kartikeya 0.0.1__tar.gz

kartikeya-0.0.1/.github/workflows/release.yml

@@ -0,0 +1,55 @@
+name: Release
+
+# Publishes to PyPI when a version tag is pushed (e.g. `git tag v0.0.1 && git push --tags`).
+#
+# Auth: a PyPI API token stored as the repo Actions secret `PYPI_API_TOKEN`
+# (Settings -> Secrets and variables -> Actions). One-time setup: create the
+# token on PyPI and add that secret. Until it exists, the publish step fails.
+# (Trusted Publishing / OIDC is the tokenless alternative but this project uses
+# the token pattern for parity with the operator's other releases.)
+
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Build sdist and wheel
+        run: |
+          python -m pip install --upgrade build
+          python -m build
+
+      - name: Check metadata
+        run: |
+          python -m pip install --upgrade twine
+          twine check dist/*
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          password: ${{ secrets.PYPI_API_TOKEN }}
+          attestations: false   # attestations require OIDC/Trusted Publishing

kartikeya-0.0.1/.github/workflows/tests.yml

@@ -0,0 +1,29 @@
+name: Tests
+
+on:
+  push:
+    branches: ["master", "main"]
+  pull_request:
+    branches: ["master", "main"]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install bubblewrap
+        run: sudo apt-get update && sudo apt-get install -y bubblewrap
+
+      - name: Install
+        run: pip install -e "." pytest
+
+      - name: Run tests
+        run: python -m pytest tests/ -q

kartikeya-0.0.1/.gitignore

@@ -0,0 +1,15 @@
+__pycache__/
+*.py[cod]
+*.egg-info/
+.eggs/
+build/
+dist/
+.venv/
+venv/
+.pytest_cache/
+.ruff_cache/
+*.db
+*.sqlite
+*.sqlite3
+.kart-scripts/
+.DS_Store

kartikeya-0.0.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Sean Campbell
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

kartikeya-0.0.1/PKG-INFO

@@ -0,0 +1,79 @@
+Metadata-Version: 2.4
+Name: kartikeya
+Version: 0.0.1
+Summary: Kartikeya — a standalone bubblewrap-sandboxed task queue and worker. Backend-agnostic (SQLite or Postgres); the execution engine formerly known as Kart.
+Project-URL: Homepage, https://github.com/rudi193-cmd/kartikeya
+Project-URL: Repository, https://github.com/rudi193-cmd/kartikeya
+Project-URL: Issues, https://github.com/rudi193-cmd/kartikeya/issues
+Author: Sean Campbell
+License: MIT
+License-File: LICENSE
+Keywords: bubblewrap,bwrap,kart,sandbox,task-queue,willow,worker
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Libraries
+Classifier: Topic :: System :: Distributed Computing
+Requires-Python: >=3.11
+Provides-Extra: llm
+Provides-Extra: postgres
+Requires-Dist: psycopg2-binary<3.0,>=2.9; extra == 'postgres'
+Description-Content-Type: text/markdown
+
+# Kartikeya
+
+> Skanda · Murugan — the six-faced commander of the divine armies, born to lead
+> the devas. The engine that marshals and runs a fleet's tasks. Colloquially:
+> **Kart**.
+
+A standalone, host-agnostic **task queue + sandboxed worker**. Submit shell (or,
+optionally, LLM-workflow) tasks to a queue; a worker claims them and runs each in
+a [bubblewrap](https://github.com/containers/bubblewrap) sandbox with an explicit
+mount/credential/network policy.
+
+Kartikeya is the execution engine extracted from the Willow fleet
+(`willow-2.0/core/kart_*`) and made to stand on its own — no fleet, no specific
+host, no required database server.
+
+## Status
+
+**Pre-alpha, under active extraction.** This repo is the target of a staged lift
+described in `docs/DESIGN.md`. The scaffold and the `TaskQueue` interface are in
+place; the sandbox/worker/execute core is being decoupled from its origin and
+brought over next.
+
+## Design goals
+
+- **Host-agnostic.** The only coupling — "where do tasks live" — is a small
+  `TaskQueue` interface a host implements. Kartikeya owns the sandbox, worker
+  loop, lanes, and command scan; the host owns storage and file roots.
+- **Zero-infra by default.** Ships a reference `SqliteTaskQueue`, so
+  `pip install kartikeya` can execute tasks with no Postgres and no fleet.
+- **Backend-swappable.** SQLite (bundled), Postgres, or a custom backend behind
+  the same interface.
+- **Sandboxed and network-gated.** Tasks run network-isolated unless the stored
+  task text carries a `# allow_net` directive; credentials reach only network-
+  enabled tasks. (Who is allowed to *write* that directive is the host's call —
+  see the security note in `docs/DESIGN.md`.)
+
+## Install
+
+```
+pip install kartikeya            # base: shell tasks, SQLite backend
+pip install "kartikeya[postgres]"  # + Postgres backend helpers
+pip install "kartikeya[llm]"       # + LLM-workflow task type
+```
+
+## Quickstart
+
+_Coming with stage 2 — once the worker core lands, this section documents
+`kartikeya worker` end to end (submit → worker runs → poll)._
+
+## License
+
+MIT © Sean Campbell

