Where Kastellan stands

Development phases, in build order

• Phase 0 — A core that can jail things SHIPPED

  Cross-platform kernel sandboxing (bubblewrap + Landlock + seccomp on Linux, Seatbelt on macOS) with negative tests proving that denials deny. JSON-RPC workers, service supervision, Postgres with an append-only audit log.

• Phase 1 — Memory & the agent loop SHIPPED

  Three-lane memory recall (semantic, lexical, graph), the task scheduler, CASSANDRA plan review, a prompt-injection guard on worker output, encrypted secrets, and an operator-approved skill system.

• Phase 3 — Web egress IN PROGRESS

  Web search and web fetch shipped behind host allowlists. The egress proxy — the single chokepoint all worker traffic is forced through — now force-routes every networked worker by default (private netns, no direct route), terminates and inspects worker TLS, scans the cleartext for the worker’s own secrets, and pins server certificates. Remaining: wiring it to the first frontier-egress worker. ← currently being built

• Phase 2 — Channels IN PROGRESS

  Matrix — self-hosted, single-user, federation off, end-to-end encrypted — is how you’ll actually talk to it, with email as a cross-transport, low-trust failover (notifications only, never commands). The inbound path, peer pairing, and the message bus have shipped; the live sandboxed Matrix client is landing.

• Phase 4 — python-exec & agent-authored skills IN PROGRESS

  Python in the strictest jail of any worker — no network, ephemeral scratch only, curated stdlib. The first slice has shipped and passed acceptance on both Linux and macOS; a catalog of named skills with trust tiers and human approval gates follows.

• Phase 5 — Frontier escalation & hardening PLANNED

  A policy gate deciding when a frontier LLM may be consulted (TLS pinning for that egress path is already built), and a 7-day adversarial soak test.