Zones

zones.yml names the places your agents run, and what each place may hold. mand runner check compares each place with it. The file is optional, and the check runs only once your rules name a zone.

Settings

`zones`

Each zone, by a name you choose, such as agents, with the settings below.

`match`

Which containers are the zone. {label: key=value} takes every container that carries that Docker label, and {name: <glob>} takes containers by name, such as {name: "multica-daemon*"}.

`keys`

The credentials the zone may hold, by name, such as MULTICA_TOKEN. No value is ever written here.

`writes`

The only places inside its containers that the zone may write. Each is a path that starts with /.

`push`

true when the zone may hold a credential that pushes to git, such as GITHUB_TOKEN. The default is false.

What the check names

mand runner check reads each container of each zone from Docker. It names what a container should not hold, by name and never by value:

finding	what it means
`docker-socket`	the Docker socket is mounted, which reaches the whole machine
`credentials-folder`	a folder of credentials is mounted, such as `~/.ssh` or `~/.aws`
`privileged`	the container runs privileged, on the host's network or process space, or with a wide capability
`push`	a push credential, in a zone that may not push
`secret`	a credential the zone does not list under `keys`
`write`	a place it may write that the zone does not list under `writes`
`hook`	a git hook in a workspace it can write, which a later git command there would run
`hooks-path`	`core.hooksPath` pointing anywhere but the repository's own `.githooks`

It exits with 1 when it finds anything. Run it on each machine where your agents run, every 10 minutes from a scheduler, so a finding reaches you within minutes.

Write it

Container names and paths differ per machine, so start from docker inspect of your own containers. A zone for the agents a Multica daemon starts. The daemon keeps its own settings in /home/agent/.claude and /home/agent/.multica, volumes of its own, so both are in writes:

.mandately/zones.yml

zones:
  agents:
    match: {name: "multica-daemon*"}
    keys: [CLAUDE_CODE_OAUTH_TOKEN, MULTICA_TOKEN]
    writes: [/home/agent/repos, /home/agent/multica_workspaces, /home/agent/.claude, /home/agent/.multica]
    push: false

mand runner check then names anything else its containers hold. Add it to the zone by pull request when the zone should hold it, or take it out of the container.

A folder bound from the machine's own ~/.multica is reported as credentials-folder, even when writes lists its path inside the container. It hands the container the Multica sign-in of the person who owns the machine. Give the daemon a login of its own instead: MULTICA_TOKEN in its environment, listed under keys, or a volume of its own.