[kinqsradio]

Summary

• On macOS a crew worker's engine process starts under a sandbox-exec profile that denies the data folder (store, service handle, other runs' files) except its own run folder, checkout and library, and denies inspecting other processes.
• Where that cannot be applied (Windows/Linux, missing tool, Orbyn itself restricted, Codex, terminal engines) the worker is refused before it starts, via the existing "refused by the app" item.
• Docs: SPEC section 11, architecture, crew, setup ("Crew runs on macOS in the beta; Windows later").
• Not covered: network, loopback service, keychain, engine login/session folders. Closing the lead's transcript files is the next change.

Refs #441

Closes #

Parity rows

none

Frames built

Frames built: none

Testing

• CI covers the rest.
• macOS, real sandbox-exec: new host::confine tests and crew::tests::confined pass; orbynd confined_cli passes; full orbyn-core crew and driver filter passes (398 passed); clippy -D warnings clean.
• Not tested: orbynd route tests (config line only; compiled by clippy), Windows run, real engines under the profile.

Co-authors

none

AI usage

• Written by hand, with no AI
• Harness and version: Claude Code 2.1.321
• Models: claude-sonnet-5-5 (implementation), claude-opus-5-5 (design review)
• Effort: medium
• Human role: assigned the task and its boundaries; review pending
• Sources: none

Checklist

• Works on Windows and macOS
• web/src/generated with any contract change; docs/architecture.md with any rule change
• No copied source, secrets, credentials or personal data; no AI attribution in commits, title or branch