kartikeya-0.0.1/README.md

@@ -0,0 +1,52 @@
+# Kartikeya
+
+> Skanda · Murugan — the six-faced commander of the divine armies, born to lead
+> the devas. The engine that marshals and runs a fleet's tasks. Colloquially:
+> **Kart**.
+
+A standalone, host-agnostic **task queue + sandboxed worker**. Submit shell (or,
+optionally, LLM-workflow) tasks to a queue; a worker claims them and runs each in
+a [bubblewrap](https://github.com/containers/bubblewrap) sandbox with an explicit
+mount/credential/network policy.
+
+Kartikeya is the execution engine extracted from the Willow fleet
+(`willow-2.0/core/kart_*`) and made to stand on its own — no fleet, no specific
+host, no required database server.
+
+## Status
+
+**Pre-alpha, under active extraction.** This repo is the target of a staged lift
+described in `docs/DESIGN.md`. The scaffold and the `TaskQueue` interface are in
+place; the sandbox/worker/execute core is being decoupled from its origin and
+brought over next.
+
+## Design goals
+
+- **Host-agnostic.** The only coupling — "where do tasks live" — is a small
+  `TaskQueue` interface a host implements. Kartikeya owns the sandbox, worker
+  loop, lanes, and command scan; the host owns storage and file roots.
+- **Zero-infra by default.** Ships a reference `SqliteTaskQueue`, so
+  `pip install kartikeya` can execute tasks with no Postgres and no fleet.
+- **Backend-swappable.** SQLite (bundled), Postgres, or a custom backend behind
+  the same interface.
+- **Sandboxed and network-gated.** Tasks run network-isolated unless the stored
+  task text carries a `# allow_net` directive; credentials reach only network-
+  enabled tasks. (Who is allowed to *write* that directive is the host's call —
+  see the security note in `docs/DESIGN.md`.)
+
+## Install
+
+```
+pip install kartikeya            # base: shell tasks, SQLite backend
+pip install "kartikeya[postgres]"  # + Postgres backend helpers
+pip install "kartikeya[llm]"       # + LLM-workflow task type
+```
+
+## Quickstart
+
+_Coming with stage 2 — once the worker core lands, this section documents
+`kartikeya worker` end to end (submit → worker runs → poll)._
+
+## License
+
+MIT © Sean Campbell

