The security model.

A task body reaches a resource through a Unix socket mounted into its container for the lifetime of one run. The socket is the capability. There is no token in an environment variable to leak and no way for code inside to widen its own access - the executor makes the call with the real credentials and hands back only the data.

Because every resource call goes through the proxy, capability enforcement, budget metering, and audit logging happen in one place rather than scattered through task code. The trusted surface stays small and auditable while the task body remains free to use whatever library it needs.

Grants map a user to a resource, the verbs allowed, and a scope in that connector's own terms - a SQL row filter, an object-storage key prefix, an HTTP URL allowlist. They are checked on every call rather than once at the start, so two people asking the same question receive answers drawn from different data, and the log shows every scope decision that made the difference.

The runtime treats model output the way a kernel treats userspace. Every task output is validated against its declared schema before anything downstream sees it. When an agent produced it, a failure sends a truncated error diff back to the model for a bounded number of repair attempts, then fails typed into the run log rather than passing malformed data along.

No agent is asked to be careful. An agent is an ordinary task carrying extra policy, and the rules that matter - which resources it may touch, what its output must satisfy, what it may spend - are properties of the definition the executor enforces. Because the definition graph is data rather than code, which task can reach which resource is a question you answer by reading.

Every value crossing a seam carries an envelope: the run, task and attempt that produced it, the schema it satisfies, the event that caused it, its taint, and its budget spent. Taint is recorded and logged today but not yet enforced - carrying it from the start is what makes enforcing it later a policy change rather than a migration.

A task can gate on human approval. The pending decision lives in Postgres, so restarting the executor leaves the run exactly where it was, waiting, and approving it lets the run continue. Suspension that survives a restart is the difference between a real gate and a polling loop.

Every run is an append-only stream of events, and executor state is a fold of that stream. Status queries, the audit trail, approval resume, and crash recovery all read the same table - so the audit trail is not a side report that can drift from what happened. It is what happened.