icebox-gov 0.1.1

Runtime governance for autonomous offensive security — the single seam every human operator, REST client, and LLM agent must pass through before anything touches a target.
Documentation
# Account-free usage

ICEBOX is designed to be useful **without creating an account or logging
in**. There is no phone-home, no telemetry, and no hosted dependency
in the default path.

## What runs locally

- The CLI and REST API bind to `127.0.0.1:8443` by default.
- The charter, scope, policy, approval queue, and audit trail all live
  in your local workspace (`workspace.json`), which you can `save` and
  `load`.
- The policy engine, approval gates, and audit engine are in-process.
  Nothing leaves your machine unless a module you run explicitly talks to
  a target you authorized.

## Optional, opt-in surfaces

These are conveniences, not requirements:

- **GitHub Releases / Homebrew / crates.io / PyPI** — channels to fetch
  the binary or SDK. You can also just `cargo install` or build from
  source.
- **GHCR** — a prebuilt Docker image for self-hosted deployments.
- **Documentation site** — copy-paste examples; no login needed to read.

## Bringing your own modules

The `#[module(...)]` macro and `MODULE_REGISTRY` mean contributor
modules are appended at runtime — you extend the seam without asking
anyone for permission.

## Enterprise (later)

Account-free stays the default. Hosted, multi-tenant, and managed
offerings are a later layer on top of the open-source kernel, not a
prerequisite for using it.