Operations

Run Ovara day-to-day: approvals, containment, hardening, and deployment.

Approval workflow

Escalated decisions move through continuation states, queried and resumed via the API:

escalated -> approved -> queued -> ready -> executed

Terminal and control states include failed, timed_out, denied, expired, cancelled, and resumed - listable via GET /v1/continuations?state=approved. Walk it end to end:

cd examples
./start_gateway.sh        # in another terminal
./demo_approval_flow.sh   # escalate -> approve -> resume -> verify
./demo_safe_shell.sh
./demo_restricted_agent.sh

After repeated escalations an agent may be auto-restricted.

Containment

Restrict a drifting or compromised agent at runtime:

POST /v1/shield/restrict/{agent_id}

Shield endpoints expose anomaly signals and trust-degradation hooks alongside restriction.

Production hardening

• AppArmor mandatory access control profile
• eBPF ring-buffer syscall interceptor
• Seccomp syscall allowlist (~130 syscalls)
• Firecracker microVM sandbox config
• Multi-region Terraform Kubernetes manifests with gateway autoscaling
• systemd, Docker, and Docker Compose deployment

Sandboxed shell execution is opt-in per action surface:

OVARA_SANDBOX_ENABLED=true

Configuration

The gateway starts on :8080 with the bundled policy in etc/:

./ovara-gateway                              # uses etc/config.json
OVARA_CONFIG=./etc/config.json ./ovara-gateway

Validation

# All Go modules: build, vet, test, race
make check

# One module at a time
cd runtime/gateway && go test -race -count=1 ./...
cd identity && go test -race -count=1 ./...
cd trust && go test -race -count=1 ./...

# TypeScript modules
cd cloud/control-plane && npm test
cd apps/admin-dashboard && npm test

# Python SDK
cd sdk/python && pytest

875+ test functions across the gateway's 29 packages, 0 data races, 100% TypeScript strict-mode compliance, 70+ Python test cases.