# Host System Changes

Use this file when deciding whether a change belongs to the host.

## Host-owned changes

Examples:

- `gateway_enable="YES"`
- `net.inet.ip.forwarding=1`
- `service pf restart`
- `service netif restart`
- `sysrc ifconfig_bridge0_name="warden0"`

## Why this separation matters

- host failures should not be misdiagnosed as jail failures
- agents need one place for machine-wide state changes
- Warden skills should focus on their domain instead of becoming generic host admin guides
