Concepts

Architecture

How Sandbox Policy, Executor, Netd and native backends compose without merging their trust boundaries.

The product boundary

Warden is the product facade. It composes a portable decision, the policy-agnostic Executor engine, native confinement and optional Netd mediation. It does not contain Datalog rules and it does not decide which rights a workload deserves.

ARCHITECTUREThe Warden composition

Policy frontendJSON · C builder · Datalog

Canonical MIRresolved decision

Sandbox Policyhost resolution

Executorlifecycle + receipts

OS backendSeatbelt · Bubblewrap

Component	Owns	Does not own
Maelys Sandbox Policy	canonical MIR, host-path resolution, capability requirements	process lifecycle, proxying
Executor engine	prepare/spawn/wait/stop, backend selection, execution receipts	authorization rules, DNS
Maelys Netd	proxy authentication, allowlist, DNS/pinning, byte relay, network receipts	OS sandbox policy
Maelys System	reactor, sockets, clocks, buffers, idempotent close	product or policy concepts
Maelys Warden	safe product composition and public CLI/C/SDK facade	a second policy engine

Prepare before spawn

CODE

request + sealed plan
        │
        ▼
backend.prepare()
        │ immutable artifact
        ▼
backend.spawn()
        │ execution handle
        ├── wait()
        ├── stop()
        └── receipt snapshot

Prepare canonicalizes and pins what the backend will need. Spawn consumes the immutable artifact. A confined request is accepted only when one backend advertises every required capability.

Native backends

Guarantee	POSIX	Bubblewrap	Seatbelt
Unconfined execution	yes	yes	yes
Strong `NETWORK_NONE`	no	netns + seccomp	SBPL deny
Filesystem view mappings / tmpfs	no	yes	no
Portable READ / WRITE rules	no	yes	yes
Standard HTTP/SOCKS clients	no	Netd relay	direct Netd loopback
Policy follows descendants	no	yes	yes

Digests and receipts

CODE

JSON / builder ──► MIR digest ──► decisionDigest
                              │
                    ExecutorPlan digest ──► planDigest
                              │
              backend + capabilities + terminal outcome
                              ▼
                    execution receipt v1

The decision digest identifies the portable authorization result. The plan digest identifies the mechanical execution plan after host resolution. Keeping both prevents a receipt from blurring policy and enforcement.