ADR 0001 — Nested-virtualization substrate with microVM sandboxing

Status

Historical acceptance-design decision; its runnable VM/microVM fixture is retired. It is not the current operator-reported runtime design. See overview.

Context

The former fictional acceptance design considered AI-agent fixtures that might be misdirected by untrusted input. Shared-kernel containers alone are a weak boundary for an agent job that might be compromised or coerced at runtime.

Decision

The historical proposal placed a fictional workload inside a golden KVM VM and higher-risk jobs in Kata microVMs with denied egress, timeout, and teardown checks. Nested virtualization would require a boot test before reliance on that design; no such current-runtime test is claimed here.

Consequences

• A separate kernel per proposed job was a design objective, not a current measured result.
• Hardware virtualization and /dev/kvm would be prerequisites for that retired fixture.
• The current operator report instead describes a generic host, operator-core VM, logical realm grouping, and individual agent sandboxes. It does not establish outer containment or realm isolation.