MAELYS//WARDEN

Policy-enforced process runtime

MaelysWarden

policy-enforced execution · v0.14.0 · 2026-08-24 · release →

I do not merely launch.
I define what the process can reach.

Run local agents, developer tools and MCP providers under an explicit filesystem, process and network policy. Warden selects Seatbelt on Apple Silicon or Bubblewrap on Linux, fails closed, and returns a versioned execution receipt.

[ CONFINED ]OS-native enforcement
  • +Seatbelt on Apple Silicon
  • +Bubblewrap on Linux
  • +no permissive fallback
[ PORTABLE POLICY ]One canonical decision
  • +strict JSON or C builder
  • +canonical MIR digest
  • +portable filesystem rules
[ MEDIATED NET ]Network without ambient access
  • +fd 4 for aware clients
  • +Netd for standard tools
  • +destination allowlists
[ AUDITABLE ]Every run leaves evidence
  • +backend and capabilities
  • +decision and plan digests
  • +terminal outcome
POLICYWARDENspawn · confine · observe
C11dependency-light runtime
2 OSmacOS arm64 + Linux
FAIL CLOSEDcapability selection
ABI 6backend contract
v1execution receipt

Runtime

What Warden owns

POLICY

Canonical input

Compile a built-in profile, strict JSON source or canonical MIR into one sealed mechanical plan.

maelys-warden --policy-json policy.json -- command
FILESYSTEM

Portable access rules

READ, WRITE and explicit DENY semantics are lowered only when the selected backend can prove them.

read / workspace · write /workspace/build
NETWORK

Two mediated frontends

Maelys-aware programs use fd 4; unmodified HTTP and SOCKS clients use Netd without receiving ambient network.

--network-frontend proxy
LIFECYCLE

Bounded supervision

Prepare, spawn, wait and stop are explicit. Failure before backend readiness prevents workload execution.

prepare → artifact → spawn → receipt
RECEIPTS

Attributable execution

Immutable receipts bind the decision digest, mechanical plan, backend capabilities, timestamps and outcome.

--receipt execution.json
INTEGRATION

CLI, C and SDKs

Use the standalone command, libmaelys-warden, or the dependency-free Node.js and Python facades.

spawn({ profile: "untrusted", argv })

One policy, native enforcement

ARCHITECTUREFrom a resolved decision to an observed process
JSON / builder / Datalogtrusted policy frontend
Canonical MIRportable decision digest
Sandbox Policyhost paths + capabilities
Wardenprepare + spawn + receipt
Seatbelt / Bubblewrapnative enforcement

The policy frontend decides. Warden enforces the already-resolved decision and records what happened.

Install and run

PLATFORMNative packages

Apple Silicon, macOS 15+

Homebrew installs the CLI, C libraries and relay helper.

brew install maelys-dev/tap/maelys-warden
maelys-warden --profile untrusted -- codex

Evidence, not a promise

EXECUTION RECEIPTSuccessful Bubblewrap execution
{
  "schema": "maelys.execution-receipt/v1",
  "invocationId": "build-2026-08-24-001",
  "decisionDigest": "94d14d6aece6e3a0cdf1409d9a92695b8591fe7016ae56ebad221fcd49ba8bc3",
  "planDigest": "cf14f5b4eff7f425b140948c9c1d53f905c73e7ad6504aaa1d3e04490f812535",
  "mediator": "maelys-netd/proxy-v1",
  "backend": {
    "name": "bubblewrap",
    "version": "0.9.0"
  },
  "network": {
    "mode": "mediated",
    "frontend": "netd-proxy"
  },
  "completed": true,
  "outcome": {
    "exitCode": 0,
    "termSignal": 0
  }
}