Shepherd

Research runtime (MIT, early alpha; arXiv 2605.10913, Stanford/Northeastern) that records an agent's run as a reversible, Git-like trace, so nothing touches your files until you accept it. Permissions live in the task's function signature (read-only or read-write per repo) and, on a supported OS, are enforced at the native syscall jail (macOS Seatbelt, Linux Landlock). Early alpha with changing APIs; study and pilot it in a sandbox, not production.