Trust

The boundary is the operating system, not a prompt.

Every run is inside the sandbox the operating system enforces, from a settings file the agent can read but not edit. Every inbound door is shut until you open it. Prompt injection is contained, not prevented. Nothing phones home: the outbound checks are a daily look for a new release, which can be switched off, and, only with a SoloINC Pro key, a check of that key with Lemon Squeezy at most once a day.

The boundary is the operating system.Seatbelt on macOS; on Windows, a later release, a low integrity level and a job object, or a container when Docker Desktop or Podman Desktop is installed. A machine that can do neither is refused workloads.

Every inbound door shut until opened.The A2A agent card and inbound door return 404 until switched on. MCP write tools need an app key. Metered model keys are never in a run until the API switch is on.

Contained, not prevented.A hostile document can still steer what a run writes. It cannot make the run spend, sign, publish, contact a person or reach a host you did not name, and the trace shows what it did, call by call.

Nothing phones home.Telemetry is local. The update check is one request for public release metadata a day, and it can be switched off. A SoloINC Pro key is checked with Lemon Squeezy when you activate it and at most once a day after, sending the key and this Mac's name; the free tier makes no such call.

The concerns, and what the product does about each

Designed against the list buyers actually keep.

The OWASP Top 10 for Agentic Applications 2026 and the questions a platform team asks. Each row names a mechanism in the repository and the test file that holds it to its word. The framework codes are our own mapping.

Concern	Plain claim	Mechanism	How you verify it
Goal hijack and prompt injection ASI01	Contained, not prevented. The run is inside the sandbox with the reserved acts out of reach, and the trace shows what it did, call by call.	The OS sandbox, `scripts/kernel/sandbox.py`, with `failIfUnavailable` set; the reserved acts, `PERSON_ONLY` in `scripts/kernel/flow/card_forms.py`	`scripts/test_kernel.py`
Tool misuse and unexpected code execution ASI02, ASI05	Every agent runs from a settings file it can read but not edit. A machine that cannot hold a workload in a sandbox is refused workloads rather than given unsandboxed ones.	`scripts/kernel/sandbox.py`; the macOS and Windows boxes in `scripts/kernel/containment/`	`scripts/test_kernel.py`, `scripts/test_containment.py`, `scripts/test_containment_windows.py`
Identity and privilege abuse ASI03	A run proves where it bills before it starts: the loopback shim it is pointed at answers, or a provider address and its filed key are both there. A provider key stays with the local shim and is never in a run's environment.	The billing preflight, `verify_billing` in `scripts/kernel/preflight.py`; the shim holding the key in `scripts/kernel/accounts.py`	`scripts/test_kernel.py`, `scripts/test_accounts.py`
Supply chain ASI04	An imported agent starts untrusted: read-only tools, no MCP servers, no schedule, no memory store. Each capability opens only as a person promotes it, one level at a time.	`scripts/kernel/importers/quarantine.py`	`scripts/test_imports.py`, `scripts/test_console_imports.py`
Memory and context poisoning ASI06	Every layer of instruction a run receives is a versioned file, shown in order in one sheet, with the history of every commit that changed it.	Instruction layers, `scripts/console/instructions.py`; rules, `scripts/console/rulesets.py`	`scripts/test_instructions.py`, `scripts/test_rules.py`
Insecure inter-agent communication ASI07	The A2A agent card and the A2A inbound door answer 404 until switched on from the Security screen. MCP write tools need a write app key. App keys are scoped and hashed at rest.	Signed cards, `scripts/kernel/agentcard.py`; app keys, `scripts/console/appkeys.py`; MCP, `scripts/console/mcp.py`	`scripts/test_security_posture.py`, `scripts/test_appkeys.py`, `scripts/test_cardsign.py`
Cascading failures ASI08	Kill switches at five scopes, written to the one halt file every run reads before it starts. A guardian reads every run as it happens and stops it on hard signals: a burst of denials, the same tool call repeated, a run near its turn cap with nothing delivered.	`HALT_PATH` in `scripts/guards.py`; `KILL_SCOPES` in `scripts/kernel/halts.py`; the guardian, `scripts/kernel/guardian.py`	`scripts/test_guards.py`, `scripts/test_console_killswitch.py`, `scripts/test_kernel.py`
Human-agent trust exploitation ASI09	The Desk shows each decision as a memo in the professional form of its domain, with the documents the steps wrote beside it. You decide on evidence, not on prose.	`scripts/console/desk.py`	`scripts/test_console_desk.py`, `scripts/test_desk_memo.py`
Rogue agents and sprawl ASI10	The registry is derived from the manifests, the signed cards, the workloads, the run ledger, the vault grants, the egress allowlist and the halt file; nothing on it is typed in twice. Anything that ran without a manifest is a shadow agent, and the board names it. Every quarter a person re-attests each agent.	`scripts/console/governance.py`; the tiers and attestation rules in `rules/governance.yaml`	`scripts/test_console_governance.py`
Data leakage	Default-deny egress with the sources named, and host groups no agent may add for itself. The console redacts anything credential-shaped from every document it publishes. Telemetry stays on the machine.	`scripts/kernel/sandbox.py`, policed by `scripts/kernel/egress_policy.py`; the publishing scrub in `scripts/console/standby.py`; local telemetry, `scripts/console/telemetry.py`	`scripts/test_security_posture.py`, `scripts/test_console_standby.py`, `scripts/test_console_telemetry.py`
Cost runaway	A scheduled workload without a budget fails validation, every run carries a turn cap, and a run that reaches the model's usage limit stops rather than waiting for it to reset.	`scripts/validate_manifests.py`; `max_turns` in `scripts/kernel/manifests.py`; `autoContinueAtUsageLimit` false in `scripts/kernel/sandbox.py`	`scripts/validate_manifests.py`, `scripts/test_kernel.py`
Auditability	Every console action is on the audit log with who did it, what it changed and what it was before; revert where reversing is possible. Every run leaves a record.	The audit log, `scripts/kernel/audit.py`; run records, `scripts/kernel/records.py`	`scripts/test_console.py`
Agents changing the rules they are judged by	The contract and the guard machinery are protected paths a workload cannot write. The two lists that name those paths are tested to agree, so a path cannot slip out of one and stay in the other.	`CONTRACT_PATHS` in `scripts/kernel/sandbox.py`	`test_the_two_protected_lists_agree` in `scripts/test_kernel.py`
Human acts	Fund, sign, submit, verify identity: a standing checklist an agent never attempts. What needs a person reaches the Desk as a memo and waits there.	`PERSON_ONLY` in `scripts/kernel/flow/card_forms.py`	`scripts/test_business_layer.py`

