Canonical docs (in repo)
docs/README.mddocs/ARCHITECTURE.mddocs/SELF_HOST.mddocs/subsystems/control-plane.mddocs/subsystems/sandbox-runtime.mddocs/operations/security-config-hardening.md
Baseline intent
- Keep control-plane state and orchestration stable.
- Keep heavy sandbox execution on dedicated container hosts.
- Keep docs in lockstep with behavioral changes.