FAQ

Does installing goodLAC automatically install a complete local model stack?

No. rc.12 deliberately does not provide a one-command public bootstrap for the heavyweight qualified Pi/FreeToken/model runtime assets.

Is every pi process automatically governed?

No. The installed goodLAC pi entrypoint is governed by default. Direct upstream execution or pi --dangerously-bypass-lac is not governed.

Does registering a capability authorize it?

No. Registration grants zero authority. Standing permission and, when required, exact approval are separate.

If a first request is denied because permission is not configured, does approving later revive it?

No. The original request remains closed. The bounded continuation mechanism can create at most one fresh request from immutable captured intent, and that fresh request receives full current evaluation.

Does “Allow once” just run the denied request?

No. It uses the fresh-request continuation path and exact approval semantics; the original denied request does not revive.

Do permissions cross projects?

The qualified project-aware path binds permissions to controller-derived project identity. A rule created for Project A does not authorize Project B.

Can the model call owner administration commands?

The qualified governed Pi sandbox does not expose the owner administrator socket, and the model-facing effect surface does not include an administration tool.

Does rc.12 approve new providers/adapters before first connection?

No. rc.12 does not implement a generic first-connect provider/adapter admission gate. Capability registration and effect authorization are separate, narrower controls.

What happens during emergency pause?

New consequential effects are blocked. Resuming the emergency state does not retroactively authorize or replay already-closed work.

Where do I report a vulnerability?

Use the repository's GitHub Private Vulnerability Reporting interface, not a public issue or discussion.