platform} yet.\n` +
-    `  It is Linux-only for now; masked injection on macOS is tracked upstream ` +
-    `(anthropics/sandbox-runtime#593) and enables once that lands.\n` +
-    `  Use "env" or "run-file" here, or run this role on Linux. ` +
-    `See https://github.com/carlostapiacl/seisin/blob/main/docs/decisions.md.`);
+    `roles.${role.name}: key_mode = "inject" is not available on ${process.platform}.\n` +
+    `  No sandbox seisin runs here masks credentials: srt does on Linux, tartaros on Linux and macOS.\n` +
+    `  Use "env" or "run-file" here, or run this role on Linux or macOS. ` +
+    `See https://github.com/carlostapiacl/seisin/blob/main/docs/keys.md.`);
 }
 
 /**

package/src/kinds.js

@@ -85,6 +85,10 @@ const SCRATCH_FILE = [
   /^\.!\d+!/,                                  // `.!36165!file` — a copy in flight
   /^\.DS_Store$/,
   /^pytest-cache-files-/,
+  // Vite and Vitest bundle a TS config into `vite.config.ts.timestamp-<ms>-<hash>.mjs`
+  // beside it, load it and delete it: a name that never repeats, found asked for
+  // 28 times in one orchestrator's queue, owned by a phase that takes no work.
+  /\.timestamp-\d+(-[0-9a-f]+)?\.[cm]?js$/,
   /(^|[-_])logs?$/i,                           // `logs`, `latest_logs`: what a run leaves
 ];
 /**
@@ -230,8 +234,22 @@ export function kindsOf(targets, opts = {}) {
 export const EXPECTED = {
   plugins:
     "Claude Code updating its plugins from inside the sandbox: plugins run outside it and update there, so the denial is expected — nothing to grant",
+  "os-background":
+    "macOS frameworks reaching for shared state every program touches at start (preferences, notifications, a compatibility sysctl): denied, and nothing the agent does depends on it — nothing to grant",
 };
 
+/**
+ * The system denials macOS frameworks cause in any sandboxed program, whatever
+ * it is doing: counted in one orchestrator's runs, 280 lines of them against the
+ * handful that were the task's. Exact names, so a service the agent itself asks
+ * for still reads as a wall.
+ */
+const OS_BACKGROUND = new Set([
+  "apple.shm.notification_center", "apple.cfprefs.daemonv1", "com.apple.AppleDatabaseChanged",
+  "kcfpreferencesanyapplication", "kern.tcsm_enable", "kern.system_version_compat",
+]);
+const OS_BACKGROUND_RE = /^apple\.cfprefs\.\d+v1$/;   // the per-user cfprefs segment
+
 /**
  * `{ kind, hint }` when the refusal of `target` is expected, else null.
  *
@@ -240,6 +258,7 @@ export const EXPECTED = {
  */
 export function expectedOf(target, { home = homedir(), env = process.env } = {}) {
   const t = String(target ?? "").replace(/\\/g, "/");
+  if (OS_BACKGROUND.has(t) || OS_BACKGROUND_RE.test(t)) return { kind: "os-background", hint: EXPECTED["os-background"] };
   const roots = [
     env.CLAUDE_CONFIG_DIR,
     home && `${home.replace(/\/+$/, "")}/.claude`,

package/src/log.js

@@ -16,13 +16,14 @@
 import { appendFileSync, closeSync, existsSync, fstatSync, mkdirSync, openSync, readdirSync, readFileSync, readSync, renameSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { basename, dirname, join } from "node:path";
-import { STATE_DIR, LOG_NAME } from "./layout.js";
+import { LOG_NAME } from "./layout.js";
+import { stateDir } from "./state.js";
 import { send } from "./spool.js";
 
 export { STATE_DIR, LOG_NAME } from "./layout.js";
 
 export function logPath(root) {
-  return join(root, STATE_DIR, LOG_NAME);
+  return join(stateDir(root), LOG_NAME);
 }
 
