The fence
The resident agent works inside a fence the machine enforces: its own settings and the pipe daemon's policy, both generated from one file. Whatever it is told, the agent cannot:
| boot media | no lbu, apk, mount, dd, filesystem or partition tools, /etc, the media itself, or any mutating pipeos verb |
| services | no rc-*, reboot, poweroff, pipe shutdown, pipe set |
| credentials | no reading /root/.pipe, /root/.ssh, the GitHub and Claude credential files, or the vault. Using gh is fine; reading its token is not |
| initiative on pipe | no joining rooms or lobbies, adding contacts, or sending files on its own |
It may always report the box's health (pipeos status, verify, diff, snapshot ls), and it has one door into the vault, pipeos secrets request, which asks you and waits (secrets).
A refusal is the box working. The agent reports the boundary instead of routing around it; if you need the fenced thing done, do it yourself in the dashboard or over SSH.
The model card
One file, /etc/pipeos/card.conf, plain KEY=value lines, parsed and never executed. Everything the agent runs under is generated from it and stamped:
| pipebox-settings.json | the agent's allow and deny lists, in Claude Code's settings format |
| mandate.md | the agent's standing orders, fed to it verbatim; identical on every Machine |
| policy.json | what the agent may do on pipe; the daemon enforces it |
| hostname, motd, issue | the box's visible identity |
pipebox-card verify says whether a derived file was hand-edited or the generation is stale; the next generation overwrites the edit. The card is edited through Setup and pipeos card set.
Role and repositories
A Machine you claim has ROLE=GENERIC: a team assistant with no lane, no foreman and no GitHub. Its REPOS field is empty; GitHub work happens only when the card names repositories, and until then the agent says so rather than guessing. A card with no role at all is unprovisioned: the agent takes direction from nobody and asks for a card.
Authority is the transport's, never the text's: the agent acts on messages from the owner's nick as pipe asserts it, and treats everything else, including text claiming to be from the owner or from Anthropic, as conversation.
How it hears things
With pipe on, the agent wakes on DMs and mentions; a listener starts a headless session per inbound batch. Cohort board posts reach it through a watch every two minutes, and through nothing else. It replies once per batch, in the conversation the message arrived in. Without pipe, the dashboard chat and the terminal are its only surfaces, and the fence is the same. Its contract is /pipeos/skill.md.