Module protected_store 

Kernel store boundary of protected sessions: the pinned child rules, the in-process store-path check and the launcher’s control-file profiles. Kernel-enforced control-file immutability for the managed macOS MCP child. Named Unix sockets are restricted too; TCP and Mach are not contained here.

Constants

CHILD_PROFILE_ENV

Compiled kernel rules for every model-directed subprocess of the protected MCP server, pinned by the launcher into the server’s environment. Read from the process environment only — a tool call must never be able to select, weaken or drop them.

Functions

bind_authority

Resolve through the existing taxonomy before pinning it in the child env. Do not create directories, migrate providers or read credential contents.

child_profile

Kernel rules for a model-directed subprocess of the protected MCP server. Additive on top of the whole-MCP profile such a subprocess already inherits: a nested Seatbelt profile can only remove rights, so (allow default) here restores nothing the launcher denied. The Engine’s own persistence is untouched — it never runs inside this profile.

control_profile

Compile the whole-MCP control-file profile from (path, deny_read) entries, protected in the given order. Every entry denies writes; deny_read also denies reads (credentials and session homes).

credential_read_paths

enforce_protected_store_path

The same boundary for model-directed in-process file tools. Reject ancestor directories too: a recursive search must not enumerate a store through an otherwise allowed parent. Internal persistence does not use this interface.

operator_credentials

Dashboard credentials are operator authority, not provider credentials. Include dormant layouts so switching or migrating a layout cannot expose an old token. Resolve paths only; never read, rotate or migrate the credential.

protected_child_prefix

Program and leading arguments that run a model-directed command under the pinned child rules, or None outside a protected session.

validate

Compile the actual profile before launching Codex. No unsandboxed fallback.