Minimal, secure-by-default agentic harness - View it on GitHub