Agent isolation

Current status: partial. Authenticated control and local lifecycle/shell pieces exist. The live target-host and role-specific protection gates remain open.

Wall enforces the execution boundary of a Cell. Only enrolled cellad can ask it to create, inspect, stop, or destroy an admitted generation. The agent cannot choose host paths, arbitrary mounts, runtime sockets, or containment settings.

Isolation and resource limits

The initial asserted isolation target is gVisor/runsc on Linux, under the installed Debian runtime stack. Other runtimes must satisfy an explicit profile; a weaker development runtime must retain non-production status and refuse protected repositories instead of silently downgrading them.

The required profile includes a non-root UID, read-only root filesystem, dropped Linux capabilities, no-new-privileges, bounded temporary storage, and CPU, memory, process, I/O, time, and disk limits. Host home directories, sibling repositories, SSH agents, Docker sockets, devices, broad bind mounts, and inbound ports are not inherited. The privileged runtime helper remains narrow; cellad never receives unrestricted runtime authority.

Authenticated control and failure behavior

The Debian control contract requires a fixed root-created Unix socket, kernel peer credentials (SO_PEERCRED), dedicated service accounts, per-installation Rustls mutual TLS, exact service ALPN, and one controller lease. Wrong peers are rejected before application decoding. Transport authentication still does not replace method policy or the installed Cella Security Floor.

A limit violation stops or throttles the Cell and records its cause. Stop revokes capabilities and network identity before teardown. Destroy removes private writable artifacts according to retention policy. Required hostile tests cover traversal, namespaces, mounts, processes, exhaustion, wrong peers, replay, key rotation, controller takeover, socket replacement, and pre-decode failures.

Example: an agent may change its private src/server.go; a request for the host's ~/.ssh/id_ed25519 does not acquire a host filesystem route.

See Wall security, protected Cell contract, and runtime substrate.