Apply P13: tool containers run from one Nix-built image named by digest

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-22 22:30:04 -07:00
parent b426ca1958
commit 655683c9e0
2 changed files with 4 additions and 4 deletions
@@ -145,7 +145,8 @@ a multi-turn tool conversation and tool parsing had no failures in 20 trials.
 3. No matching grant means deny. `ask` routes an approval request to the owner through `gatewayd`
   and the turn suspends until answered or expired.
 4. Each approved call runs in a fresh rootless container: no network unless granted, only granted
-   paths mounted, only the granted secret injected.
+   paths mounted, only the granted secret injected. Tool containers run from one image built from
+   source by Nix and named by digest; nothing is pulled at call time.
 5. **Audit log**: append-only JSONL, hash-chained, one record per decision including denials.
 6. **Data classes**: every tool result is labelled `public`, `private`, or `secret`. A session's
   taint is the union of labels it has seen. The cloud-consult tool is refused for tainted sessions