06 Isolation and Storage

06 Isolation and Storage

Source: docs/design/06-isolation-and-storage.md

Execution isolation

Shell runs in the OS sandbox (10-Sandbox). File tools go through a path gateway (soft isolation). Browser sessions are per-Bot. App data directory is never grantable.

Data access matrix

Bots see their own memory/wiki/skills; project wiki is shared within a project; workdir is shared by conversation members under lease; secrets never enter the model as raw values (aliases / configured flags).

Concurrency isolation

One writer per data class where needed (wiki maintenance queues, workdir write lease, settings write lock). Readers generally unrestricted.

Trust isolation

Untrusted content (mail, web fetch, watch summaries, share intakes) wrapped in <untrusted> markers. Memory writes filtered to reduce prompt-injection pollution.

Overall data flow

UI ↔ core RPC → agent loop → tool gateway → sandbox / providers / MCP. Persistence in encrypted SQLite + filesystem blobs under ~/.kepcup/.