Documentation Index
Fetch the complete documentation index at: /llms.txt
Use this file to discover all available pages before exploring further.
What the kernel defends against, what it assumes, and what it does not claim
| Architecture | Defenses for every trust boundary in the kernel. |
| Implemented today | Each defense is labeled below as on main or design. |
| Active path | Per defense. |
| Public exposure | — |
| Threat | Defense | State |
|---|---|---|
| Executor bypasses policy through its own auto-approve mode | Allternit policy gate on work-bound executor paths (converging), plus the recorded execution environment | Partial: work-bound paths only; env stripping opt-in |
| SSRF through a tool | Default-deny policy, shared egress guard with private-address, redirect and rebinding checks | On main (internal) |
| Secret leakage through inherited environment | Environment allowlist, no raw inheritance, secret references | On main (internal) |
| Model declares itself done | Verifier-owned completion | On main for agency-origin work |
| Prompt injection from retrieved or predecessor content | Trust classes, nonce fencing | Partly on main; compiler enforcement is design |
| Repeated external effect on retry | Idempotency key plus durable action receipt | On main for effect receipts (internal) |
| Unreviewed autonomous decision | S1 is shadow by default; a primitive acts only after passing the gate, inside a budgeted, audited canary with automatic rollback | On main |
| Tampering with history | Signed, append-only receipt chain | On main (internal) |
| Part | Status |
|---|---|
| Policy gate (work-bound executor paths, converging), egress guard (web proxy and design connector import), recorded environment (env stripping opt-in) | ENABLED on those paths · INTERNAL |
| Continuous conformance testing of defenses | IMPLEMENTED (kernel-level security conformance tests on main) |
Documentation
Plugins & MCP Apps
API Reference
SDK