Kosa8

Every agent runs in a genuine VM with its own kernel and disk on Apple's Virtualization framework or KVM, not in a container that shares the host kernel.

The sandbox sees one mounted folder and holds placeholder values instead of real API keys, which stay on your host and are brokered only to approved hosts.

The network is closed by default; traffic flows only to allow-listed hosts through a broker whose rules live on the host, out of reach of anything inside the sandbox.

Checkpoint before risky work and restore a running machine, processes included, in about a second rather than rebuilding it from scratch.

Clone a running sandbox into multiple live copies, keep the run that passes, and give each trainee or task its own reset-on-demand machine.

Every action is hash-chained and marked human or agent, risky steps can require two named approvers, and exports are signed so a third party can verify them offline.