 /**

package/src/requests.js

@@ -33,7 +33,8 @@ import { protectedBy } from "./surface.js";
 import { appendFileSync, chmodSync, closeSync, fstatSync, mkdirSync, openSync, readFileSync, readSync, statSync, writeFileSync, renameSync, unlinkSync } from "node:fs";
 import { randomBytes } from "node:crypto";
 import { dirname, join } from "node:path";
-import { STATE_DIR, tomlString } from "./layout.js";
+import { tomlString } from "./layout.js";
+import { stateDir } from "./state.js";
 import { send } from "./spool.js";
 import { withLock, readEntries } from "./log.js";
 import { loadConfig, policyId } from "./config.js";
@@ -41,7 +42,7 @@ import { loadConfig, policyId } from "./config.js";
 const REQUESTS_NAME = "requests.jsonl";
 
 export function requestsPath(root) {
-  return join(root, STATE_DIR, REQUESTS_NAME);
+  return join(stateDir(root), REQUESTS_NAME);
 }
 
 /**
@@ -663,6 +664,10 @@ export function refuseIfBarred(config, request) {
  * one step to anyone else taking this lock.
  */
 export function editPolicy(config, mutate, { waitMs = 10000, after = null } = {}) {
+  // A JSON policy (`--policy x.json`) is generated by whoever launches the run;
+  // an edit here would be overwritten there, so it is made there.
+  if (String(config.path).endsWith(".json"))
+    throw new Error(`${config.path} is a generated JSON policy: change it where it is generated, not with grant`);
   return withLock(policyLockBase(config), () => {
     const before = readFileSync(config.path, "utf8");
     const result = mutate(before);
@@ -686,7 +691,7 @@ export function editPolicy(config, mutate, { waitMs = 10000, after = null } = {}
  * nothing confined can hold this one. withLock adds the `.lock`.
  */
 export function policyLockBase(config) {
-  const dir = join(config.root, STATE_DIR);
+  const dir = stateDir(config.root);
   mkdirSync(dir, { recursive: true });
   return join(dir, "policy");
 }
@@ -708,7 +713,7 @@ export function policyLockBase(config) {
 function writePolicy(config, text) {
   const mode = statSync(config.path).mode & 0o777;
   const name = `seisin.toml.tmp-${randomBytes(12).toString("hex")}`;
-  const stateTmp = join(config.root, STATE_DIR, name);
+  const stateTmp = join(stateDir(config.root), name);
   writeFileSync(stateTmp, text, { flag: "wx", mode });
   try {
     chmodSync(stateTmp, mode);

package/src/runs.js

@@ -17,11 +17,21 @@
  * seconds over hundreds of runs re-reads a directory listing and some stats,
  * not every log.
  */
-import { readdirSync, readFileSync, statSync } from "node:fs";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { loadConfig } from "./config.js";
-import { read, logPath } from "./log.js";
-import { requestsPath } from "./requests.js";
+import { read } from "./log.js";
+import { STATE_DIR, LOG_NAME } from "./layout.js";
+import { expectedOf } from "./kinds.js";
+
+/**
+ * An archived run's own files, always at `<run>/.seisin/`: a run folder is read
+ * as it was written, whatever `--state-dir` this process was given. A launcher
+ * that runs with `--policy <run>/seisin.toml --state-dir <run>/.seisin` writes
+ * each run straight into this shape, and has nothing to copy at the end.
+ */
+const logPath = (root) => join(root, STATE_DIR, LOG_NAME);
+const requestsPath = (root) => join(root, STATE_DIR, "requests.jsonl");
 
 /** The name a run's folder may have: what becomes `run=` in a link. */
 const RUN_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
@@ -51,9 +61,11 @@ export function runFolders(dir) {
   return names.filter((d) => d.isDirectory() && isRunId(d.name)).map((d) => d.name).sort();
 }
 
-/** Where a run's policy is. */
+/** Where a run's policy is: `seisin.toml`, or `seisin.json` for a launcher that generates JSON. */
 export function runPolicy(dir, id) {
-  return join(dir, id, "seisin.toml");
+  const toml = join(dir, id, "seisin.toml");
+  const json = join(dir, id, "seisin.json");
+  return existsSync(toml) || !existsSync(json) ? toml : json;
 }
 
