A.C.E - A.C.E — Aegis Containment Engine. Auditable, layer

项目说明

<p align="center">
<img src="docs/assets/ace-social-preview.png" alt="A.C.E — Aegis Containment Engine" width="100%" />
</p>

<p align="center">
Auditable, layered AI containment for systems that must survi.<br/>
Built by <a href=" X AI</a>.
</p>

<p align="center">
<a href=" src=" alt="CI" /></a>
<img src=" alt=" 0.3.2" />
<img src=" alt="Maturity: prototype" />
<img src=" alt="Python" />
<img src=" alt="License" />
<img src=" alt="Defensive only" />
</p>

---

No unbreakable AI. No magic perimeter.
A.C.E assumes breach and rigorously limits what can leave a workload in usable form — with re e, honest maturity labels, and measurable catch rates.

> Assume breach. Contain egress. Measure e.

Maturity

| Label | Meaning |
|-------|---------|
| Prototype | Working end-to-end demos, CI-gated tests, real sandbox backends, red-team harness |
| Not production-hardened | TEE quote stubs, rule-based guardians (LLM-judge optional), process sandbox on nested hosts is isolation-limited |

We separate research, prototype, and production boundaries on purpose. Claims stay conser.

What A.C.E is

A composable containment stack you wrap around model and agent workloads:

1. Ingress — field encryption, IFC labels, tunnel policy
2. Boundary — pluggable sandbox runtime + instrumented execution
3. Egress — output guardians, rate limits, session kill
4. Audit — hash-chained tamper-e logs + compliance export

Perfect blocking is impossible under neural compression and side channels. A.C.E inverts the problem: run the work, control the exit, prove what happened.

Architecture

Quickstart

Pro (no GPU)

Local mock agent (full stack, laptop-friendly)

Real model paths

| Path | When to use |
|------|-------------|
| HF Inference API | Llama via HF_TOKEN + router — no GPU download |
| Local HF weights | Small ungated models on a GPU pod |
| Integration guide | Wire Ollama / vLLM / your handler |

Tests

Layers

| Layer | Module | Why it matters |
|-------|--------|----------------|
| Field encryption | crypto/encryption_fields | Shrinks plaintext blast radius |
| Weight obfuscation demo | crypto/equi | Linear similarity transform — not encryption |
| Information flow control | ifc/ | BLP sensitivity + integrity via dominates() |
| Agent label tracking | ifc/agent_planner | Propagates labels through tools and memory |
| TEE abstraction | execution/tee_* | Attestation binding (adapters + stub ) |
| Instrumented runner | execution/instrumented_runner | No silent bypass of inference |
| Output guardian | guardians/output_guardian | PII, entropy, stego, canaries |
| Egress controller | guardians/egress_controller | Throttle / block / kill session |
| Tamper-e log | audit/tamper_proof_log | Hash-chained append-only trail |
| Metrics + export | audit/metrics, compliance_export | Effecti score, submission packs |
| Red-team harness | redteam/simulator | Self-auditing stress scenarios |
| Sandbox runtime | sandbox/ | bubblewrap · Docker · process (gVisor/Firecracker registered, not yet functional) |
| Tunnel gateway | tunnel/ | Policy-controlled ingress/egress |

Sandbox backends

Registry-driven. Real isolation only — no fake in-process “sandbox.”

| Platform | Auto order |
|----------|------------|
| Linux | bubblewrap → docker → process (if allowed) |
| Nested containers (e.g. RunPod) | often process (separate OS process; not namespace isolation) |
| Windows / macOS | Windows Sandbox → Docker fallback |

Policy: policy.yaml · env: ACE_SANDBOX_BACKEND

Callable workloads must be registered with ("name") before isolated execution.

E o

A.C.E is built for review:

Defense stays defensive. No offensi generation.

Known limitations

Documentation

| Doc | Contents |
|-----|----------|
| Architecture | Layer model and design intent |
| Sandbox + Tunnel | Isolation and boundary gates |
| Integration | Ollama, RunPod, TEE notes |
| RunPod quickstart | Smoke, HF weights, Inference API |
| Roadmap | Phased extension plan |
| Docs index | Full index |

Contributing & security

License

Copyright (C) 2026 Fratres X AI

Dual licensed:

| Path | Terms | When to use |
|------|--------|-------------|
| Open source | AGPL-3.0-or-later | Audit, research, and use that complies with AGPL (including network source offer) |
| Commercial | Paid license from Fratres X AI | Proprietary / closed-source products or SaaS where AGPL obligations are not acceptable |

See LICENSING.md and COMMERCIAL_LICENSE.md.
Commercial inquiries: fratres-x.com

Fratres X AI

A.C.E is part of the Fratres X AI lab — re AI, autonomy, and defensi prototypes with physics-first modeling and honest maturity labels.

Site: fratres-x.com · Org: Fratres-X-AI

项目信息

开发语言：Python

Star 数：2

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A.C.E — Aegis Containment Engine. Auditable, layered AI containment. Assume breach. Contain egress. Measure everything. By Fratres X AI.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。