kartikeya-0.0.1/docs/DESIGN.md

@@ -0,0 +1,197 @@
+# Spec: Kart Lift — extract a standalone `kart` package
+
+Status: DRAFT for review (2026-07-08). Engineering spec for the migration whose
+direction is set in `kart-productionization.md`. Resolves B-22.
+
+**Decisions locked (operator, 2026-07-08):**
+1. **Shared package** — Kart becomes its own installable package; willow-mcp
+   (and later willow-2.0) *depend* on it rather than vendoring a copy. No drift.
+2. **Product-neutral default** sandbox mount policy.
+3. **SQLite task backend** — the queue must run with **no Postgres**; a
+   zero-infra `pip install` can execute tasks.
+
+The big consequence: **the `kart` package must not import willow-mcp or
+willow-2.0.** Its coupling to a host (DB access, `$WILLOW_HOME`) is inverted
+into a small **backend interface** the host implements. Kart owns the sandbox,
+worker loop, lanes, and scan; the host owns "where tasks live" and "where files
+live."
+
+## 0. Goal & acceptance
+
+A clean `pip install willow-mcp` (which pulls in `kart`) can execute a submitted
+task end-to-end with **no Postgres and no willow-2.0 present**:
+```
+pip install willow-mcp          # depends on kart
+willow-mcp worker &             # drains the queue via the SQLite backend
+# via MCP:  task_submit(task="echo hi") -> task_status -> {status: completed, result: "hi"}
+```
+plus the same for an `allow_net=True` task with `task_net` granted (sandbox +
+gate work standalone), and the `kart` suite green with neither willow-mcp nor
+willow-2.0 on `sys.path`.
+
+## 1. The `kartikeya` package
+
+New **standalone repo** (operator decision). Distribution + import name
+**`kartikeya`** — bringing back Kart's full name (Skanda / Murugan, the
+six-faced commander of the divine armies; `docs/audits/KART_SANDBOX_AUDIT_2026-06-11.md`).
+"Kart" stays the colloquial short form in prose and existing `kart:*` task ids.
+~2,200 LOC lifted from willow-2.0 `core/kart_*`; own `pyproject`; depends only
+on stdlib + optional extras.
+
+```
+kartikeya/                     # new standalone GitHub repo
+  pyproject.toml               # name = "kartikeya"; deps: none (base); extras: [llm]
+  src/kartikeya/
+    __init__.py                # run_worker(), execute_task_row(), TaskQueue
+    sandbox.py                 # from kart_sandbox.py
+    execute.py                 # from kart_execute.py
+    worker.py                  # from kart_worker.py — takes a TaskQueue
+    lanes.py                   # from kart_lanes.py
+    task_scan.py               # from kart_task_scan.py
+    queue.py                   # TaskQueue ABC + SqliteTaskQueue reference impl
+    config.py                  # sandbox mount-policy loader + neutral default
+    data/kart-sandbox.json     # product-neutral default (§5); filename kept for continuity
+  tests/                       # carried test_kart_* + queue-backend tests
+```
+Console script: `kartikeya worker` (with a `kart` alias for muscle memory).
+willow-mcp keeps its own `willow-mcp worker` subcommand that constructs the
+backend and calls into the library (§3).
+
+### 1a. Dependency dispositions
+
+| willow-2.0 dependency | Disposition in `kart` |
+|---|---|
+| `kart_sandbox/execute/worker/lanes/task_scan` | **Lifted in** as the package core |
+| `core.pg_bridge.PgBridge` | **Inverted** → `TaskQueue` interface (§2); host supplies impl |
+| `willow.fylgja.willow_home` | **Inverted** → host passes a work-root; `kart` falls back to `$WILLOW_HOME`/CWD |
+| `willow.fylgja.python_env` | **Reimplemented** minimally in `kart` (stdlib `sysconfig` + venv detect) |
+| `core.loop_heartbeat` | **Callback seam** — `on_heartbeat` hook, default no-op |
+| `core.run_ledger` | **Callback seam** — `on_run_event` hook, default no-op |
+| `core.grove_gate` | **Dropped** (fleet governance) |
+| `core.outcomes` | **Dropped** (default) / host callback if wanted |
+| `core.llm_edge` | **Optional extra** `kart[llm]`; LLM task type disabled if absent |
+
+No `core.*` / `willow.fylgja.*` import survives in `kart`.
+
+## 2. The `TaskQueue` backend interface
+
+The one seam that inverts host coupling. `kart` defines the ABC; the worker
+loop is written against it:
+
+```python
+class TaskQueue(ABC):
+    @abstractmethod
+    def claim_pending(self, agent: str, limit: int) -> list[TaskRow]: ...   # atomic claim → 'running'
+    @abstractmethod
+    def mark_running(self, task_id: str) -> None: ...
+    @abstractmethod
+    def mark_done(self, task_id: str, *, status: str, result: str) -> None: ...  # completed|failed + completed_at
+    @abstractmethod
+    def pending_count(self) -> QueueStats: ...   # for liveness/fleet_health
+```
+`TaskRow` = `{task_id, task, agent, submitted_by, status}`.
+
+Three implementations:
+- **`SqliteTaskQueue`** (shipped *in* `kart`) — reference/zero-infra backend.
+  Atomic claim via a single `UPDATE tasks SET status='running' WHERE task_id IN
+  (SELECT task_id FROM tasks WHERE status='pending' AND agent=? LIMIT ?)
+  RETURNING …` inside `BEGIN IMMEDIATE` (SQLite serializes writers; safe).
+- **willow-mcp's Postgres impl** (in willow-mcp) — maps through willow-mcp's
