Torio: agent context inside a VM

Torio is a host CLI and Linux VM layer for running coding agents with bounded context and credentials. It creates a Linux VM, runs Claude Code or Codex inside it, attaches named repositories, and maintains a private Markdown vault the agent can search. Host Git and provider credentials remain outside the VM, while private SSH reads use a guest-generated deploy key and MCP OAuth belongs to a separate guest identity.

The system treats one VM as one agent identity: --backend names the agent and Torio finds its box, so a second backend means a second VM rather than two identities contending over the same checkouts. Inside the VM, the agent runs without permission prompts, with controls it cannot reach: an unprivileged identity with no sudo, a binary it cannot rewrite, no operator write credential, and the edge of a VM. The host CLI creates and verifies the VM, installs the backend, and records non-secret instance and project configuration.

The VM is a Lima instance created from a pinned template, with pinned backend dependencies and reconciliation that does not touch user data. Projects are repository clones on the VM's Linux filesystem, and sessions are opened with torio project enter or the hub; torio project shell is used when pushing. Torio does not store credentials on the host, opens no public port, never pushes, merges, tags, or releases, and never deletes or re-images a VM.