 /**
@@ -66,7 +78,7 @@ function signatureOf(dir, id) {
   const root = join(dir, id);
   const log = logPath(root);
   return [
-    statSig(join(root, "seisin.toml")),
+    statSig(runPolicy(dir, id)),
     statSig(join(root, "run.json")),
     statSig(requestsPath(root)),
     statSig(log),
@@ -114,8 +126,8 @@ function summarize(dir, id) {
   let cfg;
   try { cfg = loadConfig(runPolicy(dir, id)); }
   catch (e) {
-    return { ...base, outcome: "unread", error: e.code === "ENOENT" ? "no seisin.toml in this run's folder" : e.message,
-      roles: [], denied: 0, byKind: {}, expected: 0, retried: 0, causes: [], hosts: [], entries: 0, canary: null };
+    return { ...base, outcome: "unread", error: e.code === "ENOENT" ? "no seisin.toml (or seisin.json) in this run's folder" : e.message,
+      roles: [], denied: 0, byKind: {}, expected: 0, retried: 0, causes: [], hosts: [], entries: 0, canary: null, dropped: 0 };
   }
   const all = read(logPath(cfg.root));
   /**
@@ -131,7 +143,9 @@ function summarize(dir, id) {
   const groups = new Map();
   for (const e of all) {
     if (e.verdict !== "denied") continue;
-    if (e.expected === true) { expected++; continue; }
+    // macOS framework housekeeping counts as expected even in a log written
+    // before seisin said so (kinds.js expectedOf).
+    if (e.expected === true || (e.kind === "system" && expectedOf(e.target))) { expected++; continue; }
     const k = e.kind ?? "file";
     byKind[k] = (byKind[k] ?? 0) + 1;
     if (k !== "system") denied++;
@@ -144,6 +158,9 @@ function summarize(dir, id) {
   const causes = [...groups.values()].sort((a, b) => b.times - a.times);
   const retried = causes.reduce((n, g) => n + (g.about === "system" ? 0 : g.times - 1), 0);
   const hosts = causes.filter((g) => g.about === "network").slice(0, 10).map(({ target, times }) => ({ target, times }));
+  // Batches of kernel messages the system log threw away during the run: its
+  // walls may be missing some. The boundary held; the record did not.
+  const dropped = all.filter((e) => e.event === "log-dropped").reduce((n, e) => n + (Number(e.batches) || 0), 0);
   const canaries = all.filter((e) => e.event === "canary");
   const canary = canaries.length ? canaries[canaries.length - 1] : null;
   const outcome = canaries.some((e) => e.confined === false) ? "refused" : denied ? "denied" : "clean";
@@ -164,6 +181,7 @@ function summarize(dir, id) {
     // Kept whole for the sum across runs, cut to RUN_CAUSES when sent.
     causes,
     canary: canary ? { confined: canary.confined !== false, reasons: canary.reasons ?? [] } : null,
+    dropped,
   };
 }
 
@@ -267,13 +285,14 @@ export function runsView(dir, filters = {}, { scanned = scanRuns(dir) } = {}) {
 function viewOf(dir, filters, every) {
   const shown = every.filter((r) => matches(r, filters))
     .sort((a, b) => cmp(b.started_at ?? "", a.started_at ?? "") || cmp(b.id, a.id));
-  const totals = { runs: shown.length, denied: 0, retried: 0, expected: 0, byKind: {}, outcome: {} };
+  const totals = { runs: shown.length, denied: 0, retried: 0, expected: 0, byKind: {}, outcome: {}, incomplete: 0 };
   for (const r of shown) {
     totals.denied += r.denied;
     totals.retried += r.retried;
     totals.expected += r.expected;
     for (const [k, n] of Object.entries(r.byKind)) totals.byKind[k] = (totals.byKind[k] ?? 0) + n;
     totals.outcome[r.outcome] = (totals.outcome[r.outcome] ?? 0) + 1;
+    if (r.dropped) totals.incomplete++;
   }
   return {
     mode: "runs",

package/src/sandboxes/command.js

@@ -85,6 +85,9 @@ export function commandSandbox(name, command, check = null, { tagsDenials = fals
     assess,
     unmet: (settings, ctx) => assess(settings, ctx).unmet,
     wrap: (bin, file, _settings, inner) => [bin, ...withPolicy(command.slice(1), file), ...inner],
+    // A sandbox of your own is not known to mask credentials, and it is started
+    // with the real value in its environment: an inject role is never its.
+    masks: () => `masked credentials (key_mode = "inject"): ${name} is not known to mask them, and it would start with the real value in its environment`,
     // Declared, not detected: `tags_denials = true` says its Seatbelt denials
     // carry sandbox-runtime's tag (docs/sandboxes.md). Without it, on macOS,
     // none of the kernel's refusals under it reach the log.

