Orchestrator-owned guardrails: protected config, spawn-time hook packs, memory-write scanning #409

From the agent-security research (HiddenLayer just validated 'agent harness security' as a product category, Aug 2026): the orchestrator is the one layer that can enforce policy locally. Solenta can implement without any ML:

1. Solenta, not the agent, owns and protects hooks/settings — deny agent writes to .claude/hooks, settings files, CI configs, and its own rule files (the single highest-leverage rule from the Hugging Face postmortem).
2. Default spawn-time hook packs: block reads of .env/.pem/credentials, tier shell commands (deny curl-pipe-sh, rm -rf outside the worktree, force-push; prompt on network egress), restrict writes outside the worktree.
3. Injection-scan untrusted inbound content (issue bodies, web fetches, proposed writes to CLAUDE.md/memory) before it enters context.
4. Scan shared-memory writes on store — the memory server is a cross-agent injection propagation channel: poison one entry, compromise every future thread that loads it. No competitor does this.
5. Secret-scan outbound diffs/commits/PR bodies before they leave the machine (gitleaks-style).

Positions Solenta as the local/open answer to enterprise harness-security vendors.