sharness.launcher: the bootstrap
sharness-ai run --policy p.json --expect-hash sha256:… -- cmd is the launcher for one process: it refuses unless the policy hashes to what the person supplied, applies the locks in the child, and starts the command; measured on three kernels. The session launcher that starts the components under one manifest is designed and not built. Written as of 25 Oct 2026.Its one job
Start the session the way init starts a machine: refuse unless the manifest hashes to the value the person supplied out of band; make one ephemeral uid per component; make a session CA and one certificate per role, then destroy the CA key; start sharness.kms and freeze it; start the other components under their policies; freeze, thaw, stop and clean up. It runs outside every domain and holds no secret.
Not an API: a command
The launcher is what everything else trusts, so it has no port of its own. It is a command the person, a script, or the platform runs above the agent:
sharness-launch --manifest manifest.json --expect-hash sha256:M
| It does, in order | Measured |
|---|---|
read the manifest, hash it, compare with sha256:M or verify the root key's signature; refuse otherwise | --expect-hash on run: a wrong hash runs nothing, exit 125 (five places, 25 Oct 2026) |
| one uid per component | user + firewall rule + locked launch + teardown ≈ 49 ms (24 Oct 2026) |
| a session CA, one certificate per role, the CA key destroyed, the CA certificate's hash recorded | a mutual TLS handshake ≈ 3.2 ms (24 Oct 2026) |
start .kms, read only its public bundle, freeze it | thaw and freeze 0.13 and 0.28 ms |
| per command: start the others under their policies in new namespaces, run, tear down | namespaces ≈ 4 ms |
at the end: thaw and kill .kms; delete users, rules, sockets |
Who runs it decides what the locks are
| The launcher is run by | The locks are, for the agent | |
|---|---|---|
the agent, inside its own session (sharness-ai run today) | a Setting: a Boundary for every child, but the agent could have skipped it | what every experiment here has done |
| a script that starts the agent | a Boundary for the agent | the next rung |
| the platform | a Boundary all the way down | the end state |
This is the caveat printed with every result on this site, in one table.
What it enforces, with what
The launcher applies nothing itself at run time; it tells the kernel, once, before each process starts: a uid, Landlock, seccomp, namespaces, a cgroup, no_new_privs, and the certificate that says which role the process has. After that the kernel and the certificates do the work and the launcher cannot be asked for more rights, because it is not listening.
On its own
Adopt only this component and you have what sharness-ai run is today for one process, for a set of them: a policy per process, checked against a hash the person supplied, enforced by the kernel. No door, no filter, no KMS; and still every process it starts cannot do what its policy does not list.
Sources: Components, Policies §2, Architecture: topologies. The one-process form: The CLI.