package/src/sandboxes/index.js

@@ -49,6 +49,8 @@ export function sandboxesOf(config) {
 export function weigh(config, settings, { platform = process.platform, role = null, locate = true, file = null } = {}) {
   const list = sandboxesOf(config);
   const register = role ? machOf(config.roles?.[role]).register : [];
+  const exempt = role ? (config.roles?.[role]?.handoffExempt ?? []).map((e) => join(config.root, e)) : [];
+  const requests = role ? (config.roles?.[role]?.requests ?? []) : [];
   let scratch = null;
   let copies = 0;
   // The file a sandbox is asked about is the one it would be handed: the run's
@@ -63,7 +65,7 @@ export function weigh(config, settings, { platform = process.platform, role = nu
   try {
     const options = list.map((sandbox) => {
       const bin = locate ? sandbox.locate() : "(not looked up)";
-      const own = settingsOf(sandbox, settings, { machRegister: register });
+      const own = settingsOf(sandbox, settings, { machRegister: register, handoffExempt: exempt, requests });
       const asked = sandbox.asksFile && locate && bin;
       const ctx = { platform, role, bin, file: asked ? fileFor(own) : null };
       const { unmet, warnings } = sandbox.asksFile && !asked ? { unmet: [], warnings: [] }
@@ -71,10 +73,25 @@ export function weigh(config, settings, { platform = process.platform, role = nu
       // `browsers`: a Mach service to register. srt's schema has no field for it
       // (srt-mach.mjs adds it); tartaros takes it as network.allowMachRegister
       // (adapt). A sandbox that is given it neither way cannot hold the role.
+      // `inject`: the real value is in the environment the sandbox starts with,
+      // so only one that masks credentials may be handed the role.
+      const masked = (own.credentials?.envVars ?? []).length > 0;
+      const masking = masked ? (sandbox.masks ? sandbox.masks(platform) : `masked credentials: ${sandbox.name} does not mask them`) : null;
       const browser = register.length && !sandbox.machRegister
         ? [`a Mach service to register (${register.join(", ")}, for browsers): ${sandbox.name} is not given it, only srt and tartaros are`]
         : [];
-      return { sandbox, bin, unmet: [...unmet, ...browser], warnings, missing: bin ? null : sandbox.missing() };
+      // `handoff_exempt`: a folder where trust-handoff is not protected. Only a
+      // sandbox that opens exactly that is handed the role; srt protects its
+      // own surfaces with no way to exempt a subtree.
+      const exemption = exempt.length && !sandbox.handoffExempt
+        ? [`handoff_exempt (${config.roles[role].handoffExempt.join(", ")}): ${sandbox.name} cannot leave a folder out of its trust-handoff protection, tartaros can`]
+        : [];
+      // `requests`: methods and paths per host. srt takes them only as a library
+      // callback, so seisin cannot hand them to it.
+      const ruled = requests.length && !sandbox.requestRules
+        ? [`requests (${requests.map((q) => q.host).join(", ")}): ${sandbox.name} cannot limit the methods and paths of a host from its settings, tartaros can`]
+        : [];
+      return { sandbox, bin, unmet: [...(masking ? [masking] : []), ...unmet, ...browser, ...exemption, ...ruled], warnings, missing: bin ? null : sandbox.missing() };
     });
     const chosen = options.find((o) => o.bin && o.unmet.length === 0) ?? null;
     return { chosen, options };

package/src/sandboxes/srt.js

@@ -150,6 +150,9 @@ export const srt = {
   locate: () => resolveSrt(),
   missing: () => `sandbox runtime not found. ${installHint()}`,
   unmet: () => [],
+  // Masked credentials: on Linux; on macOS not yet (anthropics/sandbox-runtime#593).
+  masks: (platform) => platform === "linux" ? null
+    : `masked credentials (key_mode = "inject") on ${platform}: sandbox-runtime does not mask them there yet (anthropics/sandbox-runtime#593); tartaros does`,
   // `--` before the command, and it is not cosmetic. Without it the runtime's
   // own argument parser reaches into what the agent was invoked with and eats
   // anything resembling one of its flags: `claude --settings`, `claude -c`.

