README
¶
lockfile
lockfile lets an AI agent ask yes/no questions about a file it must never
read. A separate OS account fetches the file from S3, SFTP or a local
directory, runs signed, sandboxed plugins on it, and returns only each
plugin's answer: 1 or 0. No byte of the file, its name, size, type or
path ever reaches the agent. Plugins come from a signed marketplace
(lockfile-marketplace).
Status: early development; the console, CLI and MCP server are not there yet.
Directories
¶
| Path | Synopsis |
|---|---|
|
Package index is the format of a marketplace's signed index.json: every plugin, its versions, the manifest hash and the per-platform artifacts.
|
Package index is the format of a marketplace's signed index.json: every plugin, its versions, the manifest hash and the per-platform artifacts. |
|
internal
|
|
|
answers
Package answers runs plugins on a fetched file and turns their outcomes into what the agent may see: per plugin 1, 0, or no answer with a code from a closed list.
|
Package answers runs plugins on a fetched file and turns their outcomes into what the agent may see: per plugin 1, 0, or no answer with a code from a closed list. |
|
marketplace
Package marketplace installs plugins from a signed marketplace index: the index, then the artifact, are checked against the marketplace's trust root, and every downloaded byte against the hashes the signed index lists.
|
Package marketplace installs plugins from a signed marketplace index: the index, then the artifact, are checked against the marketplace's trust root, and every downloaded byte against the hashes the signed index lists. |
|
plugin
Package plugin is the local plugin store: verified plugin binaries and manifests under <Dir>/plugins/<qualified name>/<version>/ (0500), and <Dir>/plugins.lock recording what was verified at install time.
|
Package plugin is the local plugin store: verified plugin binaries and manifests under <Dir>/plugins/<qualified name>/<version>/ (0500), and <Dir>/plugins.lock recording what was verified at install time. |
|
source
Package source fetches one object by its exact key from S3 (or an S3-compatible store), SFTP or a local directory.
|
Package source fetches one object by its exact key from S3 (or an S3-compatible store), SFTP or a local directory. |
|
verify
Package verify checks signatures of marketplace indexes and plugin artifacts against a trust root.
|
Package verify checks signatures of marketplace indexes and plugin artifacts against a trust root. |
|
workspace
Package workspace holds fetched files in the lockfile account: one private directory per handle, a random file name, never the source name.
|
Package workspace holds fetched files in the lockfile account: one private directory per handle, a random file name, never the source name. |
|
Package pluginspec is the lockfile plugin contract: the signed manifest a plugin ships with, and the rule that turns a plugin's stdout and exit status into an answer.
|
Package pluginspec is the lockfile plugin contract: the signed manifest a plugin ships with, and the rule that turns a plugin's stdout and exit status into an answer. |
|
Package sandbox runs one plugin binary on one input file under Landlock, seccomp-bpf and rlimits, and turns what it produced into a pluginspec.Outcome.
|
Package sandbox runs one plugin binary on one input file under Landlock, seccomp-bpf and rlimits, and turns what it produced into a pluginspec.Outcome. |
Click to show internal directories.
Click to hide internal directories.