Skip to content

Governance: macOS Seatbelt process wrapper #803

New issue
New issue
Closed
Closed
Governance: macOS Seatbelt process wrapper#803
Labels
enhancementNew feature or requestplan:donePlanboard status

Description

@currentbits
currentbits
opened on Sep 2, 2026

Follow-up to #262. The v1 slice (policy matrix, harness evaluator, HMAC audit, profile UI) does not confine unprompted CLIs.

Compile the declared matrix (write scopes, network) into a Seatbelt profile and wrap the local CLI child. Fail closed on path canonicalization. Audit every Seatbelt decision with decidingLayer=seatbelt, including matrix-allow / Seatbelt-deny disagreements. Keep electron/sandbox.js honest.

Linux seccomp is out of scope unless cheap. ssh remotes and WSL are not Seatbelt-wrapped.

Blocked on: #262 v1 landing a compile-able matrix schema.

Activity

  1. currentbits
    added
    enhancementNew feature or request
    plan:todoPlanboard status
    on Sep 2, 2026
  2. currentbits
    added
    plan:doingPlanboard status
    and removed
    plan:todoPlanboard status
    on Oct 16, 2026

  3. currentbits commented on Oct 16, 2026

    @currentbits
    currentbits
    on Oct 16, 2026
    OwnerAuthor

    PR #1656 is up, stacked on #1655 (#262 v1). On macOS, a local thread whose profile has write or network rules runs its CLI under sandbox-exec, for every provider:

    • Writes are confined to the worktree plus allow/ask paths, with deny/block paths carved out.
    • Network rules route egress through a loopback host-filtering proxy; outbound IP is denied otherwise.
    • Kernel and proxy denials are audited as layer: seatbelt, and matrix-allow / Seatbelt-deny disagreements are flagged.
    • Anything that can't be canonicalized refuses the run.

    Verified live with the real Claude CLI. The other CLIs haven't been run live under a profile yet.

  4. currentbits
    added a commit that references this issue on Oct 16, 2026

    Seatbelt wrap for governed local CLIs: compiled write scopes, proxied…

    f062740
  5. currentbits
    added
    plan:donePlanboard status
    on Oct 16, 2026

  6. currentbits commented on Oct 16, 2026

    @currentbits
    currentbits
    on Oct 16, 2026
    OwnerAuthor

    Landed from Solenta thread "Governance: macOS Seatbelt process wrapper" (PR #1656). Closed on merge.

  7. currentbits
    removed
    plan:doingPlanboard status
    on Oct 16, 2026
  8. currentbits
    closed this as completedon Oct 16, 2026
  9. currentbits
    added 3 commits that reference this issue on Oct 16, 2026

    Governance layer v1: per-profile permission matrix, HMAC audit, Claud…

    4b88bf6

    Seatbelt wrap for governed local CLIs: compiled writes, proxied egress (

    5d456a6

    Seatbelt tests: keep Stores in tmp so exit flushes cannot litter $HOME (

    3f39a14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or requestplan:donePlanboard status

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions