[{"data":1,"prerenderedAt":1137},["ShallowReactive",2],{"navigation_docs":3,"-prds-tart-cleanroom-vms":234,"-prds-tart-cleanroom-vms-surround":1132},[4,26,47,68,89,114,135,164,181,210],{"title":5,"path":6,"stem":7,"children":8,"page":25},"1. Getting Started & Pricing","\u002Fgetting-started","01.getting-started",[9,13,17,21],{"title":10,"path":11,"stem":12},"1.1 5-Minute Quickstart","\u002Fgetting-started\u002Fquickstart","01.getting-started\u002F1.quickstart",{"title":14,"path":15,"stem":16},"1.2 Project Boards Setup","\u002Fgetting-started\u002Fboard-init","01.getting-started\u002F2.board-init",{"title":18,"path":19,"stem":20},"1.3 GitHub Actions & GitLab CI Runner Setup","\u002Fgetting-started\u002Fci-runners","01.getting-started\u002F3.ci-runners",{"title":22,"path":23,"stem":24},"1.4 Organization Credit Pool & Per-Function Credit Pricing","\u002Fgetting-started\u002Forg-credits-and-slack","01.getting-started\u002F4.org-credits-and-slack",false,{"title":27,"path":28,"stem":29,"children":30,"page":25},"2. Pair & Triad Programming","\u002Fpair-and-triad-programming","02.pair-and-triad-programming",[31,35,39,43],{"title":32,"path":33,"stem":34},"2.1 Cross-Model Pair & Triad Programming","\u002Fpair-and-triad-programming\u002Foverview","02.pair-and-triad-programming\u002F1.overview",{"title":36,"path":37,"stem":38},"2.2 Isolated Shadow Workspaces","\u002Fpair-and-triad-programming\u002Fshadow-jj-workspaces","02.pair-and-triad-programming\u002F2.shadow-jj-workspaces",{"title":40,"path":41,"stem":42},"2.3 Cryptographic File-Scope Leases & Small-Diff Gates","\u002Fpair-and-triad-programming\u002Ffile-scope-leases","02.pair-and-triad-programming\u002F3.file-scope-leases",{"title":44,"path":45,"stem":46},"2.4 Sub-Issue to Subagent Fan-Out & Delta Velocity","\u002Fpair-and-triad-programming\u002Fsub-issue-fanout","02.pair-and-triad-programming\u002F4.sub-issue-fanout",{"title":48,"path":49,"stem":50,"children":51,"page":25},"3. Declarative Workflow Policy","\u002Fworkflow-policy","03.workflow-policy",[52,56,60,64],{"title":53,"path":54,"stem":55},"3.1 Declarative Workflow Policy Schema","\u002Fworkflow-policy\u002Fschema-reference","03.workflow-policy\u002F1.schema-reference",{"title":57,"path":58,"stem":59},"3.2 Cryptographic Conformance Matrix & Memory Tombstones","\u002Fworkflow-policy\u002Fwp-01-to-wp-15-matrix","03.workflow-policy\u002F2.wp-01-to-wp-15-matrix",{"title":61,"path":62,"stem":63},"3.3 Two-Tier Organization Governance Lattice","\u002Fworkflow-policy\u002Forg-policy-floor","03.workflow-policy\u002F3.org-policy-floor",{"title":65,"path":66,"stem":67},"3.4 Trusted Handoff Hooks & Independent Verification","\u002Fworkflow-policy\u002Fhandoff-hooks-h1-to-h5","03.workflow-policy\u002F4.handoff-hooks-h1-to-h5",{"title":69,"path":70,"stem":71,"children":72,"page":25},"4. Visual Geometry & Copy Gates","\u002Fvisual-and-copy-tribunals","04.visual-and-copy-tribunals",[73,77,81,85],{"title":74,"path":75,"stem":76},"12-Tuple DOM Geometry (176\u002F176)","\u002Fvisual-and-copy-tribunals\u002Fui-gate-geometry","04.visual-and-copy-tribunals\u002F1.ui-gate-geometry",{"title":78,"path":79,"stem":80},"Vision-3 Geometry & Auto-Patch","\u002Fvisual-and-copy-tribunals\u002Fcross-model-design-tribunal","04.visual-and-copy-tribunals\u002F2.cross-model-design-tribunal",{"title":82,"path":83,"stem":84},"64\u002F64 Declaration Copy Gate","\u002Fvisual-and-copy-tribunals\u002Fdeclaration-copy-gate","04.visual-and-copy-tribunals\u002F3.declaration-copy-gate",{"title":86,"path":87,"stem":88},"Synthetic CI Canary","\u002Fvisual-and-copy-tribunals\u002Fsynthetic-ci-canary","04.visual-and-copy-tribunals\u002F4.synthetic-ci-canary",{"title":90,"path":91,"stem":92,"children":93,"page":25},"5. Autonomous AI Program Manager","\u002Fdelivery-program-manager","05.delivery-program-manager",[94,98,102,106,110],{"title":95,"path":96,"stem":97},"Overview: Dual-Brain AI PM","\u002Fdelivery-program-manager\u002Foverview","05.delivery-program-manager\u002F1.overview",{"title":99,"path":100,"stem":101},"Executable Tickets & Auto-Splitting","\u002Fdelivery-program-manager\u002Fchinwag-tasks-and-never-stop","05.delivery-program-manager\u002F2.chinwag-tasks-and-never-stop",{"title":103,"path":104,"stem":105},".codegraph & FinOps Routing","\u002Fdelivery-program-manager\u002Fcodegraph-and-finops-arbitrage","05.delivery-program-manager\u002F3.codegraph-and-finops-arbitrage",{"title":107,"path":108,"stem":109},"++ Triage & CI Recovery","\u002Fdelivery-program-manager\u002Fplus-plus-ci-triage","05.delivery-program-manager\u002F4.plus-plus-ci-triage",{"title":111,"path":112,"stem":113},"Flight Deck & Trajectory Time-Travel","\u002Fdelivery-program-manager\u002Fflight-deck-and-time-travel","05.delivery-program-manager\u002F5.flight-deck-and-time-travel",{"title":115,"path":116,"stem":117,"children":118,"page":25},"6. The Chinwag Way & Scrimmages","\u002Fthe-chinwag-way","06.the-chinwag-way",[119,123,127,131],{"title":120,"path":121,"stem":122},"Academic Foundations","\u002Fthe-chinwag-way\u002Facademic-foundations","06.the-chinwag-way\u002F1.academic-foundations",{"title":124,"path":125,"stem":126},"Chips (◈) & 7-Day Survival","\u002Fthe-chinwag-way\u002Fchips-and-7day-survival","06.the-chinwag-way\u002F2.chips-and-7day-survival",{"title":128,"path":129,"stem":130},"Sealed Card (.cwcard.png) Drills","\u002Fthe-chinwag-way\u002Fsealed-card-handoff-drills","06.the-chinwag-way\u002F3.sealed-card-handoff-drills",{"title":132,"path":133,"stem":134},"Calibration Scrimmages","\u002Fthe-chinwag-way\u002Fcalibration-scrimmages","06.the-chinwag-way\u002F4.calibration-scrimmages",{"title":136,"path":137,"stem":138,"children":139,"page":25},"7. Zero-Knowledge Cryptography","\u002Fzero-knowledge-cryptography","07.zero-knowledge-cryptography",[140,144,148,152,156,160],{"title":141,"path":142,"stem":143},"PQ-HPKE Wire Envelope","\u002Fzero-knowledge-cryptography\u002Fpq-hpke-envelope","07.zero-knowledge-cryptography\u002F1.pq-hpke-envelope",{"title":145,"path":146,"stem":147},"Verify-Before-Decrypt (K1+K2)","\u002Fzero-knowledge-cryptography\u002Fverify-before-decrypt","07.zero-knowledge-cryptography\u002F2.verify-before-decrypt",{"title":149,"path":150,"stem":151},"Blinded Commitments & 128B Flywheel","\u002Fzero-knowledge-cryptography\u002Fblind-commitments","07.zero-knowledge-cryptography\u002F3.blind-commitments",{"title":153,"path":154,"stem":155},"Local Viewer & CISO DPA","\u002Fzero-knowledge-cryptography\u002Flocal-viewer-and-dpa","07.zero-knowledge-cryptography\u002F4.local-viewer-and-dpa",{"title":157,"path":158,"stem":159},"A.509 Agent Passports","\u002Fzero-knowledge-cryptography\u002Fa509-agent-pkix","07.zero-knowledge-cryptography\u002F5.a509-agent-pkix",{"title":161,"path":162,"stem":163},"chinwag-acu & CISO Kill Switch","\u002Fzero-knowledge-cryptography\u002Fchinwag-acu","07.zero-knowledge-cryptography\u002F6.chinwag-acu",{"title":165,"path":166,"stem":167,"children":168,"page":25},"8. E2EE Mesh & Extension SDK","\u002Fmesh-and-extensions","08.mesh-and-extensions",[169,173,177],{"title":170,"path":171,"stem":172},"chinwag-mesh & 3-Repo Time Machine","\u002Fmesh-and-extensions\u002Fsdk-and-cwcard-png-transport","08.mesh-and-extensions\u002F1.sdk-and-cwcard-png-transport",{"title":174,"path":175,"stem":176},"warroom & whisper Extensions","\u002Fmesh-and-extensions\u002Fwarroom-and-whisper","08.mesh-and-extensions\u002F2.warroom-and-whisper",{"title":178,"path":179,"stem":180},"teleport, shroud & vault","\u002Fmesh-and-extensions\u002Fgit-bundle-and-vault","08.mesh-and-extensions\u002F3.git-bundle-and-vault",{"title":182,"path":183,"stem":184,"children":185,"page":25},"9. CLI & GraphQL Reference","\u002Fcli-and-graphql-reference","09.cli-and-graphql-reference",[186,190,194,198,202,206],{"title":187,"path":188,"stem":189},"chinwag tasks & task","\u002Fcli-and-graphql-reference\u002Fchinwag-task","09.cli-and-graphql-reference\u002F1.chinwag-task",{"title":191,"path":192,"stem":193},"chinwag board & GraphQL","\u002Fcli-and-graphql-reference\u002Fchinwag-board","09.cli-and-graphql-reference\u002F2.chinwag-board",{"title":195,"path":196,"stem":197},"chinwag pair & triad","\u002Fcli-and-graphql-reference\u002Fchinwag-pair-and-triad","09.cli-and-graphql-reference\u002F3.chinwag-pair-and-triad",{"title":199,"path":200,"stem":201},"chinwag bus","\u002Fcli-and-graphql-reference\u002Fchinwag-bus","09.cli-and-graphql-reference\u002F4.chinwag-bus",{"title":203,"path":204,"stem":205},"chinwag-ci, fork-run & ui-gate","\u002Fcli-and-graphql-reference\u002Fchinwag-ci-and-uigate","09.cli-and-graphql-reference\u002F5.chinwag-ci-and-uigate",{"title":207,"path":208,"stem":209},"chinwag memory & tombstone","\u002Fcli-and-graphql-reference\u002Fchinwag-memory","09.cli-and-graphql-reference\u002F6.chinwag-memory",{"title":211,"path":212,"stem":213,"children":214,"page":-1},"10. Architecture PRDs","\u002Fprds","10.prds",[215,218,222,226,230],{"title":216,"path":212,"stem":217},"10.0 Ratified Architecture PRDs","10.prds\u002Findex",{"title":219,"path":220,"stem":221},"10.1 Ephemeral Tart Cleanroom VMs & Declarative Nix","\u002Fprds\u002Ftart-cleanroom-vms","10.prds\u002F1.tart-cleanroom-vms",{"title":223,"path":224,"stem":225},"10.2 Executable Delivery Boards & Proof-of-Green","\u002Fprds\u002Fdelivery-executable-boards","10.prds\u002F2.delivery-executable-boards",{"title":227,"path":228,"stem":229},"10.3 Cursor Agent SDK Importer & Sanitizer","\u002Fprds\u002Fcursor-agent-sdk-importer","10.prds\u002F3.cursor-agent-sdk-importer",{"title":231,"path":232,"stem":233},"10.4 Chinwag Local Web App & Command Center","\u002Fprds\u002Fhuman-command-center-ui","10.prds\u002F4.human-command-center-ui",{"id":235,"title":219,"body":236,"command":249,"description":1126,"extension":1127,"links":1128,"meta":1129,"navigation":1128,"path":220,"seo":1130,"stem":221,"__hash__":1131},"docs\u002F10.prds\u002F1.tart-cleanroom-vms.md",{"type":237,"value":238,"toc":1109},"minimark",[239,243,250,335,338,343,354,400,480,482,486,533,545,587,603,691,728,734,802,804,810,816,911,913,920,930,996,998,1004,1091,1093,1105],[240,241,219],"h1",{"id":242},"_101-ephemeral-tart-cleanroom-vms-declarative-nix",[244,245,246],"p",{},[247,248,249],"code",{},"chinwag runner start --ephemeral && chinwag env lock",[251,252,253,267],"blockquote",{},[244,254,255],{},[256,257,258,259,262,263,266],"strong",{},"PRD Metadata (",[247,260,261],{},"PRD-0035"," \u002F ",[247,264,265],{},"CHWG-0202","):",[268,269,270,280,298,316],"ul",{},[271,272,273,276,277],"li",{},[256,274,275],{},"Status:"," ",[247,278,279],{},"RATIFIED — SCHEDULED ON BOARD (02 · 📐 SCOPED & BENCHMARKED)",[271,281,282,276,285],{},[256,283,284],{},"Live Board Ticket:",[286,287,291,293,294,297],"a",{"href":288,"rel":289},"https:\u002F\u002Fgithub.com\u002Forgs\u002Femunlabs\u002Fprojects\u002F1",[290],"nofollow",[247,292,265],{}," on GitHub Projects v2 (",[247,295,296],{},"github.com\u002Forgs\u002Femunlabs\u002Fprojects\u002F1",")",[271,299,300,276,303,306,307,306,310,306,313],{},[256,301,302],{},"Invariants Enforced:",[247,304,305],{},"INV-NIX-VIRTIOFS-01"," · ",[247,308,309],{},"INV-NIX-RO-STORE-01",[247,311,312],{},"INV-NIX-ZERO-SYNTAX-01",[247,314,315],{},"INV-CLEANROOM-TRUST-SPLIT-01",[271,317,318,321,322,325,326,306,329,306,332],{},[256,319,320],{},"Author & Assignee:"," Brian Spector (",[247,323,324],{},"Emun Labs, Inc., 1401 Lavaca St STE 81335, Austin, TX 78701",") · ",[247,327,328],{},"@ARCHITECT",[247,330,331],{},"@RUST",[247,333,334],{},"@QA",[336,337],"hr",{},[339,340,342],"h2",{"id":341},"_1-problem-statement-strategic-wedge","1. Problem Statement & Strategic Wedge",[244,344,345,346,349,350,353],{},"Cloud-hosted Apple Silicon macOS CI runners charge ",[247,347,348],{},"$0.08–$0.16\u002Fminute"," (",[247,351,352],{},"$480–$960\u002Fmonth"," for an active engineering team) and suffer from two structural bottlenecks:",[355,356,357,386],"ol",{},[271,358,359,366,367,370,371,374,375,377,378,381,382,385],{},[256,360,361,362,365],{},"Cold Toolchain & Dependency Drift (",[247,363,364],{},"45s–180s"," Tax):"," Even when an Apple ",[247,368,369],{},"Virtualization.framework"," VM clones in ",[247,372,373],{},"\u003C2s",", traditional CI pipelines spend ",[247,376,364],{}," running ",[247,379,380],{},"brew install",", downloading Rust\u002FNode\u002FPython toolchains, or compiling uncached crates—and subtle drift between developer laptops (",[247,383,384],{},"brew upgrade"," roulette) causes non-deterministic CI failures.",[271,387,388,391,392,395,396,399],{},[256,389,390],{},"Self-Hosted Runner Contamination & Secret Exposure:"," Standard persistent self-hosted runners execute untrusted pull requests directly on the host filesystem, exposing ",[247,393,394],{},"~\u002F.ssh",", macOS Keychain, and production ",[247,397,398],{},".env"," secrets while polluting global build caches across jobs.",[244,401,402,412,413,416,417,420,421,424,425,428,429,432,433,438,439,442,443,276,446,456,457,462,463,466,467,472,473,479],{},[256,403,404,405,408,409,266],{},"The Chinwag Solution (",[247,406,407],{},"chinwag runner"," + ",[247,410,411],{},"chinwag env lock","\nTurn existing Apple Silicon Macs (",[247,414,415],{},"Mac Studio",", ",[247,418,419],{},"Mac mini",", and idle ",[247,422,423],{},"MacBook Pro"," laptops over ",[247,426,427],{},"iroh"," QUIC) into a ",[256,430,431],{},"zero-trust, bit-for-bit reproducible cleanroom CI swarm"," that boots an isolated APFS Copy-on-Write macOS VM in ",[256,434,435],{},[247,436,437],{},"1.8 seconds",", mounts the host's ",[247,440,441],{},"\u002Fnix\u002Fstore"," and ",[247,444,445],{},"sccache",[256,447,448,449,452,453],{},"read-only over ",[247,450,451],{},"VirtioFS"," in ",[247,454,455],{},"\u003C200ms",", compiles incremental Rust\u002FTypeScript workspaces in ",[256,458,459],{},[247,460,461],{},"18 seconds"," (down from ",[247,464,465],{},"9 minutes"," cold), and destroys the VM in ",[256,468,469],{},[247,470,471],{},"100ms"," after every job at ",[256,474,475,478],{},[247,476,477],{},"$0\u002Fminute"," cloud compute cost",".",[336,481],{},[339,483,485],{"id":484},"_2-three-layer-declarative-cleanroom-stack","2. Three-Layer Declarative Cleanroom Stack",[487,488,493],"pre",{"className":489,"code":490,"language":491,"meta":492,"style":492},"language-mermaid shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","flowchart TD\n  A[\"Repository Manifests\\n(Cargo.toml \u002F package.json \u002F .chinwag\u002Fenv.ts)\"] --> B[\"chinwag env lock\\n(Zero-Nix-Syntax Lockfile Compiler)\"]\n  B --> C[\"Deterministic .chinwag\u002Fflake.lock\\n(SHA-256 Content-Addressed Store Paths)\"]\n  C --> D[\"Ephemeral Tart Cleanroom VM (1.8s APFS CoW Clone)\\n+ nix-darwin Immutable System Spine\"]\n  H[\"Mac Host NVMe Cache\\n(\u002Fnix\u002Fstore + sccache)\"] -->|\"VirtioFS Read-Only Mount (:ro)\\n(\u003C200ms Zero-Network Bind @ >5 GB\u002Fs)\"| D\n  D --> E[\"XNU Kernel Seatbelt (INV-NIX-RO-STORE-01)\\n(Hard SIGKILL on \u002Fnix\u002Fstore Writes & nix-daemon Sockets)\"]\n","mermaid","",[247,494,495,503,509,515,521,527],{"__ignoreMap":492},[496,497,500],"span",{"class":498,"line":499},"line",1,[496,501,502],{},"flowchart TD\n",[496,504,506],{"class":498,"line":505},2,[496,507,508],{},"  A[\"Repository Manifests\\n(Cargo.toml \u002F package.json \u002F .chinwag\u002Fenv.ts)\"] --> B[\"chinwag env lock\\n(Zero-Nix-Syntax Lockfile Compiler)\"]\n",[496,510,512],{"class":498,"line":511},3,[496,513,514],{},"  B --> C[\"Deterministic .chinwag\u002Fflake.lock\\n(SHA-256 Content-Addressed Store Paths)\"]\n",[496,516,518],{"class":498,"line":517},4,[496,519,520],{},"  C --> D[\"Ephemeral Tart Cleanroom VM (1.8s APFS CoW Clone)\\n+ nix-darwin Immutable System Spine\"]\n",[496,522,524],{"class":498,"line":523},5,[496,525,526],{},"  H[\"Mac Host NVMe Cache\\n(\u002Fnix\u002Fstore + sccache)\"] -->|\"VirtioFS Read-Only Mount (:ro)\\n(\u003C200ms Zero-Network Bind @ >5 GB\u002Fs)\"| D\n",[496,528,530],{"class":498,"line":529},6,[496,531,532],{},"  D --> E[\"XNU Kernel Seatbelt (INV-NIX-RO-STORE-01)\\n(Hard SIGKILL on \u002Fnix\u002Fstore Writes & nix-daemon Sockets)\"]\n",[534,535,537,538,541,542,544],"h3",{"id":536},"layer-1-ephemeral-apfs-copy-on-write-tart-vms-18s-boot-100ms-teardown","Layer 1: Ephemeral APFS Copy-on-Write Tart VMs (",[247,539,540],{},"1.8s"," Boot, ",[247,543,471],{}," Teardown)",[268,546,547,556,566],{},[271,548,549,550,553,554,479],{},"Every CI job executes ",[247,551,552],{},"tart clone chinwag-cleanroom-base job-\u003Cuuid> --ephemeral"," on Apple's native ",[247,555,369],{},[271,557,558,559,562,563,565],{},"APFS Copy-on-Write clones the golden ",[247,560,561],{},"nix-darwin"," base image in ",[247,564,437],{}," without duplicating disk blocks on NVMe.",[271,567,568,569,572,573,576,577,580,581,452,584,586],{},"Upon job completion (or timeout\u002Fcrash), the supervisor captures a ",[247,570,571],{},"zstd","-compressed + Hybrid Post-Quantum HPKE (",[247,574,575],{},"X25519MLKEM768",") failure bundle (",[247,578,579],{},"Hook H4",") and runs ",[247,582,583],{},"tart delete job-\u003Cuuid>",[247,585,471],{},", guaranteeing zero state persistence between builds.",[534,588,590,591,593,594,596,597,349,599,593,601,297],{"id":589},"layer-2-host-shared-read-only-nixstore-sccache-via-virtiofs-inv-nix-virtiofs-01-inv-nix-ro-store-01","Layer 2: Host-Shared Read-Only ",[247,592,441],{}," & ",[247,595,445],{}," via ",[247,598,451],{},[247,600,305],{},[247,602,309],{},[268,604,605],{},[271,606,607,608],{},"Instead of downloading gigabytes of compilers and crates inside each ephemeral VM:\n",[355,609,610,622,640],{},[271,611,612,613,615,616,618,619,621],{},"The Mac host maintains a central ",[247,614,441],{}," and content-addressed ",[247,617,445],{}," directory on local NVMe (synchronized peer-to-peer across the org's ",[247,620,427],{}," QUIC mesh).",[271,623,624,626,627,629,630,349,632,635,636,639],{},[247,625,407],{}," mounts ",[247,628,441],{}," and the read-only build cache into the guest VM via ",[247,631,451],{},[247,633,634],{},"--dir=nix-store:\u002Fnix\u002Fstore:ro,cache:\u002Fvar\u002Fcache\u002Fchinwag:ro",") at ",[247,637,638],{},">5 GB\u002Fs"," memory-bus throughput.",[271,641,642,647],{},[256,643,644,645,266],{},"Hypervisor + XNU Kernel Seatbelt Immutability (",[247,646,309],{},[268,648,649,673],{},[271,650,651,652,655,656,416,659,416,662,416,665,668,669,672],{},"The host VMM enforces the ",[247,653,654],{},":ro"," tag at the hypervisor boundary, rejecting ",[247,657,658],{},"FUSE_WRITE",[247,660,661],{},"FUSE_CREATE",[247,663,664],{},"FUSE_UNLINK",[247,666,667],{},"FUSE_RENAME",", and ",[247,670,671],{},"FUSE_SETXATTR"," opcodes before they reach host APFS.",[271,674,675,676,679,680,683,684,686,687,690],{},"Inside the guest VM and on host workers, ",[247,677,678],{},"chinwag-contain-trampoline"," compiles non-negotiable XNU Seatbelt (",[247,681,682],{},"sandbox_init",") rules that terminate any process attempting to mutate ",[247,685,441],{}," or connect to ",[247,688,689],{},"nix-daemon",":",[487,692,696],{"className":693,"code":694,"language":695,"meta":492,"style":492},"language-scheme shiki shiki-themes material-theme-lighter material-theme material-theme-palenight",";; INV-NIX-RO-STORE-01: Read-only \u002Fnix\u002Fstore; hard SIGKILL on all store writes & nix-daemon sockets\n(allow file-read* (subpath \"\u002Fnix\u002Fstore\"))\n(deny file-write* (subpath \"\u002Fnix\u002Fstore\") (with send-signal SIGKILL))\n(deny file-write-xattr file-write-mode file-write-owner (subpath \"\u002Fnix\u002Fstore\") (with send-signal SIGKILL))\n(deny file-read* file-write* (subpath \"\u002Fnix\u002Fvar\u002Fnix\u002Fdaemon-socket\") (with send-signal SIGKILL))\n(deny network-outbound (remote unix-socket (path-literal \"\u002Fnix\u002Fvar\u002Fnix\u002Fdaemon-socket\u002Fsocket\")))\n","scheme",[247,697,698,703,708,713,718,723],{"__ignoreMap":492},[496,699,700],{"class":498,"line":499},[496,701,702],{},";; INV-NIX-RO-STORE-01: Read-only \u002Fnix\u002Fstore; hard SIGKILL on all store writes & nix-daemon sockets\n",[496,704,705],{"class":498,"line":505},[496,706,707],{},"(allow file-read* (subpath \"\u002Fnix\u002Fstore\"))\n",[496,709,710],{"class":498,"line":511},[496,711,712],{},"(deny file-write* (subpath \"\u002Fnix\u002Fstore\") (with send-signal SIGKILL))\n",[496,714,715],{"class":498,"line":517},[496,716,717],{},"(deny file-write-xattr file-write-mode file-write-owner (subpath \"\u002Fnix\u002Fstore\") (with send-signal SIGKILL))\n",[496,719,720],{"class":498,"line":523},[496,721,722],{},"(deny file-read* file-write* (subpath \"\u002Fnix\u002Fvar\u002Fnix\u002Fdaemon-socket\") (with send-signal SIGKILL))\n",[496,724,725],{"class":498,"line":529},[496,726,727],{},"(deny network-outbound (remote unix-socket (path-literal \"\u002Fnix\u002Fvar\u002Fnix\u002Fdaemon-socket\u002Fsocket\")))\n",[534,729,731,732,297],{"id":730},"layer-3-zero-nix-syntax-lockfile-synthesis-inv-nix-zero-syntax-01","Layer 3: Zero-Nix-Syntax Lockfile Synthesis (",[247,733,312],{},[268,735,736],{},[271,737,738,739,746,747],{},"Developers ",[256,740,741,742,745],{},"never write a single line of ",[247,743,744],{},".nix"," expression syntax",":\n",[268,748,749,789],{},[271,750,751,754,755,757,758,416,761,416,764,416,767,668,770,773,774,777,778,781,782,785,786,479],{},[256,752,753],{},"Mode A — Zero-Config Auto-Lock (Default):"," Running ",[247,756,411],{}," inspects ",[247,759,760],{},"Cargo.toml",[247,762,763],{},"rust-toolchain.toml",[247,765,766],{},"package.json",[247,768,769],{},"pyproject.toml",[247,771,772],{},"go.mod",", resolves the exact ",[247,775,776],{},"nixpkgs"," derivation hashes, and writes ",[247,779,780],{},".chinwag\u002Fflake.lock"," with Ed25519-signed ",[247,783,784],{},"narHash"," Merkle verification receipts in ",[247,787,788],{},".chinwag\u002Fstate.crdb",[271,790,791,797,798,801],{},[256,792,793,794,266],{},"Mode B — Typed TypeScript Environment Spec (",[247,795,796],{},".chinwag\u002Fenv.ts"," For custom system libraries or service daemons (Postgres, Redis, MinIO), developers declare dependencies in typed TypeScript (",[247,799,800],{},"@chinwag\u002Fjinx-nixpkgs",") with full IDE autocomplete.",[336,803],{},[339,805,807,808,297],{"id":806},"_3-two-tier-trust-split-inv-cleanroom-trust-split-01","3. Two-Tier Trust Split (",[247,809,315],{},[244,811,812,813,815],{},"To prevent untrusted fork PRs or experimental agent branches from touching release signing credentials, ",[247,814,407],{}," enforces two distinct runner profiles:",[817,818,819,839],"table",{},[820,821,822],"thead",{},[823,824,825,830,833,836],"tr",{},[826,827,829],"th",{"align":828},"left","Runner Profile",[826,831,832],{"align":828},"Trigger Scope",[826,834,835],{"align":828},"Secret & Keychain Access",[826,837,838],{"align":828},"Outbound Network Policy",[840,841,842,870],"tbody",{},[823,843,844,852,855,864],{},[845,846,847],"td",{"align":828},[256,848,849],{},[247,850,851],{},"chinwag-ephemeral-public",[845,853,854],{"align":828},"Untrusted fork PRs, external contributor branches, and unmerged agent worktrees",[845,856,857,349,860,863],{"align":828},[256,858,859],{},"Zero secrets",[247,861,862],{},"PhantomVault"," disabled, zero Apple Developer ID certificates, zero deployment tokens)",[845,865,866,867,869],{"align":828},"Locked to declared package registries and the ",[247,868,427],{}," binary cache",[823,871,872,879,897,908],{},[845,873,874],{"align":828},[256,875,876],{},[247,877,878],{},"chinwag-ephemeral-release",[845,880,881,884,885,888,889,892,893,896],{"align":828},[247,882,883],{},"Ed25519","-verified commits on ",[247,886,887],{},"main"," or signed ",[247,890,891],{},"v*"," release tags (",[247,894,895],{},"chinwag-ci verify-signer"," PASS)",[845,898,899,900,903,904,907],{"align":828},"Scoped ephemeral lease for Apple ",[247,901,902],{},"Developer ID Application"," signing + ",[247,905,906],{},"notarytool"," notarization",[845,909,910],{"align":828},"Scoped release artifact upload to Cloudflare R2 & GitHub Releases",[336,912],{},[339,914,916,917,919],{"id":915},"_4-multi-mac-4-vm-cleanroom-swarm-over-iroh-quic","4. Multi-Mac 4-VM Cleanroom Swarm Over ",[247,918,427],{}," QUIC",[244,921,922,923,925,926,929],{},"Apple's macOS EULA and ",[247,924,369],{}," cap each physical Mac at ",[256,927,928],{},"2 concurrent macOS VMs",". Chinwag turns that hardware limit into a federated multi-Mac advantage:",[268,931,932,949,987],{},[271,933,934,941,942,416,945,948],{},[256,935,936,937,940],{},"Primary Workstation \u002F Build Server (",[247,938,939],{},"2"," Always-On Cleanroom VMs):"," Runs two dedicated ephemeral Tart slots (",[247,943,944],{},"slot-1",[247,946,947],{},"slot-2",") continuously.",[271,950,951,958,959,962,963,966,967],{},[256,952,953,954,957],{},"Opportunistic Laptop Swarm (",[247,955,956],{},"+2"," Idle VMs per MacBook Pro):"," Developer laptops running ",[247,960,961],{},"chinwag runner join --opportunistic"," automatically contribute up to 2 ephemeral VM slots ",[256,964,965],{},"only"," when three hardware telemetry predicates hold:\n",[355,968,969,975,981],{},[271,970,971,972,297],{},"Connected to AC Wall Power (",[247,973,974],{},"IOPMPowerSource == AC Power",[271,976,977,978,297],{},"Thermal State Nominal (",[247,979,980],{},"NSProcessInfoThermalStateNominal",[271,982,983,984],{},"Host CPU Idle Headroom ",[247,985,986],{},"> 70%",[271,988,989,992,993,479],{},[256,990,991],{},"Instant Wakeup on User Input:"," The moment a developer touches the trackpad\u002Fkeyboard or unplugs AC power, the laptop finishes or checkpoints the active step and drains its