Placement Beyond Tier: Capability-Enforced Sandboxes and Hardware-Attested Enclaves as Placement Dimensions

Pitch

A composition language can say, in the same placement file that picks a runtime and a machine, "this component runs inside a kernel-enforced box with no network" or "this component runs only on a peer that proves, with a pinned hardware root, that it is the approved build in an approved enclave", and the plan is refused before anything starts if the declaration or the proof does not hold.

Abstract

Placement systems usually decide where a component runs (which runtime, which machine). Security properties are a separate concern, checked by a different tool, if at all. We treat two security properties as placement dimensions of the same kind as tier and machine. The first is isolation: a process can be placed in a wasm cell, a container or a microVM with a filesystem and network envelope that defaults to deny, composed with unsandboxed processes over the existing cross-process seam. The envelope is checked at plan time against the component's declared needs, but we state plainly that this check is advisory because host code bodies are opaque; the security boundary is the runtime envelope, and a boot canary probes the boundary from inside and refuses the placement if a should-be-denied attempt succeeds. The seam crosses the container boundary over mutual TLS and a relay that holds no key. The second dimension is attestation: a process may require that its host prove, by a TDX Quote v4 or an SEV-SNP report verified with pure-Python ECDSA up to an operator-pinned root, that it runs an approved bundle with a permitted measurement, and results come back only through a single delivery ledger bound to that admission. We give the refusal catalogue (every refusal named, 23 committed quote fixtures, forged cases re-signed rather than corrupted) and the limits: the container rung hosts only Python components today, the wasm-cell and microVM rungs verify their boundary and then refuse to host, the isolation runtime is a trusted enforcer, the envelope covers filesystem and network only, and the fixtures are not vendor-issued quotes. We report no performance numbers.

Problem and claim

Existing capability systems in this lineage check a declared envelope and then trust the host code body. revl's own threat model lists "the gate does not sandbox host code" as a non-goal (docs/threat-model.md:119; the design note cites it at docs/design/411-sandbox-placement.md:46). The check and the enforcement live in different layers. Remote attestation systems have the opposite shape: they prove a fact about a machine and leave the decision of what to do with it to the application.

The claim of this paper is narrow. Putting isolation and attestation into the placement vocabulary has three concrete effects that can be checked in the tree: a plan whose declared needs exceed the grant, whose isolation rung cannot be established, or whose attestation does not verify to a pinned root is refused by name before any process runs; the refusal direction is intended to be uniform (the drivers refuse rather than start a sandboxed process unconfined, and admission is refused on an unverified claim, as the refusal tests pin); and the same placement file composes sandboxed and ordinary processes over one seam. Attestation is a peer admission requirement; no test composes it with a sandboxed process over the seam.

We do not claim that the sandbox is escape-proof, that the plan-time gate proves anything about opaque bodies, or that the attestation chain reaches a real vendor certificate. Each of these is in the limits section and in the design notes' own text.

Contributions

1. An isolation ladder (wasm-cell, container, microvm) under one manifest surface, where the envelope defaults to deny and an unmappable declaration is a plan-time refusal rather than a silent downgrade (docs/design/411-sandbox-placement.md:706-734 for the ladder; the unmappable-needs refusal is at docs/design/411-sandbox-placement.md:485-488 and docs/design/411-sandbox-placement.md:924).
2. A two-layer capability model: a runtime layer that enforces filesystem and network resources, and an explicitly advisory plan-time gate over an author-declared needs table (docs/design/411-sandbox-placement.md:172-232).
3. A seam transport across the container boundary: TCP with mutual TLS over a per-process seam-only internal network, through a conductor-owned relay that is a blind byte forwarder holding no certificate or key, with a seam-only canary that confirms the transport from inside (src/revl/seam_relay.py:1-30, src/revl/sandbox_runtime.py:621).
4. A boot canary that reads the kernel from inside the boundary, with an active egress probe, so that a daemon that applies less than requested is detected and the placement refused at boot (src/revl/sandbox_runtime.py:88-175; the canary reports and the driver refuses, it does not kill a process).
5. requires attested_tee as a fourth placement dimension: a typed requirement, a fail-closed verifier with a named refusal for every gate, and verification of Intel TDX Quote v4 and AMD SEV-SNP reports with pure-Python ECDSA P-256 and P-384 to an operator-pinned root that the placement file cannot name (docs/tee-attestation-root.md:1-110, src/revl/tee_attestation.py:818).
6. A single delivery ledger: an admission yields an AttestedRun, and a result can enter only through it, with the receipt key bound into the attested evidence body (docs/attested-result-delivery.md:1-60, src/revl/tee_attestation.py:1195).
7. A fenced development verifier: the symmetric-MAC path survives as DevMacRoot, which requires acknowledged_dev_only=True, labels every verdict it reaches, and is refused outright when a hardware root is required (docs/tee-attestation-root.md:118-140, src/revl/tee_quote.py:1149).

Related work

Evidence on main

Test counts are def test_ functions per file and do not count parametrization. No test was run for this draft.

Numbers that exist

• 23 committed quote fixtures and 4 endorsement fixtures, with the verdict each must reach listed in tests/fixtures/tee/manifest.json (counted from the JSON keys; docs/tee-attestation-root.md:263 says 23). Forged cases are re-signed, not byte-flipped.
• Test function counts are listed in the table above; the sum over the sandbox and TEE files named there is 443 def test_ functions, and parametrized cases add more. These are test counts, not a coverage claim.
• Timing: tools/ecdsa_timing_demo.py, one loaded machine, measured the pure-Python signer about 8% slower on high-weight nonces and the OpenSSL-backed signer within 0.3% (docs/tee-attestation-root.md:256-260). The doc calls this a demonstration of the difference, not a proof and not a test. Signing is not the attestation-verification path, so this is a side remark at most.
• Launch cost for the rungs: the design note gives "~100ms-1s launch" for the container as an estimate (docs/design/411-sandbox-placement.md, ladder table). It is not a measurement. No measured numbers for any rung exist in the tree.

Paper outline

1. Introduction. Placement decides where; security is usually elsewhere. The gap between auditing host reach and enforcing it.
2. Background. The placement file, the seam, G4 capability reach, the G8 audit surface.
3. Isolation as a placement dimension. Manifest surface, ladder, default deny, refusals that name the gap. The two capability layers and why the plan-time gate is advisory.
4. Crossing the boundary. Seam over mTLS through a blind relay; the canary; the approval channel.
5. Attestation as a placement dimension. The requirement, the ten gates, the pinned root, report_data binding, debug refusal, the fenced development verifier, the delivery ledger.
6. Evaluation. Refusal catalogue (fixtures), escape-attempt table, overhead numbers (if produced).
7. Limits and related work.

Threats to validity and limits

• The isolation runtime is a trusted enforcer. The design says revl "cannot verify the daemon applied" the flags; the canary "probes examples, not the policy: detection of gross non-enforcement, not verification of the enforcer" (docs/design/411-sandbox-placement.md:567-600 region).
• The envelope vocabulary is filesystem and network only. Environment, exec, ipc and device authority are not enforced; an env-injected secret survives every flag, which is why spec narrowing is a stage-1 requirement (same note, surface section).
• The plan-time gate is advisory. A missing or understated [sandbox.needs] entry defaults to "needs nothing" and is admitted. Net allowlists ("only api.example.com") are not offered; net is none or all.
• Confinement bounds reach, not misuse of granted reach: a sandboxed component can still leak through the seam-served log key. That residual belongs to information-flow work and to composition policy.
• Only Python components run in a container today. Wasm-cell and microVM drivers verify their boundary and then refuse to host. The paper must not be read as if all three rungs host components.
• Attestation fixtures are synthetic. The doc says what a genuine quote needs (a per-platform key chained to a live vendor service) and that the fixtures prove the parser and the root logic, not a vendor relationship. The bundle field is a label; no hardware format measures it, so the operator's permitted-measurement set carries the meaning.
• report_data binds what the workload said; the measurement comparison against the hardware register is what makes that safe, and that is the one place a reviewer will push.
• Pure-Python curve arithmetic is not constant-time; verification inputs are public so this is harmless there, and signing has a revl[crypto] backend. The verifier is not a constant-time implementation.
• Whether the docker-gated live tests (tests/test_sandbox_seam_transport_411.py, tests/test_sandbox_container_rung_411.py) were green on any commit is not established by the tree.
• Prior-art positioning against commercial confidential-computing stacks is from general knowledge and not checked.

Fact-check

Claims in this draft were checked against revl main at commit 45bec431f: 27 checked, 6 corrected.

Cite this draft

@misc{revlp31,
  author       = {Thomas Moussajee},
  title        = {Placement Beyond Tier: Capability-Enforced Sandboxes and Hardware-Attested Enclaves as Placement Dimensions},
  year         = {2026},
  howpublished = {\url{https://inso1337.github.io/revl/research/P31.html}},
  note         = {Research draft, not peer reviewed. Written against revl commit 45bec431f. Licensed CC BY 4.0.}
}

Text licensed CC BY 4.0, author Thomas Moussajee.