AI coding agents hand commits to CI agents that make decisions while the job runs. On macOS and iOS, each CI agent needs a fresh VM per commit and a network boundary that limits what it can reach.
Meet macOS VM compliance requirements with Anka: block local for VM-to-VM and VM-to-host isolation, --no-local for a hard cut from the host, ARP spoofing prevention, and ipf-style IP filters on shared networking.