Security

Most agent frameworks bolt security on. Tixim starts from paranoia and builds outward: every layer assumes the layer inside it is already compromised.

The layers around a step Shipping

A workflow step never runs on the host. It runs:

• inside a rootless OCI container (youki) with zero ambient authority and no network by default;
• under a seccomp tier that filters what syscalls exist at all;
• behind Landlock — a kernel LSM ruleset generated from the step’s closure manifest, so the process can read only the verified /nix/store paths it was composed with. The restriction is inherited by every child process and cannot be relaxed: a compromised step cannot escape its closure;
• behind an egress MITM proxy when network is granted at all — domain allowlists, with a privacy filter that detects and redacts secrets and PII before anything leaves.

Capability lives in what a step can access, not in instructions handed to a model. A prompt injection that “convinces” an agent changes nothing about what the kernel lets it touch.

And the rootless container is the default tier, not the ceiling. Step isolation is pluggable: MicroVM and gVisor runtimes for workflow steps are planned Horizon , putting a hardware or userspace-kernel boundary under the same declarations. Builds you submit will run in MicroVMs — and on trusted compute where it’s available — so the jobs with the least-trusted inputs get the strongest walls.

Agents never hold a password Shipping

Assume every agent can be exploited — then ask what an exploited agent can leak. In Tixim the answer is designed to be: almost nothing, briefly.

Agents don’t know passwords. What an agent carries is a short-lived JWT that says who it is — which run, which step, which permissions — and nothing else. The real credentials live in the secrets subsystem and surface only at the boundary: when a step calls an external API, the MITM egress proxy authenticates the agent by its token and injects the real credential into the outbound request on the host side. The secret exists in the proxy, never in the sandbox. The same shape covers models: the agent speaks to the LLM gateway with its token; the provider keys stay with the gateway.

So the worst case is bounded by construction. A prompt-injected agent that dumps its entire environment hands the attacker a token that expires shortly, must be refreshed, and carries its permissions inside it — extraction buys a short window on a narrow scope, every use of it in the audit trail, not a credential worth stealing.

Both the gateway and the secrets subsystem are workflow- and service-aware: a request arrives as this step of this run or this service instance, so model routing, budgets, and credential release attach to declared identity — never to network position or an environment variable that happened to be set.

Writes get the same treatment as secrets: workflows have full AgentFS support, so an agent’s file writes land on a filesystem the engine controls — every write captured and attributable, full write control over what an agent may touch and a durable record of what it did.

Text is tainted until proven clean Shipping

The nastiest attacks arrive as text. Tixim types untrusted text as tainted at the boundary — tool output, web content, third-party source — and tracks every check as type state (tix-tainted-string). Filters set flags as they validate; sinks fail closed when a required flag is missing. Forgetting a sanitization step is a compile-time-shaped bug, not a silent hole.

The unicode filter enforces a strict deny-list against Trojan Source (CVE-2021-42574): bidirectional override characters, zero-width and invisible codepoints, homoglyph confusables — the machinery of code that reads one way to a human and another way to a compiler. The same policy runs as a pre-commit hook over Tixim’s own repository.

The orchestrator adds a three-layer threat scan on every incoming intent — deterministic pattern matching, a sanitizer pass, and a model-based injection detector; critical findings hard-deny regardless of source.

The supply chain must reproduce Building

Everything is built by Nix from pinned inputs, attested in DSSE/SLSA envelopes, and — through the guild system — certified only by independent reproduction under stake. The next step locks the release artifact itself: a declared release folder that any builder must reproduce byte-identically, encrypted deterministically so even the sealed blob has the same identity across builders. Non-reproducible content becomes a hard failure with a diff naming the offending file — not a warning. Horizon

Workflows that audit source code Horizon

The endgame turns the platform on its own inputs: AI workflows doing full supply-chain analysis of third-party source before it is allowed near a build — unicode and homoglyph attacks at repository scale, loader and dropper patterns, obfuscated and encrypted payloads, dependency confusion. The shipping pieces above (taint tracking, unicleaner, committee review, sandboxed analysis steps) are the kernel of that system; composing them into standing audit workflows for every dependency bump is where this goes.

Verification will not stop at userspace, either: enforcing that only files from verified, signed closures can execute — integrity enforcement rooted in the kernel — is on the research track. Horizon

From CVE to contained, in seconds Horizon

Put every piece on this page together and you get the scenario the whole architecture is aimed at:

1. A CVE is published. Guild oracles pick it up — and one oracle’s word counts for nothing. Multiple independent oracles must confirm the finding, the same quorum discipline that certifies builds applied to threat intelligence.
2. A signal fires on Sui, severity attached, machine-readable — and fans out through the iroh cloud to every subscribed instance.
3. Instances react instantly. Each one matches the signal against the SBOM artifacts of what it actually runs — not a vendor advisory about software it might have, but a build-time bill of materials for the closures it does have. A service affected by a remote-code-execution finding is frozen via cgroups in seconds — suspended mid-flight, not politely asked to shut down.
4. The fix pipeline starts. It incorporates the upstream patches, runs the tests, and analyzes the complete supply-chain delta — every change swept for backdoors, loaders, unicode attacks. A CVE’s urgency is exactly when an attacker hopes you’ll merge without looking; the pipeline looks harder under pressure, not softer.
5. Models agree, builds fire. When the source checks out and the review models agree on the bugfix, emergency builds trigger with optimizations off — correct binaries first — while the normal optimized build takes its course behind them.
6. Signed rebuilds propagate, and frozen services thaw onto patched closures.

From remote-code-execution detected to the service frozen: seconds. To new builds rolling out: minutes. That is the goal — not a patch Tuesday, a reflex.