Cape Matapan — Tainaron — was the cave where the living world met the underworld. Matapan is that gate for your agents: untrusted code works in disposable, container-isolated workspaces, and only sealed, evidence-bearing proposals cross back. Your active checkout is never in the agent's write path.
At the southernmost point of mainland Greece lies Cape Tainaron — Cape Matapan. The Greeks placed an entrance to the underworld there: a cave where Heracles dragged Κέρβερος — Cerberus, the three-headed hound, up from Hades into the light.
Every passage through that cave was watched. Nothing crossed in either direction without being seen for exactly what it was. That is the job. Your agent works on the far side of the gate, in isolation. What comes back is examined — digest by digest — before it is allowed to touch anything you own.
The gate does not trust what approaches it. It inspects, seals, and only then carries across.The founding idea
The agent works on one side of the gate. Your repository, your secrets, and your machine live on the other. Only sealed proposals cross.
Agents execute in locked-down containers: all capabilities dropped, read-only rootfs, no network by default, hard resource clamps. gVisor where available — never a silent fallback.
Work returns as a sealed proposal: diff, content digest, policy digest, run evidence, and an HMAC-authenticated target anchor only the daemon's 0600 key can produce.
Apply is a layered CAS: expected base, head-equals-base, sealed-digest-equals-applied-tree, atomic ref move. A stale base or a shifted identity aborts typed — never a partial land.
A workspace is created from your repo — a git worktree pinned at an exact commit, a defended snapshot copy, or a fresh scaffold. The source identity is recorded by device and inode.
Scoped MCP tools, container runs with hard clamps, no network unless a human grants a domain through the egress proxy. Every git call goes through one hardened runner — hooks, filters, and signing programs can never execute.
The workspace is drained, evidence gathered, and the result sealed: diff, digests, instruction manifest, and an HMAC-authenticated anchor in the hash-chained ledger.
proposal show renders the diff, the evidence, the lineage. The creator can never approve its own proposal in charon mode.
The sealed digest must equal the applied tree; the target anchor must verify; the base must not have moved. Then — and only then — the ref moves. Destroy revokes secrets and tears down with verification.
{
"proposal_id": "019f…",
"base": "8b9f2ca…",
"head": "7329c9c…",
"content_digest": "sha256:…",
"policy_digest": "restricted",
"target_branch": "main",
"anchor": {
"ledger": "proposal_seal_evidence",
"mac": "hmac-sha256:v2",
"workspace_bound": true
}
}
Every git invocation: hooks dead, env scrubbed, exact safe.directory, external drivers refused, all signing and signature verification forced off. Repo config never executes as the daemon.
Cap-drop ALL, no-new-privileges, read-only rootfs, network none, memory/CPU/pids clamps a per-run config can only lower. Kill paths verify after destroy.
Immutable, evidence-bearing, HMAC-anchored. Storage substitution, anchor forgery, and cross-workspace replay all fail closed.
Per-domain human grants. DNS resolution pinned, non-public answers rejected wholesale, CONNECT limited to 80/443. Everything else denied and ledgered.
AES-256-GCM at rest, per-workspace grants, injected only into runs, revoked at seal and destroy. Values never touch the ledger.
Cross-process leases where every retained row is live until verified cleanup. Destroy requires proven container absence — durable ever_ran evidence, never a guess.
Per-model containers, isolated keys and workspaces, one tunnel. Full compose walkthrough in the docs.
$ scripts/install.sh && matapan doctor→ end-to-end, with env reference
Documentation→ the full matapan guide