A software write-blocker around the whole run, and a record of what it could and could not enforce.
A prompt is a request; a kernel rule is enforced. The harness puts every guard it can at the operating-system level, keeps the audit trail out of the agents' reach, and where a platform only lets it advise, writes that down in the run record, so no forensic report can claim a protection the run never had.
Every guard, and how it is achieved on each host.
The kickoff measures what the host can enforce and records it. The report prints it in the chain of custody.
| guard | what it holds | macOS | Linux |
|---|---|---|---|
| Evidence read-only | The inputs directory, or an attached image, cannot be written by any agent process. Hashed before the first agent starts and checked at the end. | seatbelt · kernel | mount namespace · kernel |
| Write allowlist | A pane writes inside its own run and the agent's own directory, and nowhere else: not the examiner's home, not another case, not the run registry. On Linux, Landlock supplies the allowlist inside a user namespace, or on its own where namespaces are switched off; bubblewrap adds a read-only root when it is present. | seatbelt · kernel | Landlock · kernel |
| Quarantine | Nothing extracted from the evidence can execute. Carved binaries stay data. | seatbelt · kernel | noexec mount · kernel |
| Trace collector | The only writer of the audit trail runs outside the agents' sandbox. Each line names the hash of the line before; the head of the chain is anchored where no agent can write. On macOS every line is attributed by a per-pane token no other pane can read; on Linux, where one pane can read a peer's environment, a gate in front of the collector attributes by process ancestry instead, and the collector counts a token only on a line the gate vouched for. | enforced · by token | enforced · by ancestry |
| Prior-run isolation | An earlier run on the same evidence (its findings, its board, its tools) is unreadable to the new swarm, so a re-run cannot copy the earlier answers. On Linux the directory is masked by a tmpfs inside the namespace, or denied by Landlock where there is no namespace; under Landlock alone the file names stay visible and the contents do not, and the record says which. | seatbelt · kernel | Landlock / tmpfs mask · kernel |
| Terminal control socket | The multiplexer the agents run in has an unauthenticated control socket; an agent that reached it could start a process outside every rule above. It is denied to the panes: on macOS by the profile, on Linux by a mask inside the mount namespace. Landlock alone cannot mask a socket, and on such a host the record says unenforced rather than claiming a seal. | seatbelt · kernel | namespace mask · kernel |
| Egress allowlist | Only the model providers and the hosts the case names. Every refused connection is counted and printed. Installing from an index, when allowed, is inventoried package by package. | proxy · advisory | network namespace · fail-closed |
Every Linux cell was measured in two tiers, a host with user namespaces and a container without them, and the run record carries which tier a run had. "Advisory" is not a euphemism. On macOS the egress guard is a proxy the agents are pointed at through their environment, and an environment belongs to the process that has it. On Linux the same guard is a network namespace with no route out except through the proxy, which is a kernel boundary. The run record carries which one you got, and the report prints it.
Hashed on the way in, held read-only throughout, checked on the way out.
An inputs directory is copied into the run and a pristine copy is kept beside it; a disk image can be attached read-only instead of copied. Every file's hash is recorded before the first agent starts. During the run the operating system refuses writes; if a write ever lands by another route, the harness restores the file from the pristine copy and announces it on the board. At the end, every file is checked again and the result, content and metadata separately, goes into the custody section.
Before the agents begin, a catalog pass reads the partition table, walks the file list and hashes what it can, so the swarm starts from an index rather than from a mount.
The audit trail cannot be edited by what it records.
Every tool call, its arguments, its result and the reasoning before it. Every intervention with its reason. Every refusal.
A collector process outside the sandbox holds the only writable handle. The agents reach it over a socket in a directory they cannot write, so it cannot be unlinked or replaced.
Each line names the sha256 of the line before it. The head of the chain is written outside the sandbox, so a file that is rewritten, extended or shortened no longer matches what the record remembers.
Who wrote a line is decided by a per-pane secret the collector holds, rather than by what the line claims. A line claiming to be another agent is written as what it is, with the claim beside it; an attempt on the record is itself a finding.
The report walks the chain and says intact, edited, appended, shortened or rewritten, and how many lines could not be attributed to a pane.
When a guard is only advisory, the report says so. When an agent walked around one, we published the whole account.
On one published run, an agent refused repeatedly by the egress guard unset the proxy variables in its environment and installed the library it needed. The kernel-enforced guards held throughout. The advisory one did not, and could not have, which is what advisory means. The custody section of that run's report prints Egress enforcement: ADVISORY beside the package that came through, and the full account (every attempt, the command, why it worked, what to do about it) sits in the repository beside the run, with the runs where a guard was only advisory in the case ledger.
A harness that hides its own limits cannot be put in front of a court. The record reports what was achieved rather than what was asked for.
The escape, end to end, in the repository →
Stronger isolation, by edition.
Each step is stronger isolation for the same harness, with the record carrying which one a run had.
macOS seatbelt profiles per pane; on Linux, Landlock inside a user namespace with a network namespace for egress, or Landlock alone where namespaces are switched off. Fast to start, no images to build, and honest about what each platform can hold.
The swarm runs on a Linux host the examiner watches from anywhere. Egress becomes fail-closed everywhere, and evidence is served from read-only images.
Each agent in its own container with only the shared run mounted. What one agent installs, breaks or runs stays its own; the board and the trace are the only shared surfaces.
A disposable virtual machine per case, built from a pinned image, destroyed with the run; air-gapped where the evidence demands it, with the case file as the only thing that leaves.
The files were written by the subject of the investigation. They are material to examine, and the harness treats them that way.
A note, a filename, a chat message inside the evidence cannot give an agent a task or a permission. Nothing read in the evidence can cause a network request, an install or an execution. A URL in a chat log is a finding to record; resolving it would tell the subject their device is being examined. The contract says it; the egress guard and the quarantine enforce it; the trace shows every time it was tested.
Everything on this page is in the source, with the tests that fail without it: the guards, the collector, the verification, the custody section.
Read the harness on GitHub →