The public v0.1.3 release is storage hygiene only and is not an Agent-isolation boundary. The public v0.2.0-rc.1 release candidate uses a provisioned, Developer ID-signed, notarized Broker app and a private Data Protection Keychain access group. The 3-machine/24-hour external acceptance round is deferred; this release does not claim independent security review or independent-user adoption.

The security objective is narrow: a same-user model-launched process must not retrieve a managed credential without a contemporaneous explicit user authorization. The trusted Harness host and in-process plugins are intentionally allowed to receive a credential through ctx.credentials.resolve().

The boundary fails closed on missing entitlements, invalid signatures, denied or canceled authentication, locked Keychain, malformed responses, timeouts, and Broker crashes. It never falls back to the old helper, file-based storage, plaintext, or an environment value for a managed operation.

The following local evidence passed with disposable items and no recorded secret material:

• signed provisioned Broker: exact App ID/profile/group, Developer ID, Hardened Runtime, secure timestamp, universal slices;
• authenticated provider lifecycle: set, get, exact round trip, unset, post-delete absence, and clean Broker disposal;
• independent same-UID Security.framework reader, /usr/bin/security, copied Broker, direct invocation cancellation, and quarantined native/Intel launch checks;
• isolated DSH 0.1.0-rc.6 plugin installation, composed profile replacement, Web HTTP 200 boot, and a DSH bash-tool attempt that failed closed without returning a value;
• Apple notarization accepted and stapled: 8941cae5-75a5-4f1c-bdfb-998d1ce578c3.

This is not an independent security audit. It does not cover a compromised macOS kernel, administrator access, debugger access to the trusted Harness host, a user approving an unexpected prompt, or independent-user adoption. Do not disclose real credentials, Keychain dumps, account identifiers, or private model configuration in issues or reports.