Concepts

Four ideas, in the order you'll need them.

Celln has a small vocabulary and it means something specific every time. Start with the model, then the two lanes an executable can run in, then the boundary those lanes are enforced by.

The really simple version, before any of the jargon: tool lane is borrowed, agent lane is born. A tool-lane program already existed on the host and someone checked it out before you got here — like borrowing a friend's car, you trust it because you know where it's been. An agent-lane program is code the AI just wrote, seconds ago, for this one task — like a stranger who just built a car in your driveway. It might be great. Nobody's checked. So it starts with almost no keys to anything, until it earns more.

One cell can carry both lanes at once — an attested interpreter and the agent-written file it's fed — the lane is decided per invocation, not once for the whole cell. See the interpreter flag for exactly when that split happens.

1. The model →

Mote, cell, assay, warden, pilot — the five terms and the one lifecycle they describe.

2. Tool lane →

A host-verified tool — a digest-pinned image, a static binary, or a brokered capability — lent read-only into a cell. Where the trust comes from, and how celln run uses it.

3. Agent lane →

Code a model just wrote, sealed and run with narrower authority. Where forging and the laundering ban fit in.

4. The security boundary →

What's hardware-enforced, what's brokered, and what Celln explicitly does not claim.

The one-sentence version: a tool the host already vouches for runs in the tool lane; anything a model just wrote runs in the agent lane — and an interpreter fed agent-written input is demoted to the agent lane too, so compiling or interpreting model output is never a way to launder it into tool-lane trust.