/runtime/architecture
The runtime
Your agent framework talks to NeuronEdge Enclave's unprivileged front door. Everything privileged — the microVMs, the privacy router, the audit chain — sits behind a peer-cred-authenticated socket. In confidential mode the whole host is a SEV-SNP CVM.
your code
Agent framework — LangChain · Mastra · CrewAI · custom
confidential tier · SEV-SNP CVM — memory-encrypted + attested
host · linux + kvm
ne-apiunprivilegedthe front door
ne-supervisorprivileged
- Firecracker microVMper workspacestandard tier
└ guest agent over vsock
- deny-by-default egressnetns + TAP
└ privacy router optional · PII on cleartext HTTP
- signed audit chaintamper-evident
/runtime/workspace
Every workspace, regardless of tier
- A separate execution boundary (kernel or Landlock/seccomp/netns sandbox)
- A network namespace with deny-by-default egress
- An optional privacy router that redacts PII on cleartext HTTP egress
- A signed audit event for every action
- Snapshot / fork / warm-pool primitives for agent planning loops
/runtime/tiers
Standard vs. confidential
Standard tier
firecracker · default- Isolation
- Separate kernel (hardware virtualization)
- Boot
- ~1404ms cold · ~2ms warm-pool hit
- Trust model
- Host operator is trusted (no encryption)
Confidential tier
single-CVM-direct- Isolation
- SEV-SNP encryption + Landlock/seccomp/netns
- Attestation
- 2-layer binding: VCEK→ARK + TPM-Quote nonce
- Trust model
- Operator-excluded. TCB = paravisor + UEFI digest
/runtime/api
The surface
The same primitives from Python, TypeScript, or Rust — over gRPC or REST.
$python-sdk
from ne import Client
c = Client("http://127.0.0.1:8080")
# Create a workspace (standard tier by default)
ws = c.create_workspace("my-agent", kernel_image_path="...", rootfs_image_path="...")
# Run a command in the sandboxed workspace
result = c.execute_command(ws.workspace_id, command="pip", args=["install", "requests"])
print(result.stdout)
# Write a file into the workspace
c.write_file(ws.workspace_id, path="main.py", content=b"print('hello')")
# Snapshot + fork (for agent planning loops)
snap = c.snapshot(ws.workspace_id)
forked = c.fork_workspace(snap.snapshot_id, new_workspace_id="plan-b")
# Destroy
c.destroy_workspace(ws.workspace_id)