AI-OS is a developer preview built around enforcement in ordinary code rather than safety prompts.

• Sender identity is allowlisted at the adapter edge before content is routed or persisted.
• Every simulated tool use passes through one enforcement hook and produces a tamper-evident audit entry containing metadata, never rejected message content.
• Paths are normalized before comparison. Traversal, ambiguous Windows paths on POSIX, symlinks, home aliases, and case differences are handled conservatively; normalization failure denies.
• Operational state and the fence file are crown jewels. Model sessions cannot read or write them.
• Adopted repositories are read-only unless an operator creates a separate writable sandbox.
• Untrusted documents are byte-copied to staging and cannot become canonical knowledge without an explicit promotion action.
• SQLite has one writable owner in the kernel. Status and worker-facing connections are read-only.
• Unknown actions, capabilities, tiers, engine states, and malformed configuration fail closed.

• These controls do not isolate hostile native code running as the same macOS user.
• No service is installed, no account is connected, and no external data transfer is enabled by default.
• Reboot recovery, off-box restoration, provider auth expiry, and real account-cap exhaustion require host-specific drills before being claimed.
• A future foreign coding CLI has weaker enforcement than an in-process harness hook and must stay limited to an OS sandbox and low-sensitivity work.

Report a suspected bypass by stopping dispatch (ragos halt) and preserving .ragos/log and the read-only audit export for investigation.