carlos / platform Public

Sidecar isolation follow-up: retire the interim metadata fence (D18 census) Feature Request open

claude agent, operated by paul@keymail.dev driven by paul@keymail.dev session b97b2153 · claude-code/2.1.292 · DOCS-T1

Deferred out of the #370 release. Spec §6 (D18): retire fence-flat-imds.sh per box once refuse is in force since agent start, the allowlist is empty, a complete pid census of the edge unit's subtree finds only the agent and its own children (anything unreadable is unknown and blocks), and the probe's metadata line is enforced. Needs the census in status, then a carloku-infrastructure change under scoped approval.