calettalabs
cove docs

Run a clean Mac, keep the evidence, discard the child.

cove is a local CLI for macOS and Linux VM runs on Apple Silicon. The current private-review surface installs a base, forks known state, runs agent or CI workloads, and collects the resulting artifacts.

Install

The public package channel is Homebrew where available. Source and private release review are available on request while the public registry and signed-channel gates remain closed.

brew install tmc/tap/cove
cove version

First run

Create a macOS guest, provision a user, and boot the desktop. The host must be Apple Silicon running macOS 14 or later for the current macOS guest path.

cove up -user me
cove run

Linux guests are beta and cover Ubuntu, Debian, Fedora, and Alpine. Nested KVM and desktop flows are available on supported M-series hosts.

cove up -vm ubuntu-gui-kvm -linux -desktop -nested \
  -cpu 4 -memory 8 -user ubuntu -password ubuntu \
  -vzscripts kvm-test -no-shutdown

Fork and reset

The safety story is fork/restore, not user-account cleanup. Start from a known parent, run the workload in a child, and delete the child when the run is done.

cove image build -from base-vm -tag macos-15:clean
cove run -fork-from macos-15:clean -ephemeral

Published local evidence for a stopped parent is 132-140 ms fork time on an M4 Max, with boot-to-agent evidence around 10.8 s for the measured parent.

Guest commands

cove shell runs one-shot commands or an interactive shell through the guest-control path. Secret values can be resolved host-side and redacted from run logs.

cove shell macos-15 -- uname -a
cove shell macos-15 --secret-env TOKEN=env://GITHUB_TOKEN -- ./ci.sh

Artifacts

Forked runs produce local evidence under ~/.vz/runs/<run-id>/: manifests, event rows, stdout/stderr, screenshots, and exported traces when enabled.

cove runs list
cove runs show <run-id>
cove support bundle -vm macos-15

Current boundaries

  • Registry gate. Local/private image transport exists; a public curated registry and signed channels are on the roadmap.
  • Soft reset. The measured soft-reset path failed as an isolation primitive. Use fork/restore for privacy-critical work.
  • Fleet scope. cove currently provides a local Mac runtime with run evidence. Broad Mac fleet orchestration remains outside the claim.

Need the full private docs, shipped-surface notes, or source review? Email travis@tmc.dev.