Golden-Gray Hybrid Isolation Execution Architecture

This article details the theoretical foundation, design architecture, security boundaries, and state transition model of the Golden-Gray Hybrid Isolation architecture adopted by the physical execution plane (L3/L4) in the Aura high-performance OS-level AI agent framework.

1. Architectural Evolution and Core Pain Points

The original design of Aura OS utilized a Strongly-typed DSL (ExecutionDsl) Driven Model. Tasks generated by the inference layer had to precisely match WebHook or PythonHook structures. While highly deterministic, this paradigm exposed two major industrial pain points:

Compilation Bloat in Contract Libraries: Every time a physical skill (like a specific heterogeneous API or hardware control) was added or modified, the contract definitions in aura-core had to be updated, causing the entire Workspace to recompile and severely limiting plug-and-play flexibility.
Restricted AI Self-Evolution: Large Language Models (LLMs) could not directly leverage their powerful Code Generation capabilities to write temporary data parsing or self-healing scripts, stifling the framework’s “autonomous evolution” potential.

However, moving to the other extreme—Code-As-Data Sandbox Execution—would expose an infinitely large physical attack surface on the host machine (e.g., Fork Bombs, Intranet SSRF penetration), which is absolutely unacceptable for OS-level resident software.

2. Hybrid System Definition

To achieve the ultimate balance between Absolute Host Defense and Infinite Autonomous Evolution, the Aura execution plane has been fully upgraded to a “Golden-Gray Hybrid Isolation” system:

2.1 The Golden Path (OpenAPI Tool-Calling)

Mechanism: 90% of standardized physical interactions are forced through restricted, declarative tool calls. The system maintains only one static OpenAPI Schema. The execution layer manages a dynamically registered toolset, executing via reflection in memory through relay proxies.
Features: Parameter-level Schema Static Firewall. The attack surface is restricted entirely to compliant parameters, resulting in zero code execution risk and minimal energy overhead. Every tool call is dispatched via reflection in microseconds, achieving Zero Disk IO loss.

2.2 The Gray Sandbox (Air-gapped Code Runtime)

Mechanism: For highly complex customized heterogeneous scripts, non-standard mathematical inferences, or streaming data parsing, the LLM can output native Python/WASM scripts directly.
Features: Human-Machine Collaborative Strong Authorization. Gray scripts remain absolutely silent without explicit user authorization in the interaction layer. Once signature activation is granted, it is immediately deployed into a heavily isolated three-tier physical sandbox for execution.

3. ACS (Aura Container Sandbox) Design

To completely eliminate the DooD (Docker-out-of-Docker) mechanism that relied on external Docker, Aura built ACS—a native isolation sandbox system implemented purely in Rust. It is driven by two parallel isolation engines:

3.1 Engine A: ACS-L (Linux Kernel Native Sandbox)

For gray tasks requiring dynamic Python/Bash scripts, ACS-L uses native Linux kernel APIs to build a high-strength micro-container sandbox:

Six-fold Namespace Isolation: Stripping mount points, network (completely air-gapped), PID, IPC, and other system resources.
Minimal Base Rootfs & OverlayFS Zero-Residue Mounts: Modifications occur in memory tmpfs, ensuring 100% physical zero disk residue upon destruction. Supports controlled bind mounts and path escape validation for persistence.
Cgroups v2 Quota Protection: Fine-grained CPU and RSS memory limits to immunize against runaway loops.
Seccomp-BPF Syscall Filtering: Locks down the syscall surface for the entire runtime lifecycle.

3.2 Engine B: ACS-W (WebAssembly WASI Sandbox)

For high-speed physical computing that doesn’t require a local interpreter, the built-in Wasmtime engine acts as the ACS-W micro-sandbox:

Epoch-level Fuel Control: Forcibly injects WASM computational fuel limits; exhaustion triggers instantaneous instruction-level security fusing.
Absolute De-networking: Disables WASI Sockets extensions and maps zero local disk directories.

4. State Transition and Causal Chain

System state transitions strictly adhere to causal consistency. The inference plane generates pending_feedback tasks; the interaction plane pushes them to the user; upon user consent, the state becomes pending_execution; the execution system runs it via the hybrid mechanism; finally, the result is returned to the interaction plane, forming a complete control loop.

Produced by Dark Lattice Architecture Lab.