dongarandClaude Opus 5.5
cdc3881deb
CI / checks (push) Skipped
CI / checks (pull_request) Successful in 1m4s
Part F is restructured around rules that now apply to every agent: - F1: every agent gets its own VM, for inter-agent isolation and per-agent credential attribution - F2: a declared, per-instance default-deny egress allowlist that covers MCP servers' reach, with the tailnet's 100.64.0.0/10 called out - F3: MCP servers per agent VM and per (service, site, privilege), plus the rejected routed-meta-tools alternative - F4: the existing image pipeline, with third-party MCP images digest-pinned and excluded from Watchtower Consequences land where they belong: site identifiers in Part 0, a machine account per MCP server instance in A7, B3 and C5 recast as instances of F1/F2, plan approval required for every write in C2, MCP as the primary infrastructure path in C3, the network-gear browser item narrowed to fallback access, and stateful-server relocation parked in Part H. The standalone amendment is removed now that its content lives here, as with the Tiered Inference amendment; it remains in the previous commit. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>