Safety model

Coven is a local authority boundary, not a prompt wrapper. It validates sensitive requests at the daemon even when a CLI or local client already performed a friendlier check.

What the daemon enforces

• A launch has a canonical project root.
• A working directory must remain inside that root.
• A harness id must be supported or explicitly registered.
• Input and kill requests apply only to a verified live session.
• Archive is reversible; sacrifice is explicit and refuses live sessions.

What stays outside Coven

• Provider credentials and provider policy remain with the harness.
• A local client cannot grant itself wider project or session authority.
• The local socket is not a public network service.

Use Daemon security for operational controls and the API error envelope to handle rejections correctly.