Nice use of Rust for the sandbox layer. One thing that helped in our multi-agent experiments was giving each agent its own key and having every tool call carry a signed receipt. That makes debugging a lot easier because you can at least answer "which agent requested this call with these params?"
If delegation is involved, carrying the delegation proof alongside the receipt helps explain why agent B thought it was allowed to act.
It is now fully functional, thoroughly tested. Given the multitude of available applications that are probably more practical than Lula, I just wanted to show /share this and hope that it finds at least some application somewhere!
This is another project I'll take this opportunity to share:
The sandbox degradation path (Firecracker, Linux namespaces, SafeFallback) is really pragmatic. Most projects in this space just skip the isolation story entirely. What's the latency overhead like for a typical tool call going through the Firecracker vsock path vs SafeFallback?
If delegation is involved, carrying the delegation proof alongside the receipt helps explain why agent B thought it was allowed to act.
reply