The agent proposes; you accept; the engine enforces. Every piece of code a KB can run — its validator, its source plugins — is a WebAssembly component whose entire authority is the list of capabilities it imports. That list is checked before a single instruction executes, and the engine is the only thing that can answer it.
A component declares a typed world: exactly the host interfaces it may call. There is no ambient filesystem, network, clock, randomness or environment — an import the world doesn't name is an authority that does not exist. Kyyn reads that list off the artifact and checks it against policy before instantiation, every time.
Zero imports. A validator receives a canonical snapshot of the tree, returns violations, and structurally cannot observe the clock, the network, the filesystem or anything else.
A tap's HTTP goes through the engine, which enforces the host allowlist you consented to, applies size and deadline limits, and attaches credentials itself — secrets never enter the plugin's memory.
Before any component runs, kyyn hashes the bytes against the tree or tap pin, extracts the world and full import set, refuses anything outside the profile, and applies memory, table, stack and time budgets. Over-importing, digest-mismatched or malformed components never instantiate.
A KB is a pair: the tree, and the validation function that accepted it. The validator component is committed in the tree itself — not a recipe for rebuilding it. Any machine with the kyyn binary can re-run the exact predicate that accepted any commit: no toolchain, no build, no network.
Validators run under a pinned deterministic execution profile — no threads, canonical arithmetic, fixed limits. The verdict is a property of the tree, not of whichever machine happened to check it.
Every run has a fuel budget — an instruction allowance metered by the runtime. An accidental infinite loop in a proposed validator is a clean, reproducible rejection, never a hung accept gate.
Each accept records the component digest, its world, the execution profile, configured limits, outcome and fuel consumed.
When your agent proposes a schema change, you review Rust source — so kyyn makes sure the source and the executable can't drift apart.
Staging builds the component from the proposal's source and stages both atomically. At accept, kyyn rebuilds from the reviewed source and requires byte-for-byte equality with the staged component. A changed source tree, build input or artifact breaks the binding — there is no silent fallback.
First-party and third-party components are accepted by digest, like packages from a repository you choose to trust. Kyyn never pretends adjacent source produced them — the review UI labels the trust mode honestly, and the component stays capability-contained at runtime regardless.
Containment tells you what code can do. Deciding what it should do stays with you — which is the whole point.
The runtime is the sandbox, and it's embedded in kyyn itself. Consuming a KB — validating, pulling, reviewing, running taps — needs no Rust toolchain, no OS sandbox packages, no build step. Identical containment on Linux and macOS. A pinned toolchain is used only when you author schema changes, and kyyn installs it on demand.