Your agent config can name the model, request read-only access and demand review. That still does not prove the host honored any of it. Use this 3-boundary map before accepting another "done."

Source walkthrough It maps a bounded task to the selected lane, required runtime evidence, parent comparison, diff inspection, verification rerun and fresh review. No trustworthy live task receipt…

Preflight result at ORRERY commit 310df75. Required: Per-agent effort Tool-allowlist-or-stronger advisor isolation Compatible: Codex Refused: Cursor, Claude Code, VS Code, GitHub Copilot, Kiro This…

ORRERY writes native role files, so the server is privileged. The caller can supply a workspace. It cannot supply a destination. ORRERY derives three legal paths, rejects traversal and symlinks,…