assets: update architecture diagram for v0.2 sandbox layer\n\nAdded Container Sandbox box (peach/dashed border) to the pipeline:\nConfig → Validate → Enforce → Isolate → Serve → Execute\n\nNew box shows: Docker isolation, --cap-drop=ALL, read-only root,\nimage digest pinning, watchdog timeout, lazy spawn/reap. Marked\nas 'v0.2 · opt-in per agent' to indicate it's not default.\n\nAlso updated existing boxes: YAML Config gains 'Sandbox: docker',\nValidation gains 'T4 sandbox enforced', Security gains 'Anomaly\ndetection', MCP Server gains 'Registry HMAC'.\n\nSame Catppuccin Mocha palette as the original. · goweft/heddle@aae3cc2

4s

40s

42s

1m 26s

Navigation Menu