Specific guarantees, not a magic sandbox.
Celln makes different promises for declared tools and agent-authored code. It refuses to claim a hardware property on a host that cannot provide it.
What is enforced in a KVM cell
- Declared tool code is read-only from inside the guest after stage-2 sealing.
- Execution is gated by content hash against a signed manifest.
- Tool code is not writable by the guest, including a privileged guest trying its own page tables.
- Warden enforces an authority ratchet: rights can shrink, never expand.
- Removing a mapped tool revokes it from a running cell.
Agent-authored code
celln agent creates a real sealed KVM cell. The generated program is always author=agent and runs in the agent lane: only its executable and writable workspace are loaned. Landlock rejects other filesystem access; seccomp rejects network and privileged syscalls. Compiling model-written source does not promote it to tool-lane authority.
Network is brokered
A cell has no in-kernel network stack. For a named HTTPS destination, use --allow-host example.com, or in a spec [cell] allow_hosts with a tool declaring builtin = "fetch". Pilot passes the request over vsock and the host performs the fetch; private addresses and redirects that leave the declared authority are refused.
What Celln does not claim
- It does not claim hardware isolation without Linux,
/dev/kvm, and a readable kernel image. - It does not make agent-authored code a verified host tool.
- It does not grant ambient network access, package installation, or a general-purpose Linux distribution to a cell.
- It does not remove the need to trust the host, the configured agent CLI, or the verified tool supply chain.
Verify on your own host
celln doctor celln verify make acceptance-kvm make bench-kvm
The acceptance check drives setup, generated code, its in-cell boundary, and celln ps -a using a deterministic local model stub. On a suitable host, the hardware checks include guest code that attempts forbidden operations; they are not host-side assertions alone.