opportunistic runner slots in ",[247,994,995],{},"\u003C500ms",[336,997],{},[339,999,1001,1002,297],{"id":1000},"_5-mechanized-delivery-slices-on-the-project-board-chwg-0202","5. Mechanized Delivery Slices on the Project Board (",[247,1003,265],{},[355,1005,1006,1041,1067],{},[271,1007,1008,1020,1021,349,1024,1026,1027,1030,1031,1033,1034,1037,1038,1040],{},[256,1009,1010,1011,1014,1015,276,1017,1019],{},"Slice 1A (",[247,1012,1013],{},"CHWG-0202-A"," — Golden Tart Image & ",[247,1016,451],{},[247,1018,654],{}," Seatbelt):"," Build ",[247,1022,1023],{},"chinwag-cleanroom-base",[247,1025,561],{}," + Determinate Nix), wire ",[247,1028,1029],{},"tart run --dir=nix-store:\u002Fnix\u002Fstore:ro",", and verify ",[247,1032,309],{}," Seatbelt ",[247,1035,1036],{},"SIGKILL"," tests + ",[247,1039,455],{}," mount latency.",[271,1042,1043,1053,1054,262,1056,1058,1059,1061,1062,1064,1065,479],{},[256,1044,1045,1046,1049,1050,1052],{},"Slice 1B (",[247,1047,1048],{},"CHWG-0202-B"," — ",[247,1051,411],{}," Zero-Nix Compiler):"," Implement automatic lockfile synthesis from ",[247,1055,760],{},[247,1057,766],{}," -> ",[247,1060,780],{}," with pre-mount ",[247,1063,784],{}," verification receipts in ",[247,1066,788],{},[271,1068,1069,1081,1082,1084,1085,1087,1088,1090],{},[256,1070,1071,1072,1049,1075,1077,1078,1080],{},"Slice 1C (",[247,1073,1074],{},"CHWG-0202-C",[247,1076,407],{}," 2-Tier Trust Gate & ",[247,1079,427],{}," Pool):"," Implement JIT GitHub Actions \u002F GitLab runner registration (",[247,1083,851],{}," vs. ",[247,1086,878],{},"), ",[247,1089,579],{}," HPKE failure bundle sealing, and AC\u002Fthermal-gated multi-Mac pooling.",[336,1092],{},[268,1094,1095],{},[271,1096,1097,276,1100],{},[256,1098,1099],{},"Ready to ship verified code at autonomous speed?",[286,1101,1104],{"href":1102,"rel":1103},"https:\u002F\u002Fchinwag.sh\u002Fpricing",[290],"Reserve Your Organization Credit Pack →",[1106,1107,1108],"style",{},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":492,"searchDepth":505,"depth":505,"links":1110},[1111,1112,1120,1122,1124],{"id":341,"depth":505,"text":342},{"id":484,"depth":505,"text":485,"children":1113},[1114,1116,1118],{"id":536,"depth":511,"text":1115},"Layer 1: Ephemeral APFS Copy-on-Write Tart VMs (1.8s Boot, 100ms Teardown)",{"id":589,"depth":511,"text":1117},"Layer 2: Host-Shared Read-Only \u002Fnix\u002Fstore & sccache via VirtioFS (INV-NIX-VIRTIOFS-01 & INV-NIX-RO-STORE-01)",{"id":730,"depth":511,"text":1119},"Layer 3: Zero-Nix-Syntax Lockfile Synthesis (INV-NIX-ZERO-SYNTAX-01)",{"id":806,"depth":505,"text":1121},"3. Two-Tier Trust Split (INV-CLEANROOM-TRUST-SPLIT-01)",{"id":915,"depth":505,"text":1123},"4. Multi-Mac 4-VM Cleanroom Swarm Over iroh QUIC",{"id":1000,"depth":505,"text":1125},"5. Mechanized Delivery Slices on the Project Board (CHWG-0202)","PRD-0035 & CHWG-CICD-2: 1.8s APFS Copy-on-Write Tart macOS Cleanroom VMs, host-shared read-only VirtioFS \u002Fnix\u002Fstore and sccache, zero-Nix-syntax lockfile synthesis, and iroh QUIC multi-Mac runner pooling.","md",null,{},{"title":219,"description":1126},"uHFGRV0AlwGwA30wvcstIalQjzZkl9t2pngfTdomR5o",[1133,1135],{"title":216,"path":212,"stem":217,"description":1134,"children":-1},"Publicly ratified engineering Product Requirements Documents (PRDs) and Request for Discussion (RFD) specifications backing Chinwag's live GitHub Projects v2 and Linear boards.",{"title":223,"path":224,"stem":225,"description":1136,"children":-1},"PRD-0038 & CHWG-0192: Chinwag Delivery-2 autonomous kanban state machine, 4-surface Proof-of-Green verification, 200ms snap-back, and native GitHub\u002FLinear Insights telemetry.",1794371826572]