Enforcement kernel
Quiet Open-Core v1.2.0: frozen /v1 decision pipeline, Cedar policy, Slack approvals, MCP gateway, Docker sandbox, and hash-chained audit — Mode A public package baseline when tests pass.
Enforcement kernel
The decision path, deep-dive
How the fail-closed pipeline works: intercept → decide → execute or block → record evidence. Public ship identity is Quiet Open-Core v1.2.0 — this page is the kernel story and playground.
Mode A: Quiet Open-Core v1.2.0 · Stage 1 done · Stage 3 not public baseline · ship rule: tests pass = done · see /v1
Looking for the release celebration page? ActantOS Quiet Open-Core.
Build goal
No agent action executes without an ActantOS decision. Stage 1 is the enforcement kernel every later feature depends on. If this layer cannot block, approve, execute, and audit tool calls reliably, nothing else matters.
Stage 2 control-plane surfaces may be locally implemented. Stage 3 governed autonomy is not the Mode A public baseline and is not production-qualified without Mode B evidence. Memory vault and full managed multi-tenant SaaS packaging remain future. No partner verification gate.
Verification
What the MVP proves
Success criteria
guarded_read(".env") → denied
guarded_bash("git push") → approval_required
Decision endpoint returns allow / deny / approval_required
Manual approval creates a one-use token
Approved command executes in Docker sandbox
Every step appears in the audit log- StageQuiet Open-Core
- Releasev1.2.0 Mode A baseline
- Ship ruleTests pass = done
- Daemon portlocalhost:3100
npm run demo -- --url http://localhost:3100
Playground
Try the decision API
Explore sample intercept responses — no local daemon required.
Non-credential README read receives allow with a decision_token.
POST /v1/intercept/tool-call — request
{
"request_id": "demo_allow_01",
"tenant_id": "t_demo",
"agent": {
"id": "pi_demo",
"runtime_type": "pi",
"environment": "dev",
"risk_tier": "low"
},
"tool": {
"name": "guarded_read",
"kind": "file",
"schema_hash": "sha256:..."
},
"resource": {
"id": "/workspace/README.md",
"kind": "file",
"path": "/workspace/README.md"
},
"normalized": {
"verb": "read",
"mutation": false,
"destructive": false,
"network": false,
"credential_access": false,
"risk_class": "low"
}
}Response
{
"decision": "allow",
"decision_mode": "enforce",
"reason_code": "allowed",
"decision_token": "eyJ...signed.hmac...",
"constraints": {
"timeout_ms": 30000,
"network_mode": "none"
}
}Sample responses from the enforcement demo. Full API reference →
Components
What's in the build
actantosd
The enforcement-kernel daemon. Exposes the decision API on port 3100, runs kill-switch and budget checks, evaluates Cedar policy, and issues signed decision tokens.
Pi guarded adapter
Wraps Pi file and shell tools with guarded_read and guarded_bash. Every call normalizes into POST /v1/intercept/tool-call before execution.
MCP policy gateway
Routes MCP clients through ActantOS. Pins tool manifest hashes, blocks SSRF targets, and intercepts tools/call before forwarding to upstream servers.
Cedar policy engine
AWS Cedar evaluates RBAC and ABAC rules behind a PolicyDecisionProvider abstraction. ActantOS maps results to allow, deny, or approval_required.
Docker sandbox
Allowed shell and file operations execute in an isolated container with network constraints. The MVP uses Docker; gVisor and Firecracker follow in later phases.
Postgres audit chain
Every intercept, decision, and tool result is recorded in a hash-chained audit log. Session timelines expose request_id, risk_class, and result hashes.
Demo story
End-to-end flow
Run npm run demo -- --url http://localhost:3100 against a local actantosd to exercise the full pipeline. See the quickstart guide for setup.
Safe read
A non-credential file read receives decision=allow with a short-lived decision_token.
Credential block
Reading .env is denied with reason_code=policy_forbid.credential_path. Credential access is always deny, never approval.
Approval required
git push returns approval_required with an approval_id. The agent pauses until a human decides.
Manual approval
An approver calls POST /v1/approvals/{id}/decide. The adapter re-submits with a one-use approval token.
Audit timeline
GET /v1/sessions/{id}/events returns the full hash-chained timeline for forensic review.
Kill switch
Activating a kill switch immediately denies all tool calls for the scoped agent or tenant.
Stack
MVP technology
- TypeScript + Fastify + Zod
- Postgres with Kysely
- AWS Cedar (cedar-policy-cli 4.11.2)
- Docker Compose for local development
Non-goals
Not in this release
These are deliberate MVP exclusions. The enforcement kernel must be proven before enterprise features ship.
- Enterprise memory vault (audit evidence is not a memory vault)
- Firecracker microVM runtime (gVisor/runsc is the intended hardened path)
- Full multi-tenant managed SaaS control plane as a commercial product
- Artificial open-core seat limits on the free Enforcement Kernel
- Stage 3 / v1.1.0 as Mode A public maturity baseline
- Production-qualified multi-tenant platform without Mode B evidence
Roadmap
From kernel to platform
Three stages: prove enforcement, scale the control plane, deliver governed enterprise autonomy. v0.1.0 ships stage one.
Agent Runtime Control Plane
Operator visibility, policy ops, multi-channel webhook approvals, OIDC ops auth, and single-tenant hosted path with health probes. Locally implemented engineering, not a higher public maturity than Quiet Open-Core.
Governed enterprise autonomy
Tenant foundation, fail-closed gVisor isolation, STS credential broker, Object Lock evidence archives, and durable SIEM connectors. Not Mode A public baseline; production-qualified multi-tenant platform remains Mode B conditional.
Stage 1 done · Stage 2 done
Get started now
Quiet Open-Core v1.2.0 and Stage 2 control-plane ops are live. Run the kernel locally, keep tests green, and use ops dashboards for day-2 work.
Run it locally or request a walkthrough
Start with Docker Compose and the demo script, or book a session to see the enforcement kernel against your agent stack.