Genesis is a research system with an embodied host boundary. Treat a running instance like a user-level process that can read its permitted inputs, use CPU, and hold persistent state — not like a sandboxed model.

The supported startup path is ./run.sh (or the packaged genesis command). State belongs in ${XDG_DATA_HOME:-$HOME/.local/share}/genesis, or the directory selected by GENESIS_DATA_DIR / .genesis-data-dir.

Do not point a live instance at accounts, files, microphones, cameras, webhook URLs, or hardware controls you are not willing to let it use under the permissions of the user running it.

Genesis can autonomously fetch public web content when network access is enabled. There is currently no domain allow-list in the default configuration. Run offline when that is not acceptable:

./run.sh --offline

A Discord session mirror is optional. Put the webhook in .genesis-discord or GENESIS_DISCORD_WEBHOOK; both are local secrets and must never be committed.

The developmental record is cumulative and load-bearing. Stop Genesis with Ctrl-C, ./run.sh --stop, or genesis --stop. Do not use kill -9, edit the memory-mapped state directly, or delete state as an operational shortcut.

Please do not open a public issue for a vulnerability that could expose data, credentials, or a running instance. Use GitHub's private vulnerability reporting flow if it is enabled for the repository; otherwise contact the maintainer through the GitHub account linked from the repository.

Include:

• the commit or version tested,
• whether the instance was online or offline,
• the affected boundary (filesystem, network, IPC, sensors, ARC adapter, etc.),
• a minimal reproduction,
• and whether any persistent state was modified.

Do not include real secrets, recordings, or personal state dumps in a report.

In scope:

• unintended secret disclosure from the repository or runtime,
• state-file corruption or unsafe recovery behavior,
• IPC privilege or protocol confusion,
• unsafe autonomous network or tool use beyond the documented boundary,
• unsafe interaction with system sensors, CPU controls, or ARC submission credentials.

Out of scope:

• the documented ability to fetch public web pages when online,
• CPU/disk use within the documented bounds,
• the fact that a non-sandboxed process can access what its user can access,
• or benchmark failures that do not cross a security boundary.