Canonical published Now, a dependency-light Go terminal tool for sensitive environments. It sends only an explicit request, arguments, and standard input to a completions-compatible model; the model returns one shell script, which the tool prints for approval before executing locally with BusyBox ash. There is no model tool loop. Optional Bubblewrap controls declare read-only paths, writable paths, and network access, keeping proposal and execution as separate trust zones. The evidence is a new source repository, not a tagged release or independent security assessment; auto-approve flags can remove the human checkpoint, and isolation depends on Bubblewrap availability and correctly scoped grants. Restraint here is architectural: remote inference proposes once, while consequential access remains local and declared.
A question for designCould a model's role end at one inspectable proposal while local permissions, execution, and the option to stop remain explicit?*5