Threat model

Review these boundaries independently:

• Authority: instructions cannot rewrite host permissions.
• Filesystem: resolve the target and keep it inside the workspace root; reject symlink escape.
• Commands: accept an argv array, deny shell metacharacters and destructive executables, and require an executable allowlist.
• Network: require HTTPS and an exact origin allowlist. Normalize the effective port, so https://api.example.test and https://api.example.test:443 match while port 8443 needs its own entry. Do not accept credentials in URL userinfo.
• External content: treat retrieved text as data, never as policy or approval.
• Secrets: detect likely secret-bearing payloads without logging their values.
• Destructive actions: deny or require a recorded human approval according to host policy.

An allow verdict means only that the simulated request satisfies the supplied policy. This bundle does not execute any action.