package/src/sandboxes/tartaros.js

@@ -17,6 +17,7 @@
  * check` says so), and the canary still checks every run that it can.
  */
 import { existsSync } from "node:fs";
+import { spawnSync } from "node:child_process";
 import { createRequire } from "node:module";
 import { join, dirname, delimiter } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -58,7 +59,17 @@ export function dependencyTartaros(from = HERE) {
 }
 
 /** The command line for one run: the settings as they are, the role as a label. */
-export function tartarosArgv(bin, file, inner, { role = null, machRegister = [] } = {}) {
+/** Whether this tartaros takes `--egress-log` (0.1.0-alpha.18): asked once per binary. */
+const egressLog = new Map();
+export function supportsEgressLog(bin) {
+  if (!egressLog.has(bin)) {
+    const r = spawnSync(bin, ["--help"], { encoding: "utf8", timeout: 5000 });
+    egressLog.set(bin, `${r.stdout ?? ""}${r.stderr ?? ""}`.includes("--egress-log"));
+  }
+  return egressLog.get(bin);
+}
+
+export function tartarosArgv(bin, file, inner, { role = null, machRegister = [], log = null } = {}) {
   // A browser role gets tartaros's browser grants — the shared memory, IOKit
   // classes and sysctls a headless Chromium dies without (f7edae1) — and a
   // run-private TMPDIR, the only place it may open a unix socket (bcb0c69):
@@ -68,7 +79,13 @@ export function tartarosArgv(bin, file, inner, { role = null, machRegister = []
   // the role gets — built from the role's own list (env.js), with the hook's
   // socket, the role's name and its env-mode keys. tartaros's own scrub
   // (7f9925f) would drop those, and the hook would go silent.
-  return [bin, "run", ...(role ? ["--role", role] : []), "--inherit-env", ...browser, "--settings", file, "--", ...inner];
+  // --egress-log: tartaros's record of its egress broker's decisions, read back
+  // into seisin's log at the end of the run (commands/run.js, brokerDenials).
+  // Not --log, which also starts the effect collectors (more than a second a
+  // run, measured). A tartaros older than the flag gets nothing: an unknown
+  // option would refuse the run.
+  const record = log && supportsEgressLog(bin) ? ["--egress-log", log] : [];
+  return [bin, "run", ...(role ? ["--role", role] : []), "--inherit-env", ...browser, ...record, "--settings", file, "--", ...inner];
 }
 
 /** What tartaros says of this file: what it cannot hold, and its warnings. Only asked of a binary that was found. */
@@ -85,9 +102,15 @@ export const tartarosUnmet = (bin, file, ctx) => tartarosAssess(bin, file, ctx).
  * (tartaros 99b0117). Only when there is one: an unchanged role is handed the
  * same file as before, and srt, whose schema is strict, never sees the field.
  */
-export function tartarosSettings(settings, { machRegister = [] } = {}) {
-  if (!machRegister.length) return settings;
-  return { ...settings, network: { ...settings.network, allowMachRegister: machRegister.map((p) => `${p}*`) } };
+export function tartarosSettings(settings, { machRegister = [], handoffExempt = [], requests = [] } = {}) {
+  if (!machRegister.length && !handoffExempt.length && !requests.length) return settings;
+  let out = settings;
+  if (machRegister.length) out = { ...out, network: { ...out.network, allowMachRegister: machRegister.map((p) => `${p}*`) } };
+  // tartaros's own field (its --handoff-exempt), absolute: srt never sees it.
+  if (handoffExempt.length) out = { ...out, filesystem: { ...out.filesystem, handoffExempt } };
+  // tartaros's own field (its --allow-request): the only requests an allowed host gets.
+  if (requests.length) out = { ...out, network: { ...out.network, requestRules: requests } };
+  return out;
 }
 
 export const tartaros = {
@@ -95,8 +118,16 @@ export const tartaros = {
   locate: () => resolveTartaros(),
   missing: () => `tartaros not found: neither ${TARTAROS_PACKAGE}, which installs with seisin unless optional dependencies are left out, nor tartaros on PATH.`,
   asksFile: true,
+  // Masked credentials: tartaros says whether it masks them, through explain
+  // (0.1.0-alpha.16 and later do; earlier ones refuse the field).
+  masks: () => null,
   adapt: tartarosSettings,
   machRegister: true,
+  // Takes filesystem.handoffExempt (tartaros 0.1.0-alpha.18): a folder left out of
+  // its trust-handoff protection.
+  handoffExempt: true,
+  // Takes network.requestRules (0.1.0-alpha.18): methods and paths per host.
+  requestRules: true,
   assess: (_settings, { bin, file, platform } = {}) => tartarosAssess(bin, file, { platform }),
   unmet: (_settings, { bin, file, platform } = {}) => tartarosUnmet(bin, file, { platform }),
   wrap: (bin, file, _settings, inner, ctx) => tartarosArgv(bin, file, inner, ctx),

