# Plumber hardener

Run `av harden plumber` to apply this hardener and `av doctor plumber` to verify it.

`av harden plumber` installs the signed Plumber Isotope and migrates the
complete local config into one Automic Vault Secret. If the on-disk
`~/.batchsh/plumber.json` exists, it contains only a fixed, non-secret custody marker.

The patched Target routes local config reads and writes through dedicated
Plumber-only XPC operations. Each operation binds the live Target, complete
arguments, fixed local-config scope, and exact Secret Name. Plumber cluster-mode
KV storage is unchanged.

Invalid or oversized JSON, unsafe paths, unsigned or incorrectly signed Targets,
source drift, and unexpected archive contents fail closed.