NaZelo documentation

The NaZelo family: a sandbox that runs code you do not fully trust, a policy that decides what it may reach, and a signed chain that proves what happened.

Everything here is for someone using it — running a workload, integrating the engine, or verifying evidence it produced. Nothing here depends on anything unpublished.

NaZelo — the engine

NaZelo runs a command under layered isolation and produces signed, verifiable evidence of exactly what ran, how it ran, and why it was allowed.

• Getting started — from a fresh install to a command in the sandbox, its evidence collected and a token verified
• Reference — trust levels, presets, network and L7 stream-proxy enforcement, seccomp process governance, capability tokens, evidence events, configuration, the full CLI and Python API, the security model and its limits

NaZelo Trust — the composition

Three engines, one guarantee: PimaTika decides egress from a signed manifest, NaZelo enforces the decision, Litatoli seals the evidence — one command, correlated by one run_id.

• NaZelo Trust — start here, including the two narrower compositions that ship beside it: nazelo-policy (decided and enforced) and nazelo-evidence (isolated and sealed)
• Installing · Getting started · The conclusive test
• Operating limits — read this before trusting a result: enforced is not attested, and TLS hides things
• Disclosure policy — what leaves the machine, your choice, safe by default

Where the guarantee stops

Both products say so in their own words, and both are worth reading before you rely on either. NaZelo enforces at the node; it cannot attest what a guest kernel did to itself. NaZelo Trust correlates three engines; enforced and attested are different claims.

• NaZelo — security model and limitations
• NaZelo Trust — operating limits
• Evidence contract — the canonical model of what NaZelo Trust proves
• Integration contract — what the three engines guarantee together, what they need, and what they do not do

Beside the code

These ship with the source, because they are about building it:

• Firecracker rootfs and kernel — building the TL4 microVM artifacts

Licences

NaZelo and NaZelo Trust are source-available, not open source: Business Source License 1.1, converting to Apache-2.0 on 2030-07-30. You may read, build, run in production and audit them; you may not offer them to a third party as a hosted service.

The critical-domain packages — nazelo-critical and nazelo-trust-critical, which add simulated protocol peers — are proprietary and documented with the package.

For alternative arrangements: support@nazelo.dev

---

Questions and issues: https://github.com/theAIstep/nazelo/issues