The architecture, in the order it was built.
Each page describes one authority domain: what it identifies, what it decides, what it refuses to infer, and what it does not claim. They build on each other, so reading them in order is worth more than dipping in — but every page states its own dependencies.
Process identity & sessions
Who exactly is asking — signing identity, lineage, and containment sessions.
Read →Phase 02Filesystem containment
Canonical resource identity, symlink resistance, and deny-by-default paths.
Read →Phase 03Network containment
Endpoint identity, byte-level address classification, and flow verdicts.
Read →Phase 04Authorization & grants
How a human decision becomes a narrow, revalidated, expiring grant.
Read →Phase 05Process tree & execution
Containment that follows descendants through shells and interpreters.
Read →Phase 06Capability broker & MCP
Give the agent the capability, not the credential.
Read →Phase 07Fail-lock & tamper resistance
Enforcement failure must never silently become permission.
Read →Phase 08Audit & security evidence
A tamper-evident local record that says exactly what happened.
Read →Phase 09Vault isolation
A real Linux VM under Virtualization.framework, and what was proven in it.
Read →Phase 10Production hardening
Signing, entitlements, installation, recovery, and the release gate.
Read →These pages describe the permanent architecture. Where a boundary is implemented but not yet proven at runtime — because it depends on an Apple restricted entitlement — the page says so in the same paragraph as the capability, not in a disclaimer at the bottom. See Trust.