Concepts · 3 of 4

Code a model just wrote, contained from the first instruction.

This is for computations, not questions. A cell exists to contain code you'd rather not run unsealed — if nothing executes, there's nothing to protect you from, and asking the model directly is the right tool for that. This is the tutorial for celln agent: what runs, how it's attested after the fact, and exactly what authority it gets.

What "agent lane" means

Agent-authored code is never tool-lane authority, at any tier, no matter how it was produced. It gets only what's explicitly loaned to it: its own executable and a writable workspace, nothing else by default. This is a permanent property of who wrote it, not a temporary trust level that compiling or attesting can raise.

Have it write something

$ celln agent "print the first 100 primes, space separated"
● asking anthropic (claude-opus-5) to build: print the first 100 primes, space separated
  · waiting for claude (up to 90s; --timeout changes it)
  · replied in 5s
  · selected sealed runtime: Rust 2021 (static musl); 23 source lines  /tmp/celln-agent-1844068/program.rs
  + rebuilt, reproduced  blake3:c0d7ceb8247d62bee808d6dc84b1ea57abeb7c16c95e46b5dc126f9abacd40b7  436 KiB  tier=forged author=agent
  · cell sealed, tools lent read-only
  ✔ pilot: /agent/program permitted:agent

2 3 5 7 11 13 17 19 23 29 31 …

--show-source prints what the model actually wrote, before it runs. The program ran in the agent lane — note the log line says tier=forged author=agent together. It earned a real tier through a real rebuild-and-compare; it is still, permanently, author=agent, and that's what decides its authority, not the tier.

Forging and attestation are not the same claim

The model writes the program on the host. forge compiles it twice, in different directories, and compares the resulting bytes. If they match, assay grades it forged and records the recipe; if not, it's verified instead — the rebuild established reproducibility on this machine and toolchain, nothing more, nothing about correctness or safety. Compiling is not a way around the laundering ban: rustc fed model-written source is python fed model-written source with the interpretation step moved earlier. If the laundering ban stops one, it has to stop both — and it does. See the interpreter flag for the tool-lane side of that same rule.

Choosing who writes it

Backends are subprocess adapters over CLIs you've already authenticated — claude, codex, ollama — or a plain API call for DeepSeek. Celln never reads, stores, or forwards a credential; it stays on the host, and cells have no ambient network, so it never enters the guest either.

$ celln setup                         # finds a provider CLI and materialises the default tool images
✔ default provider: openai (~/.config/celln/config.toml)

$ celln providers
  ✔ anthropic  claude-opus-5          claude
  ✔ openai     (cli default)          codex  default
  ✔ local      qwen2.5-coder          ollama

$ celln providers --set-default anthropic # change the saved default
$ celln agent --provider openai "…"    # override it for one invocation
$ CELLN_PROVIDER=local celln agent "…"    # override it for one shell command

celln agent "…" is for work that generates code to run — that's the path Celln seals and governs. --tool python runs the model's program with a lent interpreter instead of forging a Rust binary.

Network is brokered, never ambient

A cell has no in-kernel network stack. Network-shaped work has to declare exactly where it may reach before the model is even called:

celln agent --allow-host example.com "crawl https://example.com/…"

Without --allow-host, Celln returns Unsupported rather than generating a crawler that can never connect. When it is granted, Pilot passes the request over vsock and the host performs the fetch; private addresses and redirects that leave the declared destination are refused. Getting the model provider itself into a cell is the same egress problem as any other network access, and gets the same answer.

What's actually enforced

Landlock rejects filesystem access outside the program's own executable and its writable workspace.
Seccomp rejects network and privilege-escalation syscalls outright — the brokered fetch above happens through Pilot, not through a guest-visible socket.
The generated program is always author=agent; a real, reproducible build can raise its tier, never its authority.
Nothing crosses the boundary except brokered bytes — a credential never enters the guest because the guest never has a way to send one anywhere.

Full detail, including what this does not claim: the security boundary.