kid-agents

Use when running dangerous shell commands, installing untrusted packages, or testing untrusted code that could damage the host. Spawns a sandboxed kid (a child EloPhanto inside a hardened container) where rm -rf, fork bombs, kernel-touching ops, and similar are safely contained. Default vault scope is empty; default network is outbound-only. Distinct from organization specialists — kids are ephemeral, identity-less,…