Where Kastellan stands

Development phases, in build order

• Phase 0 — A core that can jail things SHIPPED

  Cross-platform kernel sandboxing (bubblewrap + Landlock + seccomp on Linux, Seatbelt on macOS) with negative tests proving that denials deny. JSON-RPC workers, service supervision, Postgres with an append-only audit log.

• Phase 1 — Memory & the agent loop SHIPPED

  Four-lane memory recall (semantic, lexical, graph, entity-similarity) fused by rank — with layer gates so operator rules and approved skills reach the prompt only through their own blocks, never through recall. The task scheduler, CASSANDRA plan review, a prompt-injection guard on worker output, encrypted secrets, an operator-approved skill system, and a one-command supervised installer (kastellan-cli install: Postgres + the agent under systemd --user or launchd, no root).

• Phase 3 — Web egress SHIPPED

  Web search, web fetch, one-call web research, and a read-only mail-archive tool shipped behind host allowlists. The egress proxy — the single chokepoint all worker traffic is forced through — force-routes every networked worker by default (private netns, no direct route), terminates and inspects worker TLS, scans the cleartext for the worker’s own secrets, and pins server certificates; an operator-configured extra CA can admit exactly one private TLS origin. Optional micro-VM isolation (Firecracker on Linux, Apple container on macOS) wraps networked workers end to end, including the browser worker. Remaining: wiring the proxy to the first frontier-egress worker, and making good-netizen behaviour (rate limits, backoff, robots.txt) a structural property of the web workers rather than operator policy.

• Phase 2 — Channels IN PROGRESS

  Matrix — self-hosted, single-user, federation off, end-to-end encrypted — is live end to end: the sandboxed Matrix client, peer pairing, the message bus, and supervised channel bring-up have all shipped. Follow-up messages now carry the recent conversation, so a short question after an answer is understood in context, and a stuck room holds up only itself — undeliverable replies queue per conversation and are audited if given up. The operator ask channel is live too: when CASSANDRA says a human must decide, the question is posted to your Matrix room and the task waits for a closed-set answer — a bounded deadline fails closed. The email failover’s inbound half shipped as well, off by default and gated hard (a DMARC verdict from your own mail server plus a per-pairing token in the body). Remaining: outbound email replies (SMTP) — until then email is receive-only, and replies to it are audited as undelivered. ← next up

• Phase 4 — python-exec & agent-authored skills IN PROGRESS

  Python in the strictest jail of any worker — no network, ephemeral scratch only, curated stdlib — shipped and acceptance-green on both Linux and macOS, with an optional Firecracker micro-VM boundary on Linux. Agent-authored Python skills already run through an operator-approval lifecycle (crystallise → approve → pin → invoke); the tiered delegation policy follows.

• Phase 5 — Oversight, frontier escalation & hardening IN PROGRESS

  A model-based CASSANDRA guard tier is running in production as advisory defence-in-depth, not a gate: measured at 65% recall at zero false positives, with narrative-framed attacks the known miss — so nothing downstream is allowed to relax on it. Still to come: a policy gate deciding when a frontier LLM may be consulted (TLS pinning for that egress path is already built), a measured oversight corpus for the review lattice, and a 7-day adversarial soak test.