capsule-runtime 0.1.0

The runtime that executes Murmur capsules. Runs packaged AI agents in isolation, enforcing WASI capability grants on a Wasmtime component sandbox.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

// `security::harden_process_dumpable` needs one `unsafe { libc::prctl(...) }` call on Linux;
// `#[allow(unsafe_code)]` on that item overrides this crate-level default of `deny` rather
// than `forbid`, since `forbid` cannot be overridden by a narrower `allow` anywhere in the crate.
#![deny(unsafe_code)]

pub(crate) mod a2a;
pub(crate) mod agent;
pub mod artifact;
pub mod bindings;
pub(crate) mod checkpoint_sign;
pub mod errors;
pub(crate) mod hooks;
pub(crate) mod identity;
pub mod limits;
pub(crate) mod murmur_md;
pub(crate) mod network_policy;
pub(crate) mod otel;
pub(crate) mod outgoing;
pub mod plan;
pub mod runtime;
pub(crate) mod sandbox;
pub mod security;
pub(crate) mod shell;
pub(crate) mod streaming;
pub(crate) mod trace;
pub mod types;

pub use errors::RuntimeError;
pub use limits::ExecutionLimits;
pub use murmur_artifact::{AfterTask, LifecycleConfig, LifecycleOverride, TaskAcceptance};
pub use runtime::{launch_session, stage_session};
pub use types::{
    capability_policy_from_runtime_manifest, ArtifactRequest, CapabilityPolicy,
    InstalledArtifactSummary, LaunchResult, LockExpectation, ResolvedLockArtifact, StageRequest,
    StagedSession,
};