Pacenote v0.5.0

Pace can answer from a sandbox built into Pacenote: each request runs in a small Linux VM of its own, with nothing else to install. A team hub now runs from a published image.

brew update && brew upgrade --cask pacenote

The upgrade quits the running app first and reopens it. Nothing changes until you choose the built-in sandbox: Pace keeps running where it runs now, and config and run history are untouched.

The built-in sandbox

Settings > Sandbox > Built-in sandbox runs each request's claude or codex in a Linux VM of its own, started in under a second. It needs a Mac with Apple silicon and macOS 15 or later, and no Docker. The Intel app goes without it.
Set up built-in sandbox prepares it once, in ~/.pacenote/vm: a Linux kernel (a download of about 290 MB, checked against a pinned SHA-256) and the image, built with the same CLI versions as the Docker sandbox. Run it again for newer CLIs.
The VM has no network device. Its one way out is a proxy in Pace that lets through only the allowed domains, the same list as the Docker sandbox's, and never reaches this Mac, the link-local range or multicast.
Each run starts from a read-only image with an empty home and /tmp, and sees only the files its CLI needs. A stop or a timeout stops the VM, and runs at the same time each get their own.
Sign-in is the Docker sandbox's: a claude token (claude setup-token) or codex's login file. Only the selected CLI's credentials go into its runs, in either sandbox.
Diagram rendering still uses Docker.

Ops tools in the built-in sandbox

With ops tools on, Pace starts their broker in a VM of its own while it runs. Its credentials and work folder stay in that VM, out of reach of the VM that answers.
The broker's VM reaches only what its settings name: the SSH hosts, each kubeconfig's API server, GitHub and the Jira site. It never reaches this Mac.
Its audit log says who asked on each line: the person, the conversation and the thread.
Ops tools need a sandbox, now either one (OPS_TOOLS=on with REASONER_SANDBOX=vm or docker). In the built-in sandbox, tool settings apply when Pace restarts, and Recreate broker prepares the broker's files again.

Team hub

Each release publishes the hub's image, ghcr.io/ashon/pacenote-hub, for amd64 and arm64 servers. A hub is now compose.yaml and hub.env from deploy/hub and docker compose up -d, without the repository, and docker compose pull && docker compose up -d updates it (Team hub).
A hub built from source keeps working: docker compose up -d --build still builds it, and the data volume, with the paired desktops, stays the same.

Also

The startup check of the claude token follows ANTHROPIC_BASE_URL, as claude does.