+  schema-adaptation (`_TASK_FIELDS`), so it works against an *adopted* `tasks`
+  table, using `FOR UPDATE SKIP LOCKED` for the claim.
+- **willow-2.0's impl** (later) — wraps its existing `PgBridge`.
+
+This is also exactly what makes the **SQLite backend** (decision 3) fall out
+naturally rather than being bolted on.
+
+## 3. willow-mcp integration
+
+willow-mcp stays thin — it does **not** contain sandbox/worker code:
+- Adds `kart` to `dependencies`.
+- Implements `WillowMcpTaskQueue(TaskQueue)` over its adopted `tasks` table
+  (Postgres via schema-adaptation) **and** wires the shipped `SqliteTaskQueue`
+  for the no-Postgres path; backend chosen by config (Postgres if `WILLOW_PG_*`
+  present, else SQLite under `WILLOW_STORE_ROOT`).
+- Adds `willow-mcp worker` (argparse subcommand, consistent with `--serve`):
+  `--lane fast|batch`, `--slots N`, `--once`. Constructs the backend + calls
+  `kart.run_worker(queue=…, lane=…)`.
+- Ships the `CREATE TABLE tasks` DDL the review flagged missing
+  (`docs/schema/`), for both SQLite and Postgres, matching `_TASK_FIELDS`.
+
+## 4. Security posture (preserve + test)
+
+- **bwrap isolation** and **credential-prefix gating** carry over unchanged.
+- **Net-directive contract stays split (B-21 ↔ B-22):** the worker grants
+  egress iff the *stored task text* has a `# allow_net` line; willow-mcp's
+  `task_submit` is the only writer of that line, only under `task_net`,
+  stripping caller copies. Ship an **end-to-end test in willow-mcp**: a
+  `task_queue`-only app submitting `task="curl …\n# allow_net"` with
+  `allow_net=False` runs **network-isolated**; a `task_net` app with
+  `allow_net=True` runs with egress. Most likely seam to regress in the lift.
+- `kart` also gets a unit test that `task_allows_network()` still keys on
+  `line.strip() == "# allow_net"` exactly (the contract willow-mcp's strip
+  depends on).
+
+## 5. Sandbox config — product-neutral default
+
+Vendored `kart/data/kart-sandbox.json`: keep `WILLOW_`, `PG`, `POSTGRES`,
+`OLLAMA_`, `GIT_` prefixes and generic bind paths; **drop** fleet-only
+`GROVE_`/`SAFE_` prefixes and fleet bind paths from the *default*. Resolution:
+`$KART_SANDBOX_CONFIG` → `$WILLOW_HOME/kart-sandbox.json` → vendored default.
+Templating (`{{HOME}}`, `{{WILLOW_ROOT}}`) preserved. The fleet keeps its richer
+policy via the override file — parity without shipping fleet surface.
+
+## 6. Test migration
+
+Carry `tests/test_kart_*.py` into `kart/tests/`, replacing fleet imports with a
+fake `TaskQueue`, a tmp `kart-sandbox.json`, and no-op heartbeat/run callbacks.
+Add `SqliteTaskQueue` backend tests (concurrent claim, no double-execution).
+Gate bwrap tests on `bwrap_available()` so CI without bwrap skips, not fails.
+
+## 7. Optional LLM task type
+
+`kart[llm]` extra. Base worker runs shell tasks with zero LLM deps; an LLM task
+submitted without the extra fails cleanly (`{"error": "llm task type requires
+kart[llm]"}`), never an import crash. (willow-2.0 supplies its own `llm_edge`
+adapter behind the extra's hook.)
+
+## 8. Staged PRs / milestones
+
+Spans two (maybe three) repos; sequence willow-mcp value first.
+
+1. **Extract `kart` (new package):** lift the 5 files, sever fleet imports per
+   §1, define `TaskQueue` + `SqliteTaskQueue`, callback seams, neutral config.
+   *Acceptance: `kart`'s own suite green standalone; `pip install kart` +
+   SqliteTaskQueue executes a shell task in a sandbox.*
+2. **willow-mcp integration:** depend on `kart`, add `WillowMcpTaskQueue`
+   (Pg + SQLite), `willow-mcp worker`, DDL. *Acceptance: §0 end-to-end on a
+   clean venv, no Postgres.*
+3. **Security e2e + docs → B-22 Fixed:** the §4 net-gate e2e test, README
+   quickstart, fill `skills/kart-tasks.md` §0 worker-run section, honest
+   `pyproject`.
+4. **Liveness:** worker heartbeat via the `on_heartbeat` seam surfaced in
+   `fleet_health`/`diagnostic_summary` (review §1).
+5. **willow-2.0 migration (separate, later):** point willow-2.0 at the `kart`
+   package, delete its `core/kart_*`. Ends drift. Can trail well behind stage 3.
+6. **Optional:** `kart[llm]`, systemd templates, batch-lane polish.
+
+## 9. Decisions & remaining questions
+
+**Locked:**
+- Repo: **new standalone GitHub repo** (operator).
+- Name: **`kartikeya`** (operator — "bring back Kart's full name").
+- Shared package · product-neutral default · SQLite backend (top of doc).
+
+**Working assumptions (operator may override):**
+- **willow-2.0 migration is deferred to stage 5** — accepting a temporary
+  window where willow-2.0 keeps its `core/kart_*` copy while willow-mcp depends
+  on `kartikeya`. Rationale: ship willow-mcp value (close B-22) before touching
+  the live fleet.
+- **`kartikeya` publish stays under the operator gate**, same as willow-mcp
+  (release-state hold), until explicitly released — even though its surface is
+  lower-risk than willow-mcp's OAuth layer.
+
+**Still open:**
+- Confirm PyPI `kartikeya` is claimable (almost certainly; verify at extract
+  time) and that the `kart` alias console-script name doesn't collide.
+```

