Execution contract
Policy before process
broker or operator request -> validate non-empty argv -> require allow_exec -> require a bare command name -> require command allow-list membership -> validate working directory -> construct child environment from empty -> apply timeout and optional POSIX resource limits -> execute in a separate process group -> return ExecResult JSON Optional local-model path: manifest + existing weight file + size and sha256 verification -> offline local runner -> buffered JSON or additive JSONL streaming
Source-first evidence
Why this is a card, not a simulated product
| Surface | Evidence | Limit |
|---|---|---|
| Safe execution core | Public Python source, policy schema, CLI, threat model and adversarial-review history | Not a kernel or container isolation boundary |
| Environment and network posture | Empty child environment, allow-listing, secret-name filtering, proxy removal and offline signalling | Network isolation is best-effort environment-level neutralisation |
| Resource controls | Wall-clock timeout, process-group cleanup and optional POSIX rlimits | Filesystem access is not jailed and command identity is not hash-pinned |
| Local inference | bls infer, llama.cpp-family runners, fake runner for CI and additive JSONL streaming | Weights are operator-fetched; Ollama and Transformers remain deferred |
| Verification | README receipt records 286 passing tests at implementation head 19091b1; current head contains later documentation cleanup | No test rerun was performed for this static evidence card |
Source-first rule: the public repository is the canonical proof. This page only provides recruiter orientation and direct links; it does not replace the README, manual, threat model, CI or test source.
Honest security posture: this is a bounded process guardrail for a trusted caller, not a hostile multi-tenant sandbox. The source explicitly documents the missing filesystem jail, best-effort network posture and unpinned executable identity.