macOS today, Windows later

What the OS holds is not identical on both.

SoloINC for Mac is the release today. Windows is a later release; this is how its box is built, so you can judge it before it ships.

On native Windows, reads and outbound connections are enforced by SoloINC's own file tools and egress gate rather than by Windows, because Windows offers no filesystem or socket boundary a program can put around itself without an administrator, and SoloINC never asks for an administrator password. A program the agent starts could read a file SoloINC would have refused it, or open a socket that goes around the gate.

Install Docker Desktop or Podman Desktop and SoloINC uses a container for scheduled agents automatically, a kernel boundary in all three directions. The security docs.

	macOS	Windows, native	Windows, with a container
Writes	kernel	kernel	kernel
Reads	kernel	SoloINC	kernel
Network	kernel	SoloINC	kernel
Process tree	kernel	kernel	kernel

EU AI Act Article 14, mapped

Human oversight, measure by measure.

Article 14 asks that a person be able to understand the system, interpret its output, override it and halt it, and that its logs are kept. Each of those words has a place in the product. This is our own mapping of the product onto those words, not an assessment, and nobody outside 8086 LLC has assessed it.

The risk tiers in rules/governance.yaml (minimal, limited, high, unacceptable) are each mapped to the EU AI Act's tier and to the NIST AI RMF functions the controls have to satisfy. The same file drives the Governance board and the evidence pack.

Article 14 measure	Where it lives
Understand	The instruction layers: every layer a run is told, in the order the model receives them, each with its history.
Interpret	The memo: every Desk item in the form its domain uses, with the documents the steps wrote and the trace.
Override	The Desk: approve, continue, send back with a question, reject, release a parked item with a direction.
Halt	The kill switches: agent, step, pipeline, cell, everything, all written to the one halt file every run reads before it starts.
Logs	Per-call traces for thirty days; the audit log with before-values; run records.

What we do not claim

Said plainly, so nobody has to ask.

A platform team's checklist has boxes we cannot tick. These are the ones, and why.

No SOC 2, no ISO 42001, no third-party audit. 8086 LLC holds none and does not say otherwise. The tests in the repository are what stand behind this page.
No claim about encryption of data at rest. The state root is on your disk. Full-disk encryption is the buyer's choice and the buyer's act.
Prompt injection is contained, not prevented. A hostile document can still steer what a run writes. The sandbox, the reserved acts and the trace bound what that can cost.
Native Windows will be the weaker box. When the Windows release ships, reads and network are held by SoloINC, not by Windows, until a container engine is installed. The table above says exactly where.
Only the Mac app is released. It is signed with a Developer ID and notarised by Apple. Windows, iPhone, iPad and Android are later releases.

Verify it yourself

The tests exist in the repository.

Every mechanism on this page is held by a test file under scripts/ in SoloINC's own repository, and they run on every change before it ships. These are the files.

The threat model, with the residual risks stated, is docs/THREAT-MODEL.md in the same repository.

scripts/test_accounts.py
scripts/test_appkeys.py
scripts/test_business_layer.py
scripts/test_cardsign.py
scripts/test_console.py
scripts/test_console_desk.py
scripts/test_console_governance.py
scripts/test_console_imports.py
scripts/test_console_killswitch.py
scripts/test_console_standby.py
scripts/test_console_telemetry.py
scripts/test_containment.py
scripts/test_containment_windows.py
scripts/test_desk_memo.py
scripts/test_guards.py
scripts/test_imports.py
scripts/test_instructions.py
scripts/test_kernel.py
scripts/test_rules.py
scripts/test_security_posture.py
scripts/validate_manifests.py

Disclosure

Found something? Tell us.

Email support@soloinc.ai. Say what you found, how to reproduce it and what it exposes. A PGP key will be published with the first tagged release.

3Acknowledged within 3 business days.

10Assessed within 10 business days, with a severity and a plan.

→Fixed in the next release when confirmed. A critical issue ships as a patch release as soon as it is fixed, and the release notes say so.

0No bounty. We acknowledge reporters in the release notes if they want it. The full policy is in SECURITY.md in the repository.