package/src/srt.js

@@ -535,8 +535,11 @@ export function settingsFor(config, roleName, spool = null, observe = false, { a
      * Masked credentials: the real value reaches the runtime's own environment
      * (run.js), never the sandbox, which sees `fake_value_…`. `mode: "mask"`
      * and the per-credential `injectHosts` are all that is emitted — no
-     * `extract`, `decode`, files or SigV4, and never `allowPlaintextInject`,
+     * `extract`, `decode`, files or `awsPairs`, and never `allowPlaintextInject`,
      * which over HTTPS carries the sentinel and so is deny with extra steps.
+     * An AWS pair under its usual names (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY)
+     * is paired by the sandbox itself and re-signed (srt; tartaros from
+     * 0.1.0-alpha.18).
      */
     ...(credentials ? { credentials } : {}),
   };

package/src/state.js

@@ -0,0 +1,25 @@
+/**
+ * Where this process keeps seisin's own files: the log, the request queue and
+ * their lock.
+ *
+ * `<root>/.seisin/` unless a launcher keeps them elsewhere with `--state-dir`
+ * (an orchestrator that archives each run in a folder of its own, and should
+ * not have to copy a directory out of a worktree it is about to delete). The
+ * choice travels to everything a run starts as SEISIN_STATE_DIR, so the hook
+ * inside the sandbox and the parent agree on one place.
+ */
+import { join, resolve } from "node:path";
+import { STATE_DIR } from "./layout.js";
+
+let override = process.env.SEISIN_STATE_DIR ? resolve(process.env.SEISIN_STATE_DIR) : null;
+
+/** The state directory for a policy rooted at `root`. */
+export function stateDir(root) {
+  return override ?? join(root, STATE_DIR);
+}
+
+/** `--state-dir`: from now on, and for everything this process starts. */
+export function setStateDir(dir) {
+  override = resolve(dir);
+  process.env.SEISIN_STATE_DIR = override;
+}

package/src/surface.js

@@ -32,7 +32,8 @@ import { join, isAbsolute, delimiter, dirname, resolve, basename, sep } from "no
 import { fileURLToPath } from "node:url";
 import { homedir } from "node:os";
 import { writePathsOf, realOrSelf } from "./grants.js";
-import { STATE_DIR, CONFIG_NAME } from "./layout.js";
+import { CONFIG_NAME } from "./layout.js";
+import { stateDir } from "./state.js";
 
 /** seisin's own package: the code the next `seisin run` executes. */
 const SEISIN_HOME = realOrSelf(join(dirname(fileURLToPath(import.meta.url)), ".."));
@@ -270,7 +271,7 @@ function computeParentInputs(config, env) {
     // for a person to diff and move onto the policy; a role that could write it
     // could plant a policy the operator then promotes in good faith.
     { path: policy + ".observed", why: "the policy", always: true },
-    { path: abs(STATE_DIR), why: "seisin's log and request queue", always: true },
+    { path: stateDir(config.root), why: "seisin's log and request queue", always: true },
     ...(config.keyDirs ?? []).map((d) => ({ path: abs(d), why: "a key directory", always: true })),
   ];
   for (const [scheme, p] of Object.entries(config.keyProviders ?? {})) {

package/src/territory.js

@@ -59,6 +59,14 @@ export const READ_MODES = ["all", "territory"];
 /** Files an agent reads at start that live outside its home directory. */
 export const AGENT_FILES = { claude: ["~/.claude.json"], codex: [] };
 
