terret

https://github.com/terret-org/terret

The meta-gem, and the way a Terret is composed. Bundles ship ordered config rows, profiles stack bundles, patches adjust rows by id, and Terret.boot hands the result to the Hames loader -- so which plugins run, in what order, with what config is a question YAML answers rather than Ruby. Ships terret-base (the log, the harness, the model seam, the execution world sandboxed with the network denied, the standard tool roster, and a policy floor that starts closed), the headless profile template, and trt: boot, dump-config, doctor.