RigOne treats orchestration failures as product failures, not terminal noise:
- overlapping write scopes are refused before the first process starts;
- cancellation ends the whole process group and verifies that it is dead;
- timeouts go through the same supervised shutdown path;
- prompts and secrets go through stdin, never command-line arguments;
- child environments are rebuilt from an explicit allowlist;
- unknown vendor events are recorded and ignored instead of crashing the run;
- a green exit code without proof that tests ran is not accepted as a green check;
- files are the source of truth, while the SQLite index can be deleted and rebuilt.
Settings passed through to an agent app can never raise an agent's file permissions; the Can it change files control is the only way to do that. A project setting can never send an agent's traffic to another address; model gateways are set in your own settings.
Auto with full access is the exception to the fence: its steps run with the same access as the agent app in your terminal. Turn it off when you want Auto's steps to stay in their copies.
What leaves your Mac
RigOne runs on your Mac and works in your folders. The agents it starts are Claude Code, Codex or OpenCode, so what they read goes to their providers exactly as when you run them in a terminal, and their commands may reach the network. A model gateway receives the traffic of the agents you send through it. A trigger talks to Linear with the key you gave it. Boards talks to the MonoOne server, which only ever receives encrypted tasks, comments and activity. Remote access connects your paired devices to your Mac through the MonoOne relay.