Services, secrets, and analysis

Service Cell

A Service Cell runs an approved task or application independently from the agent. Its code comes from a sealed revision or pinned artifact, and its launch behavior comes from an approved Run Target.

Example: a backend runs in a Service Cell while an Agent Cell tests its HTTP endpoint. The backend can use an authorized database secret without revealing that secret to the agent. A secret-bearing Service Cell has no agent, interactive shell, or debugger attached while its secret lease is active.

The service can continue after the agent disconnects. Updating its code or admitted settings creates a new service generation rather than letting the agent rewrite a running secret-bearing environment.

A Cella Service is the named service identity and endpoint contract. A Service Cell is a runtime that can implement that service. A Connected Service is an explicitly enrolled service outside a managed Cell; enrollment does not make its external execution Cella-contained.

Further reading: Service runtime and data.

Analysis Job Cell

An Analysis Job Cell runs a bounded task against explicitly granted data. It separates data analysis from the coding agent's workspace and from a live service's storage.

Example: an approved job reads a selected database snapshot and produces a classified report. The agent receives an authorized report artifact rather than automatic access to the raw database or the service's writable volume.

Project secrets: application runtime configuration

A Project Secret Set holds explicitly imported application runtime values outside the repository ingress and every Agent Cell. The Project Secret Boundary controls their storage and projection.

A Secret Runtime Binding authorizes a specific set for an exact eligible runtime generation, target, scope, and lifetime. Application secrets are separate from the provider Connections Gateway uses for external Effects.

Example: a Service Cell receives an approved database configuration. The Agent Cell can exercise a permitted application endpoint without receiving the secret or access to the service's process memory.

Further reading: Service and secret boundaries.