kartikeya-0.0.1/pyproject.toml

@@ -0,0 +1,47 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "kartikeya"
+version = "0.0.1"
+description = "Kartikeya — a standalone bubblewrap-sandboxed task queue and worker. Backend-agnostic (SQLite or Postgres); the execution engine formerly known as Kart."
+readme = "README.md"
+license = { text = "MIT" }
+authors = [{ name = "Sean Campbell" }]
+requires-python = ">=3.11"
+keywords = ["task-queue", "sandbox", "bubblewrap", "bwrap", "worker", "kart", "willow"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: MIT License",
+    "Operating System :: POSIX :: Linux",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: System :: Distributed Computing",
+    "Topic :: Software Development :: Libraries",
+]
+dependencies = []
+
+[project.optional-dependencies]
+# LLM-backed "workflow" task type. Base worker runs shell tasks with zero LLM deps.
+llm = []
+# Reference Postgres backend helpers (SQLite backend needs no extra).
+postgres = ["psycopg2-binary>=2.9,<3.0"]
+
+[project.scripts]
+kartikeya = "kartikeya.worker:main"
+kart = "kartikeya.worker:main"
+
+[project.urls]
+Homepage = "https://github.com/rudi193-cmd/kartikeya"
+Repository = "https://github.com/rudi193-cmd/kartikeya"
+Issues = "https://github.com/rudi193-cmd/kartikeya/issues"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/kartikeya"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

