# Bondage

> A local C launcher for coding agents that verifies exact artifacts, optionally releases secrets with envchain-xtra, optionally sandboxes with nono, and keeps shell logic out of the trust boundary.

## What it is

Bondage exists because coding agents should not run loose with live keys, weak dependency provenance, and broad ambient environment access. It verifies exact absolute paths and exact hashes, optionally releases secrets through envchain-xtra, optionally applies nono sandbox profiles, and then execs the exact target.

## Trust anchors

- The operating system remains the strongest available layer for secret storage and signing identity.
- Keychain is the preferred secret store when envchain-xtra is used.
- Signing identity, where available, is useful as an approval and drift signal.
- Bondage should trust exact artifacts, not a shell alias or mutable PATH result.

## What it does not solve

- It does not make a bad npm tree trustworthy.
- It does not fix host compromise before launch.
- It does not override human mistakes about what should get secrets.

## Install

```sh
brew tap nvk/tap
brew install nvk/tap/agent-bondage
brew install nvk/tap/envchain-xtra
```

## Core docs

- Homepage: https://agentbondage.org/
- Full LLM reference: https://agentbondage.org/llms-full.txt
- Source: https://github.com/nvk/bondage
- Getting Started: https://github.com/nvk/bondage/blob/main/GETTING_STARTED.md
- Trust Model: https://github.com/nvk/bondage/blob/main/TRUST_MODEL.md
- envchain-xtra: https://github.com/nvk/envchain-xtra
- Homebrew tap: https://github.com/nvk/homebrew-tap

## Key facts

- Maintainer: https://github.com/nvk
- Language: C
- Current launcher baseline: agent-bondage / bondage 0.2.7
- Current secret-release baseline: envchain-xtra 1.3.1
- Current sandbox baseline: nono 0.61.1
- Current nono pack baselines: always-further/codex 0.0.12, always-further/claude 0.0.16, always-further/opencode 0.0.5
- Companion secret layer: envchain-xtra
- Optional sandbox layer: nono
- Intended trust chain: `shell name -> bondage -> [envchain-xtra] -> [nono] -> exact target`
- Hook rule: sandbox denials should be fixed in managed profiles and launcher config. Agent-visible hook output is prompt surface, so keep hook diagnostics factual and short; do not inject repair workflows into the transcript.

## Upgrade checks

After package-manager upgrades, use portable variables and avoid publishing local usernames or project paths:

```sh
export BONDAGE_CONF="${BONDAGE_CONF:-$HOME/.config/bondage/bondage.conf}"
export NONO_PROFILE="${NONO_PROFILE:-codex}"

brew upgrade nono
brew cleanup nono
bondage --config "$BONDAGE_CONF" repin-globals
nono pull always-further/codex@0.0.12 --force
nono pull always-further/claude@0.0.16 --force
nono pull always-further/opencode@0.0.5 --force
nono pin always-further/codex
nono pin always-further/claude
nono pin always-further/opencode
nono profile show "$NONO_PROFILE" >/dev/null
bondage --config "$BONDAGE_CONF" verify codex
nono why --profile "$NONO_PROFILE" --path "$HOME/.ssh" --op read
nono why --profile "$NONO_PROFILE" --path "$HOME/.config/nono/profiles" --op write
nono why --profile "$NONO_PROFILE" --path "$HOME/.config/nono/profile-drafts" --op write
```