ACTIVE AGENTRUNNING
P
page-reader
Read a page and inspect an unexpected instruction.
Context provenanceUSER
Tool budget remaining6 calls
SUPERVISION, MADE VISIBLE
Give agents room.
Keep the boundaries.
See what happens when an external instruction meets an exact capability and a human decision.
EXTERNAL CONTEXTFIXED FIXTURE
↗ fixtures.praesidionyx.invalid/injection
A harmless-looking article
Useful information from an external source.
Reading makes the context untrusted.
TOOL REQUESTfs.write
Start by reading the external page, then attempt the requested write.
WRITE CAPABILITY
Exact write authority.
The agent may write one exact path. A supervisor approval cannot expand it.
- Tool
- fs.write
- Resource
- notes.txt
- Delegation
- Root grant
SUPERVISOR DESKNO REQUEST
Your decision, precisely scoped.
An untrusted write is held here until you decide. Approval authorizes one exact retry.
Five-minute expiry · context-bound · one useSIMULATED WORKSPACE
No files written yet.
DECISION TRACE Local browser events · unsigned
- Actions and decisions will appear here.
This playground simulates policy. Real namespace, Landlock, seccomp, cgroup and signed audit checks run in the Linux runtime. See recorded evidence →
CONTEXT IS A RESOURCE
Page the data.
Keep the provenance.
Memory rollback restores context pages. It never restores an earlier trust level, authority or tool budget.
RESIDENT CONTEXT0 / 3 PAGES
Three page slots. Older pages move out as new ones arrive.
STICKY PROVENANCE
User context
New external pages mark the agent untrusted, even after those pages are evicted or a previous snapshot is restored.
- Resident pages
- 0
- Stored history
- 0
- Snapshots
- 0
The runtime uses SQLite and sqlite-vec, deterministic lexical retrieval, and byte-based context estimates. This view illustrates paging with three fixed slots.
FROM THE REAL LINUX RUNTIME
Evidence you
can replay.
A credential-safe recording of seven offline demos, followed by verification of the signed audit chain.
—Rust checks passed locally
7End-to-end demos
0Live model calls required
Loading recording…
What this recording establishes
Exact capability rejection, supervised injection denial, approved research output, memory paging, child scope, scheduler controls and signed audit verification. Dedicated Linux tests separately exercise actual confinement and cancellation.
Verified locally on Apple Silicon / Docker Desktop. The project is a local kernel/API MVP. It makes one initial provider completion; SDK programs drive subsequent actions. It does not claim an autonomous planner or a production multi-tenant boundary.
THE BOUNDARY IS THE PRODUCT
A small kernel.
Explicit authority.
Models propose actions. The operating layer checks authority, provenance, budgets and confinement before tools act.
01 · AGENT
SDK + private session
The model cannot mint capabilities or clear provenance.
02 · KERNEL
Capability + policy gate
Exact scope, sticky taint, budget and one-use approvals.
03 · TOOL
Disposable Linux worker
MCP over a private pipe with layered confinement.
HUMAN SUPERVISION
A separate door for decisions.
Supervisor and agent APIs use separate keys and Unix sockets. Approval binds the agent, arguments, capability digest and context revision; it cannot widen authority.
LINUX CONFINEMENT
Controls must actually work.
Seven namespaces, Landlock V3, a seccomp allowlist and CPU/memory/PID cgroups. Startup probes disable tools if mandatory enforcement is unavailable.
DURABLE ACCOUNTABILITY
Signed before effects.
Canonical JSONL, SHA-256 chaining, Ed25519 signatures and a signed local checkpoint. Emergency tree cancellation still proceeds when audit storage fails.
RESOURCE CONTROL
Budgets follow the tree.
Children reserve parent budgets and inherit narrower tool scope. Parent termination cancels descendants. Paging and rollback preserve taint and consumed budgets.
Run the full runtime locally.
Clone the repository, start Docker Desktop, then run:
python3 scripts/quickstart.pyRead the threat model and security notes for the current limits.