kartikeya-0.0.1/src/kartikeya/__init__.py

@@ -0,0 +1,32 @@
+"""Kartikeya — standalone sandboxed task queue + worker (a.k.a. Kart).
+
+Public surface:
+- Task-queue backend seam: `TaskQueue`, `TaskRow`, `QueueStats`, `SqliteTaskQueue`.
+- Execution lanes: `lanes` (fast/batch constants + worker-mode helpers).
+- Task security gate: `check_kart_task` (hybrid scan over task text).
+- Execution: `execute_task_row`, `drain_claimed_tasks`, `run_shell_task`.
+- Worker loop: `run_worker`.
+"""
+from __future__ import annotations
+
+from . import lanes
+from .execute import drain_claimed_tasks, execute_task_row, run_shell_task
+from .queue import QueueStats, SqliteTaskQueue, TaskQueue, TaskRow
+from .task_scan import check_kart_task
+from .worker import run_worker
+
+__version__ = "0.0.1"
+
+__all__ = [
+    "TaskQueue",
+    "TaskRow",
+    "QueueStats",
+    "SqliteTaskQueue",
+    "lanes",
+    "check_kart_task",
+    "run_shell_task",
+    "execute_task_row",
+    "drain_claimed_tasks",
+    "run_worker",
+    "__version__",
+]

kartikeya-0.0.1/src/kartikeya/data/kart-sandbox.json

@@ -0,0 +1,87 @@
+{
+  "version": 1,
+  "description": "Kartikeya bwrap mount policy (product-neutral default). Override via $KART_SANDBOX_CONFIG or $WILLOW_HOME/kart-sandbox.json to add host/fleet-specific paths without editing code.",
+  "env_prefixes": [
+    "WILLOW_",
+    "PG",
+    "POSTGRES",
+    "OLLAMA_",
+    "GIT_",
+    "TWINE_",
+    "PYPI_",
+    "ANTHROPIC_",
+    "OPENROUTER_",
+    "GROQ_",
+    "GITHUB_",
+    "NPM_",
+    "NODE_",
+    "SSH_AUTH",
+    "HUGGINGFACE_",
+    "HF_",
+    "OPENAI_",
+    "AWS_",
+    "DBUS_",
+    "XDG_"
+  ],
+  "credential_env_prefixes": [
+    "TWINE_",
+    "PYPI_",
+    "ANTHROPIC_",
+    "OPENROUTER_",
+    "GROQ_",
+    "GITHUB_",
+    "NPM_",
+    "HUGGINGFACE_",
+    "HF_",
+    "OPENAI_",
+    "AWS_"
+  ],
+  "bind_read_only": [
+    "/usr",
+    "/etc",
+    "/sys",
+    "{{HOME}}/github",
+    "{{HOME}}/.config/git",
+    "{{HOME}}/.config/systemd"
+  ],
+  "bind_read_write": [
+    "{{WILLOW_ROOT}}",
+    "{{HOME}}/.willow",
+    "{{HOME}}/.local",
+    "/var/run/postgresql"
+  ],
+  "bind_try": [
+    "{{WILLOW_ROOT}}/.venv-dev",
+    "{{HOME}}/.willow-venv",
+    "{{HOME}}/.gitconfig",
+    "{{HOME}}/.npmrc",
+    "{{HOME}}/.cargo",
+    "{{HOME}}/.npm",
+    "{{HOME}}/.cache/uv",
+    "{{HOME}}/.cache/pip",
+    "{{HOME}}/.cache/pre-commit",
+    "{{HOME}}/.config/pip",
+    "{{HOME}}/.config/pypoetry",
+    "{{HOME}}/.local/share/uv",
+    "/run/user",
+    "/run/media",
+    "{{XDG_RUNTIME_DIR}}",
+    "/run/systemd/resolve"
+  ],
+  "bind_try_read_only": [
+    "/lib32"
+  ],
+  "worktree_scan_roots": [
+    "{{WILLOW_ROOT}}/worktrees"
+  ],
+  "rtk_compress": {
+    "enabled": false
+  },
+  "_security_notes": {
+    "github_ro": "~/github is read-only by default; WILLOW_ROOT + its worktrees nest read-write on top. Hosts promote additional repos to RW via an override config.",
+    "ssh_dropped": "~/.ssh is not bound. SSH git uses SSH_AUTH_SOCK (via /run/user) + known_hosts (ro), both only on allow_net. Private keys never enter the sandbox.",
+    "creds_gated": "credential_env_prefixes (and ~/.config/gh, ~/.netrc) are present only on allow_net. A no-network task gets zero credentials.",
+    "localhost_tier": "# allow_localhost shares the host network namespace (loopback works) but still strips credentials. Weaker than --unshare-net; prefer over allow_net for local-only work.",
+    "tmp_tmpfs": "/tmp + /dev/shm are private tmpfs, not host binds."
+  }
+}