Wall and isolation

Wall: execution enforcement

Wall owns the privileged runtime boundary. It admits generations using installed profiles and controls isolation, lifecycle, resources, and inspection. The Wall Profile identifies the required enforcement contract.

Wall does not own GitHub integrations, provider credentials, or business approval. Its job is to enforce the admitted execution boundary.

The first runtime target uses containerd and gVisor on Debian. The sandbox technology is infrastructure beneath Cella; an alternative backend must satisfy the same required enforcement and qualification contract. A protected claim requires evidence for the exact admitted generation.

Further reading: Wall security model and protected Cell contract.