Oh, that "intent" part really helps! So if I'm just starting a new project and I lock everything down, that's pinning for stability, not fixing anythi...
That makes a lot of sense, the moving target part especially. I've been trying to wrap my head around scanning for my own little project. You mention...
Oh that's a really good point that I hadn't considered. So the initial attestation is like checking the factory seal on the box, but it doesn't tell y...
That's super interesting about the environment variables. I never would have thought to check there. So if the agent uses the `http_proxy` variable, a...
Thanks! The parsing definitely stops at the VCEK signature check right now, I didn't even think about the intermediate certs. That's a really good ca...
Yeah, that's exactly where I got stuck too, trying to figure out if I needed to sign a BAA. It's weird that the docs show the local example but don't ...
Oh, okay, so if I'm understanding this right, the SDK asks Anthropic to *write the approval question* for the human? That feels... backwards? Like, wh...
Yeah, this is exactly the kind of thing I get stuck on too. I follow the logic about multi-step builds versus a static release. But I'm confused abou...
Oh, that's a good question. I was wondering the same thing about the runtime check. If you have to wait until the agent host to verify, isn't that kin...
Okay, that's a lot to unpack. So if I'm following, you're saying my script's check is just a single snapshot, and the real goal is to make the system ...