A layer, not a monolith.
Take what you need.

The agent has to justify every edit or write before running it.

File edits wait for approval before they're applied.

Post-edit safety net. Suspends on rejection. Forces a re-review before the agent tries again.

AST-based bash interception. Blocks destructive commands before they run.

Tiered process isolation backed by the Sandlock engine (seccomp + Landlock).

Connects your local Pi instance to the self-hosted Bastille-C3 Console. Sends governance events for centralized audit, shared team policy, and team admin.

Full capture of HTTP requests and responses for LLM model calls. A local record you can inspect.

Local-first retrieval built on zvec. Your embeddings, collections, and storage stay under your control.

Cuts output token volume by roughly 50% or more.

Lossless session compaction. No LLM call. Nothing lost.

Auto-redirects pip, poetry, python, and venv to uv.

Spins up and manages agents and long-running processes through PTY sessions, not tmux.

High-leverage configs that enforce a methodology without capping the intelligence.

Manage your BASTILLE-C3 license from the Pi command palette - status, refresh, and clear.