The catalog assigns 7 packages to this responsibility boundary. This page derives its vocabulary, topology, publication state, and maturity profile directly from those audited records.
Counts expose what the catalog actually contains. They do not convert package metadata into production-readiness or quality claims.
13 package-specific limitation entries remain visible across this domain.
25 unique capability statements are attached to packages in this domain. The language below is catalog evidence, preserved without expanding the claim.
Linux agent isolation policy
Landlock and seccomp integration surfaces
cgroup v2 and eBPF/BPF-LSM controls
security receipts
strict JSON parsing
boundary compilation
JSON Schema validation
bounded repair policy
normalize and validate paths
classify side effects
decide when explicit permits are required
RFC 8785 JSON canonicalization
duplicate-key rejection
boundary profiles
BLAKE3 content digests
strict JSON boundary compilation
canonical digesting
receipt artifacts
fixture conformance
workspace path policy
database safety policy
resource-cap primitives
sandboxed workspace construction
patch filesystem helpers
path-policy enforcement
Edges are derived from sibling dependency declarations. Cross-domain traffic describes manifest topology, not runtime call direction, frequency, or activation.
Each record has a stable URL with its complete catalog scope, capabilities, targets, features, relationships, registry evidence, update trail, and known limits.
Linux-first control plane for AI-agent security using kernel and process isolation mechanisms.
AiDENs adapter for strict JSON boundary parsing, compilation, schema validation, and repair policy.
Application-level path safety and canonical tool side-effect classification helpers.
RFC 8785 JSON Canonicalization (JCS) with boundary profiles and duplicate-key rejection
P31 v11A boundary compiler microkernel — strict JSON boundary compilation with receipt artifacts
Workspace and database safety policy primitives for forge-engine
Workspace sandboxing and patch filesystem primitives
This route reorganizes audited package metadata. It does not add implementation claims or expose access-controlled source.
p32-schema-compat / 011027f77fc7a53c6ecb05300d5c34144370fa3b