Cell
A standalone library, CLI and MCP server with no Ephemora dependency. Enforced limits on fuel, memory, time and I/O, and signable execution records you verify yourself with your own keys.
Read what is measured →EPHEM0RA ENTERPRISE · NOT RELEASED
Temporary execution for permanent responsibility.
For organizations that need governed execution, deployment control and verifiable evidence. The enterprise edition is the layer that operates Cell's boundary, from policy and key custody to the evidence an auditor accepts. It is not released. There is nothing to install here, nothing to buy, and this page describes work in design.
ENTERPRISE · STATUSNOT RELEASED
artifact NONEinstall path NONEconversations OPEN
WHO IT IS FOR
For environments that cannot afford permanent risk.
EnvironmentWhat runs thereWhat the boundary holds
Agent platformsAI
Code an assistant wrote minutes earlier, pointed at services you own.
Fuel, memory and time for one run, and a record of what that run did.
Customer productsSAAS
Uploads, plugins and scripts that customers bring with them.
The files and the network a tenant may reach, and nothing a tenant may not.
Build pipelinesCI/CD
Generated code that a pull request places inside your build.
Nothing outside the folders the job was given, and no network to send them to.
Edge and on-premAIR-GAPPED
Code that has to run where nothing may phone home.
Network closed by default and no cloud account standing in the middle.
THE GOVERNANCE LAYER · NOT RELEASED
Govern the boundary.
Keep the evidence.
The enterprise edition is being built on Cell's isolation primitives, not around them: the controls an organization needs in order to run that boundary at scale. Cell ships today. This layer does not.
POLICYIDENTITYKEYSEVIDENCEON-PREMAIR-GAPPED
THE DIFFERENCE IN ONE LINE
One boundary.
Two different jobs.
Cell is complete for isolation. The enterprise edition is complete for operation. That is the whole difference, and the reason most teams start with the layer that ships today.
Enterprise
What the layer is being designed to do: collect records and alert on them across thousands of runs a day, keep tenants apart, hold the keys, and hand an auditor evidence in a form they accept. None of it exists to install.
Ask what is real today →When Cell is enough
One process, your own logging, receipts you verify on your own machine. If that describes your workload, use Cell and skip the conversation — that outcome is intended.
Source and README →WHAT CELL DELIBERATELY LEAVES OPEN · IN DESIGN
Four questions that decide
whether you need the conversation.
Cell reports what happened in a run. It does not decide who collects the report, who separates tenants, who holds the keys or who upgrades the engine. Those four answers are where the enterprise edition starts.
01 · OVERSIGHTWho watches the walls?
Cell emits the baseline, the budget counters and a signable record. Someone has to collect, store and alert on those across thousands of runs a day.
02 · TENANCYWho stays in their lane?
Cell isolates one module execution. Concurrent tenants, their sandbox directories and their audit trails are a separate boundary question.
03 · CUSTODYWho can revoke a key?
Tamper-evident records only help if you decide where they live, how long they stay, and in what form they reach an auditor.
04 · OPERATIONWho runs it on a bad day?
Engine upgrades, pool sizing, fleet observability, and the incident process for a guest that misbehaves.
THE AUDIT CONVERSATION
Designed to support your controls, not replace them.
Ephem0ra is an execution and evidence layer. It supports the controls your team operates and does not replace them, and no sandbox installation discharges an obligation under a law or a framework.
PROGRAM STATUSNO BUILD TO HAND OUT
Architecture discussed under NDA · on-prem is the direction · air-gapped is documented against hardware attestation and is not this build
WHAT EXISTS TODAY Cell v1.1.0 on PyPI with its committed evidence, and the framework mappings we maintain for our own review. A certificate name on this page would be a claim we cannot produce an audit for.
EVIDENCE ON RECORD · RAW JSON ARCHIVED
Tested against every attack
we could source.
Not a marketing number. A count. The corpus replays published attack classes from independent public sources, dated, hashed and archived, reproducible on request.
4,911attack payloads in the sealed corpus run · 2026-10-01
201attack classes · 7 independent public corpora
4,810flagged by the scan layer · 41 on code behaviour, 4,769 on malformed input
19,740signed execution records from our own runs · counted 2026-10-06
Detection and enforcement are separate claims. The scan layer flags 97.9% of the corpus, but only 41 payloads are flagged as code doing something wrong; the rest trip on malformed input. Enforcement is measured only where the corpus labels an expected block: 47 of 62, so 75.8%, and the 15 misses are documented. Every decision, blocked or allowed, is written into a signed execution record. All of it measured on our own build and our own runs — there is no customer fleet behind these numbers, and the product on this page is not released. The corpus and the runner behind 97.9% and 75.8% are internal, so unlike the Cell figures these cannot be replayed from a public repository yet.
START THE CONVERSATION · NOT RELEASED
Bring one workload you cannot put in anyone else’s cloud.
Tell us what should run temporarily, what must remain under your control and what evidence your team needs. Teams that want a say in how this layer is built are the ones it is being designed for; teams that need the boundary today start with Cell.
← drag, scroll or use arrow keys →