+/**
+ * Files in HOME every process on the platform reads at start, whatever it is,
+ * and that hold nothing about anybody. On macOS CoreFoundation reads
+ * `~/.CFUserTextEncoding` (a text-encoding code, `0x1F5:0x0:0x0`); shut, it was
+ * 278 of 409 denials in one orchestrator's runs, every one of them noise.
+ */
+export const PLATFORM_FILES = { darwin: ["~/.CFUserTextEncoding"], linux: [] };
+
 /**
  * Where data lives, per platform. Whole roots: what is under them belongs to
  * somebody. `/opt/homebrew/var` and `/usr/local/var` hold the databases a
@@ -225,6 +233,7 @@ export function keptFor(config, role, { observe = false, agent, program } = {})
     // starts and says "Not logged in" (measured, 2026-10-09). A run of no
     // agent, or of another, does not get it.
     ...(agent ? (AGENT_FILES[agent] ?? []).map(expand) : []),
+    ...(PLATFORM_FILES[process.platform] ?? []).map(expand),
     ...writePathsOf(config, role, { observe, agent }),
     ...(role.reads ?? []).map((p) => readPath(config.root, p)),
     ...(role.toolchain ?? []).map((p) => readPath(config.root, p)),

package/ui/index.html

@@ -2403,15 +2403,18 @@ table.runs tr.sys td{color:var(--dim)}
     if (w.text) bits.push('started <span title="' + escA(w.title) + '">' + esc(w.text) + "</span>");
     return bits.join(" · ");
   }
-  function outcomeTag(o){
+  function outcomeTag(o, dropped){
     var says = { clean: "clean", denied: "denied", refused: "canary failed", unread: "policy unreadable" };
-    return '<span class="oc ' + escA(o) + '">' + esc(says[o] || o) + "</span>";
+    // A run whose system log dropped kernel messages: its walls may be missing some.
+    var lost = dropped ? ' <span class="oc refused" title="the system log dropped ' + escA(String(dropped)) +
+      ' batch(es) of kernel messages during this run: denials may be missing from its record">record incomplete</span>' : "";
+    return '<span class="oc ' + escA(o) + '">' + esc(says[o] || o) + "</span>" + lost;
   }
 
   function drawRunBanner(){
     var b = document.getElementById("run-banner");
     var r = RUNINFO || { id: RUN };
-    b.innerHTML = "<b>Run " + esc(r.run_id || r.id) + "</b> " + outcomeTag(r.outcome || "") +
+    b.innerHTML = "<b>Run " + esc(r.run_id || r.id) + "</b> " + outcomeTag(r.outcome || "", r.dropped) +
       ' · <a href="./">all runs</a>' +
       '<div class="meta">' + (runMeta(r) || "no run.json: only what its policy and log say") +
       " · read only: nothing is granted from here</div>";
@@ -2442,6 +2445,7 @@ table.runs tr.sys td{color:var(--dim)}
     document.getElementById("rn-kpis").innerHTML =
       card("b", "runs", t.runs, (t.outcome.denied || 0) + " denied something · " + (t.outcome.clean || 0) + " clean") +
       card(t.outcome.refused ? "a" : "g", "canary failed", t.outcome.refused || 0, "runs that never started") +
+      (t.incomplete ? card("a", "record incomplete", t.incomplete, "runs whose system log dropped kernel messages") : "") +
       card(t.denied ? "a" : "g", "denied", t.denied, (k.file || 0).toLocaleString() + " files · " + (k.network || 0).toLocaleString() + " network") +
       card(t.retried ? "a" : "g", "spent retrying", t.retried, "calls after the first denial of the same thing");
 
@@ -2463,7 +2467,7 @@ table.runs tr.sys td{color:var(--dim)}
           var w = when(r.started_at || "");
           return "<tr><td><a href=\"./?run=" + encodeURIComponent(r.id) + "#requests\"><code>" + esc(r.run_id || r.id) + "</code></a></td>" +
             '<td title="' + escA(w.title || "") + '">' + esc(w.text || "") + "</td><td>" + esc(r.team || "") + "</td><td>" + esc(r.role || "") +
-            "</td><td>" + esc(r.work_item || "") + "</td><td>" + esc(r.status || "") + "</td><td>" + outcomeTag(r.outcome) +
+            "</td><td>" + esc(r.work_item || "") + "</td><td>" + esc(r.status || "") + "</td><td>" + outcomeTag(r.outcome, r.dropped) +
             "</td><td class=num>" + r.denied + "</td><td class=num>" + r.retried + "</td><td>" +
             (r.hosts || []).slice(0, 3).map(function(h){ return "<code>" + esc(h.target) + "</code>"; }).join(" ") + "</td></tr>";
         }).join("") + "</tbody>"