Execution Surfaces

Ovara intercepts 11 execution surface types. Every surface routes through the same decision pipeline: identity, lease, policy, trust, receipt.

Surfaces

Surface	Examples
shell	shell:git push origin main, shell commands
exec	Direct process execution
git.push	Push to remotes
git.pull	Pull from remotes
git.fetch	Fetch from remotes
git.checkout	Branch and ref checkouts
github.push	GitHub push events
github.pr	Pull request operations
github.merge	Branch merges into protected branches
github.delete_branch	Branch deletion
ci.trigger	CI/CD pipeline triggers
shell.sandboxed	Opt-in sandboxed execution (OVARA_SANDBOX_ENABLED=true)

The core check endpoint

curl -X POST http://localhost:8080/v1/runtime/check \
  -H "Content-Type: application/json" \
  -d '{
    "action_type": "shell",
    "resource": "shell:git push origin main",
    "agent_identity": { "issuer": "ovara", "subject_id": "agt_001" },
    "environment": "dev"
  }'

Batch checks

POST /v1/runtime/batch-check

Evaluate many actions in one round trip.

Approval workflow

Escalated decisions move through a continuation state machine:

escalated -> approved -> queued -> executing -> executed

With race-safe atomic claiming, panic recovery, and a stuck-executing sweep. After repeated escalations an agent may be auto-restricted.

Containment

Compromised or drifting agents can be restricted at runtime:

POST /v1/shield/restrict/{agent_id}

Shield endpoints expose anomaly signals and trust-degradation hooks.

Production hardening

• AppArmor mandatory access control profile
• eBPF ring-buffer syscall interceptor
• Seccomp syscall allowlist (~130 syscalls)
• Firecracker microVM sandbox config
• Multi-region Terraform Kubernetes manifests
• systemd, Docker, and Docker Compose deployment