The system is an authority layer for project knowledge and agent workflow. It must not pretend that prompts are security boundaries.

Initial daemon should:

• bind only to loopback;
• optionally require a local token;
• avoid exposing source/project APIs to the LAN by default.

Agents are untrusted with respect to:

• truth claims;
• project-plan correctness;
• declared file scope;
• verification assertions.

They are trusted only to the extent that the execution environment gives them access.

Do not accept:

• “tests passed” without executable evidence where tests are required;
• “human verified” from an agent;
• “no regressions” based only on an LLM assertion.

Path scope is an advisory coordination mechanism unless the execution environment enforces it.

For stronger isolation, use:

• worktrees;
• containers;
• OS-level sandboxing;
• restricted credentials.

The graph should avoid ingesting secrets.

Store references/metadata rather than secret values.

Environment captures should have secret-redaction policies.

Capability records should identify:

• tool origin;
• permissions;
• credential scope;
• destructive operations;
• network access.

High-risk capabilities should be visible in task context.

Project text, source code, comments, tests, issue text, and external tool output may contain hostile instructions.

The planner must distinguish:

• project policy;
• task instruction;
• source content;
• retrieved evidence.

Retrieved source text must not automatically become system-level authority.