THE EXECUTION DATA PLANE

Confined execution.
Observed outcomes.

Give software a place to run, a boundary it cannot quietly cross, and an answer you can inspect.

Substrate is a standalone Linux execution service. It owns guarded workspaces, bounded processes and interactive sessions. Every mutation has a durable operation record; every advertised capability comes from a machine probe.

Run your first workspace →Follow an operation

Rust · Apache-2.0 · Development contract

01 / CONFINE

A boundary with teeth

Guarded filesystem access, read-only inputs, a private network namespace, process and memory bounds, and whole-tree termination.

Six confinement adapters →

02 / RECORD

Durable before dispatch

An operation is recorded before effects begin. A lost connection leaves an identity to reconcile, instead of a reason to blindly repeat a command.

03 / OBSERVE

Facts, including uncertainty

Inspect exit status, captured output, resource usage and applied isolation. If execution cannot be proved, Substrate reports an unknown state or a named refusal.

SECURITY BOUNDARIES

Policy above. Enforcement below.

Callers such as Mantle decide what work to request. Substrate admits and confines it on a trusted Linux host. The host administrator, daemon and kernel remain inside the trusted boundary.

Caller · SDK · Mantle · local MCP adapterIntent, credentials and placement decisions

↓ Personal profile: owner-permissioned Unix socket + kernel peer credentials

TRUSTED LINUX HOST

Substrate daemon

Authenticates the caller, admits operations and rechecks verified capabilities.

Private durable state

SQLite operation ledger, resource observations and bounded captured output.

↓ Host driver applies the confinement boundary

CONFINED PROCESS / INTERACTIVE SESSION

Your argv, under explicit bounds

/workspaceWritable, guarded tree

/runtimeOptional verified read-only capsule

host rootsExplicit read-only inputs

Cleared and shaped environment · no nested user namespaces · PID and memory/swap bounds · output limits · timeout and cancellation

Network: no egress by default. An explicitly admitted aperture connects to a declared destination under a byte ceiling.

The personal deployment boundary. Hosted admission adds a separately verified trust envelope; it is not supplied by a caller-chosen HTTP identity. Deployment postures →

What this protects

Workspace paths cannot escape through traversal or links. Missing enforcement is a refusal. Resource bounds and observations describe the actual selected host.

What remains trusted

This is not protection from a compromised host administrator or kernel. Captured process output is durable state; applications must keep secrets and login codes out of it.

START WITH OBSERVATION

Ask the machine what it can enforce.

Start a personal daemon with an explicit allowed UID, then inspect its verified capability facts. Enabling process execution additionally needs bubblewrap, socat and delegated cgroup v2 controllers.

Complete setup and workspace round trip →

BASH · INSPECT A RUNNING PERSONAL DAEMON

# Use the private socket from the setup guide.
curl --silent --show-error --fail-with-body \
  --max-time 30 \
  --unix-socket ./run/substrate.sock \
  http://localhost/v1/machine | jq

BUILD ON THE BOUNDARY

One primitive. Several ways to use it.

Application workers

Run ordinary binaries with explicit bounds and inspect their outcomes.

Run a command →

Agent environments

Mantle composes Substrate into interactive development sessions. Substrate itself owns no agent loop or fleet scheduler.

Explore Mantle →

Integrations

Use the Rust SDK or a disposable local MCP adapter through the same daemon boundary.

Rust SDK → MCP →

If the machine cannot prove it,
Substrate does not claim it.

Read the documentation →

Confined execution.Observed outcomes.