wiregap

The system separates a machine that may execute anything from a machine that may reach anything, and places a single reviewable program between them. The first machine, the box, holds a general interpreter and no path to the outside; its network interface has exactly one physical peer and that peer does not route. The second, the proxy, holds the only route outward and constitutes the entire trusted computing base.

The objective is narrow and worth stating exactly. The system exists to prevent remote code execution: to make it impossible for the occupant of the box to cause code to run, systems to be reached, or actions to be taken beyond its boundary. It does not exist to keep information in. The box may hold a live credential, read any injected instruction, and compute any payload it likes, because every use of those things requires an actuator it does not have. Disclosure is not treated as harm here; caused execution is the only harm.

The architecture is aimed at one operating model rather than at deployment generally. It is built for the case where the intent is to grant an agent maximum flexibility: a general interpreter, live credentials, no per-action supervision, and the freedom to build, install, and iterate at whatever speed it manages. Nothing inside the zone is gated, because gating it would protect nothing. That latitude is what the boundary is paying for, and environments whose agents need less of it are better served by lighter approaches.

The operator, a human, is unconditionally answerable for every action the system enacts, whether or not they approved it. The system's job follows directly: to ensure the set of acts it can enact never exceeds the set the operator has approved. Trust in the agent is set to zero permanently and made irrelevant, not by distrusting it but by removing every place where its trustworthiness could matter.

Guarantees are structural. The forbidden thing is made unrepresentable or unreachable rather than detected, because a detected act is already an authored one and the operator's answerability is unconditional. The trusted program is held small enough to be read in a single sitting, on the order of five hundred lines, and admits only constructs verifiable by enumeration: total functions over finite domains rather than parsers of unbounded grammars.

Not a data diode, and not an air gap. Both terms describe the direction information flows: an air gap permits no channel, a diode permits one direction only. Both invite a defender to protect confidentiality, to stop data leaving. This system does the reverse. The box egresses freely and holding a secret is not a loss, because a secret has value only where it can be used and every use is unreachable. Adopting either term re-imports an invariant this design does not hold.

Not industry zero trust. "Never trust, always verify" is continuous re-verification. Trust is minimised and re-priced per request, but every permitted action remains a granted trust that verification resolved positively, which makes it a sliding scale whose zero is only a default posture. Here trust is set to zero permanently and made irrelevant, because the design removes every place where it could matter. The term is kept because the objection it provokes from a security practitioner is the teaching moment.

Not defence in depth. A stack of mitigations is the quiet admission that every layer leaks, so another is added, and the whole falls when one course fails. Each decision here deletes a class of problem rather than stacking a guard above it. The test applied throughout is that every boundary has one place it lives, defined once, rather than a history of accreted decisions nobody made as a whole.

Not obscurity. Concealment is not part of the posture and cannot be. A design whose safety depended on its details being unknown would rest on exactly the kind of contingent bet this architecture exists to remove, and the reviewability guarantee runs the other way entirely: a trusted computing base whose guarantee is that a human read it completely is not a thing that can be hidden. The description on this page withholds nothing that matters, because nothing that matters would be weakened by describing it. The repository is closed for reasons of readiness rather than secrecy.

The debt to prior work is real: confinement in Lampson's sense, object-capability security, and the constitutional principle that a person answers for what their systems execute. What differs is purpose. Those lineages were built for static programs and human operators. The occupant here is dynamically generated, rewritten by the adversary in flight, and running at machine speed, and the thing worth preventing is not what it learns but what it can cause to run.

Seven Rust crates divide along the boundary. The driver operates the network controller directly from userspace with the kernel outside the trusted path, on documented device defaults and the fewest register writes that produce a correct link. The proxy is the single listener on the interface and the whole of the trusted computing base. The protocol crate defines the channels crossing the boundary, each constrained so that the dangerous thing cannot be expressed in it rather than filtered out of it. The remainder cover transport, the event reactor, a direct path, and measurement.

Development is organised in sprints against written contracts. The driver has been brought to a live link on the target hardware and a full end-to-end capture has been taken on real devices. The design documents carry their open questions explicitly, including the choice between a virtual machine and dedicated bare metal for the box, and the form of the link between the box and the boundary. The repository is not yet public.