The maintainer's programs. They start the server and build the sandboxes OCX runs in.

F: box "fossil" bold ht 0.5in wid 0.9in thick
D: box "ocx2 daemon" bold "and its agent runs" "own folders, network" italic wid 1.65in ht 0.9in dashed with .e at F.w - (1.5in, 0)
R: cylinder "repositories" wid 1.2in ht 0.7in with .w at F.e + (1.1in, 0)
W: box "web page *" bold "no repositories" italic "no network" italic wid 1.5in ht 0.9in dashed with .n at F.s - (0, 0.6in)
C: box wid 1.5in ht 0.9in dashed with .n at (R.x, W.n.y)
   text "receipt reader" bold at C.n - (0, 0.17in)
   box "receipt-reader.cr" bold thick wid 1.35in ht 0.3in at C.c
   text "no network" italic at C.s + (0, 0.17in)
S: box "serve.cr" bold ht 0.4in wid 0.9in thick with .s at F.n + (0, 0.5in)

arrow from D.e to F.w "adds, over HTTPS" above "as a non-admin user" below
arrow from F.e to R.w "writes" above
arrow from C.n to R.s "reads only" ljust
arrow from F.s to W.n "confine.cr," ljust "per request" ljust
arrow from W.e to C.w "asks" above
arrow from S.s to F.n "starts" ljust
arrow from S.w left until even with D then down to D.n
text "confine.cr" with .s at ((S.w.x + D.x) / 2, S.w.y)
line from S.e right until even with C.e + (0.3in, 0) then down until even with C
text "confine.cr" with .s at ((S.e.x + C.e.x + 0.3in) / 2, S.e.y)
arrow from last line.end to C.e
K1: text "thick: trusted program      dashed: sandbox built by confine.cr" italic with .n at ((D.w.x + C.e.x + 0.3in)/2, W.s.y - 0.2in)
    text "a sandbox's process reaches only what its box and arrows show" italic with .n at K1.s

• Trusted: fossil and three short scripts, serve, confine and receipt-reader, set by hosts.json.
• Agents add only through Fossil, from this host or another: sync over HTTPS or Fossil's web forms, as users holding neither admin nor setup (nodes goC4w, runs gio24R).
• Adding never erases: Fossil names each artifact by its hash, so an edit is a new artifact and the old one stays in history. Removing one needs admin (shun) or the repository file itself (purge); changing users or settings needs admin or setup.
• Limits: any forum writer can edit or blank any post, though history keeps the old one; a user given y can replace or delete unversioned files, which keep no history; chat is not part of the record.
• * Until phase 2 is built: only the web page's /receipt runs sandboxed; its other pages still run the release's program unsandboxed, able to write the repository files. Phase 2 of the Migration plan ends that: the web page asks the ocx2 daemon for everything, and confine sandboxes every page. It is the next work after this switch.
• sync-fossil is the maintainer's own sync tool, not part of this.

Why changes here need the maintainer's approval

These programs build the sandboxes and run with the server's full authority: one changed line could open them. So they

• change only with the maintainer's approval on the record (HISTORY.md decision 22);
• are built from the maintainer's checkout, never from a release;
• are deployed together, serve, confine, receipt-reader and hosts.json, in a directory only root can write.