Glossary

A worker that pulls self-contained jobs from sources and runs each with one capability from a closed toolbox. This glossary fixes the words used to say what it defends and what it does not.

Language

Trust

Operator: The person who installs and configures sandcastle. Theirs are the only choices that count. Avoid: Admin, owner, user

Trusted base: Everything the promise rests on and promises nothing against: the operator, the machine, the configuration and sandcastle itself. Avoid: Trust root, TCB

Promise: What an attacker cannot achieve. Whatever is not in the promise is written down as outside it. Avoid: Guarantee, security model

Parts

Core: The part of sandcastle that decides what runs: it asks the sources for jobs, starts a box for each and sends the result back. It reads the envelope of a job and never opens its content. It holds no secrets and names a destination, never an address. Avoid: Runner, host process, daemon

Box: Where a capability runs for one job. It starts clean, holds no secrets, has no network, and nothing of it remains. Avoid: Sandbox, container, jail

Keep: The one place the secrets live. It adds the right secret to a request the core hands it and sends it to the destination the operator configured. It never gives a secret out and never opens the content of a job. In the trade: a credential broker. Avoid: Vault, keys box, secret store

Secret: A key or token the keep adds to a request for one destination. The configuration names it, and only the keep ever reads its value. Avoid: Credential, token file, key file

Gate: The only way out to the network. Everything sandcastle sends leaves through it, and it lets through only what the operator allowed. In the trade: an egress proxy. Avoid: Network box, firewall, proxy

Network

Destination: A named place sandcastle may send to, written by the operator. Each source and each capability that goes out has its own. The core says the name, the keep knows the address and the secret, and the gate lets through only these. Avoid: Endpoint, target, upstream, allowlist entry

Internal network: The address ranges closed by default: private, CGNAT, loopback and link-local. Never the network between the keep and the gate. Avoid: LAN, private network, intranet

Internal exception: One concrete internal address and port the operator opened for one destination. Avoid: Whitelist entry, bypass, hole

Sealed: Said of the addresses that never open, not even by an internal exception. Avoid: Hard block, blacklist, forbidden range

Refusal: The gate saying no to a connection, with a recorded reason. Avoid: Block, drop, deny, rejection

Releases

Version: A numbered, published point of sandcastle that passed every test of the promise. Only a version keeps the promise; what lies between versions is work in progress. Avoid: Release candidate, snapshot, latest

Build: One compiled sandcastle, named by its own fingerprint. It says what is installed, not what was published. Avoid: Version, revision