Where Kastellan stands

Development phases, in build order

• Phase 0 — A core that can jail things SHIPPED

  Cross-platform kernel sandboxing (bubblewrap + Landlock + seccomp on Linux, Seatbelt on macOS) with negative tests proving that denials deny. JSON-RPC workers, service supervision, Postgres with an append-only audit log.

• Phase 1 — Memory & the agent loop SHIPPED

  Three-lane memory recall (semantic, lexical, graph), the task scheduler, CASSANDRA plan review, a prompt-injection guard on worker output, encrypted secrets, and an operator-approved skill system.

• Phase 3 — Web egress SHIPPED

  Web search, web fetch, one-call web research, and a read-only mail-archive tool shipped behind host allowlists. The egress proxy — the single chokepoint all worker traffic is forced through — force-routes every networked worker by default (private netns, no direct route), terminates and inspects worker TLS, scans the cleartext for the worker’s own secrets, and pins server certificates; an operator-configured extra CA can admit exactly one private TLS origin. Optional micro-VM isolation (Firecracker on Linux, Apple container on macOS) wraps networked workers end to end. Remaining: wiring the proxy to the first frontier-egress worker.

• Phase 2 — Channels IN PROGRESS

  Matrix — self-hosted, single-user, federation off, end-to-end encrypted — is live end to end: the sandboxed Matrix client, peer pairing, and the message bus have all shipped. The email failover’s inbound half shipped too, off by default and gated hard (a DMARC verdict from your own mail server plus a per-pairing token in the body). Remaining: outbound email replies (SMTP) — until then email is receive-only. ← currently being built

• Phase 4 — python-exec & agent-authored skills IN PROGRESS

  Python in the strictest jail of any worker — no network, ephemeral scratch only, curated stdlib — shipped and acceptance-green on both Linux and macOS, with an optional Firecracker micro-VM boundary on Linux. Agent-authored Python skills already run through an operator-approval lifecycle (crystallise → approve → pin → invoke); the tiered delegation policy follows.

• Phase 5 — Frontier escalation & hardening PLANNED

  A policy gate deciding when a frontier LLM may be consulted (TLS pinning for that egress path is already built), and a 7-day adversarial soak test.