kastellanRust development
Workers, channel adapters, and the macOS sandbox-parity work. The codebase is a 27-crate workspace with a strict no-unsandboxed-spawn rule.
Help hold the walls
A security-first project needs adversarial eyes as much as feature hands.
Security review
Red-team the sandbox policies, the threat model, the egress proxy. Finding a hole is a contribution, not a nuisance.
Docs & testing
The onboarding manual, cross-distro testing, macOS coverage. If a setup step surprised you, that’s a bug in the docs.
Ideas & issues
Design discussions and issue triage happen in the open on GitHub. Issues →
Build it in three commands
git clone https://github.com/hherb/kastellan
cd kastellan && cargo build --workspace
cargo test --workspaceUbuntu 24.04+ needs one extra step — an AppArmor profile so bubblewrap can create user namespaces (sudo scripts/linux/install-bwrap-apparmor-profile.sh). macOS works out of the box. Without that profile, sandbox tests print [SKIP] and still report green — so run scripts/run-e2e-gate.sh --list to see the gated tiers that demand their fixtures. Release builds go through one script, bash scripts/build-release.sh, so every consumer sees the same bytes.
House rules
- AGPL-3.0, and AGPL-compatible dependencies only — license hygiene is part of the security boundary.
- Linux and macOS are both first-class: no platform-specific feature lands without a counterpart of equivalent guarantee.
- Every worker is sandboxed before it runs. There is no unsandboxed escape hatch, and reviewers refuse PRs that try to add one.
- A green run is not evidence until you know what ran: skipped tests count as passes, so gated suites ship with a REQUIRE knob and a positive control that fails when zero tests ran.
- The repo’s handover convention (docs/devel/handovers/) means any contributor — or any AI session — can pick up exactly where the last one left off.
Start with the repo:
github.com/hherb/kastellan