0.5.0-rc1 · Security Model 1.2.0 · 82 tests

Agents can already act. Company OS decides whether they are allowed to.

Docker plus a second .env jails the process. It does not decide who may act, which tools a worker is granted, or what evidence remains. Company OS is the authority layer around that — on one Linux host, for more than one company.

Public GitHub repository Try it in Docker

Apache-2.0. Evaluation / discovery, not production 1.0. No product-market-fit claim.

ALLOW / HOLD / DENY

A grant is not a key. ALLOW runs. HOLD waits for an owner. DENY refuses.

Sanitized grants view: public intake ALLOW, publish and spend HOLD, marketplace and transfer DENY, one publish approval pending — Sanitized example tenant. Tokens and live lab state omitted. Approving a queue row is evidence an owner clicked — it does not by itself publish or spend.

One engine, several tenants

Company OS engine over three isolated tenants, each with directory, sqlite, token, and grants — Tenants do not share work, receipts, or sqlite. Money Hunter is a different company and is not a tenant of this tree.

Tenant isolation

Own directory, sqlite, port, and token. Opening the wrong database as the wrong tenant fails closed.

Scoped credentials

Secrets stay in a 0600 file. Process environment is not an implicit source. Blocked prefixes never resolve from a shared overlay.

Approvals

HOLD queues. DENY refuses. spend.request(..., approved=True) cannot self-approve.

Receipts

A trail of what ran, what was held, and what was denied. Completing already-done work is refused.

Public proof tenant

Packet Press is a different company on the same platform — civic briefs, not a renamed storefront.

packetpress.thecriners.com · sanitized grants