Overlord Adds Transactional Isolation and Auditing for AI Agents

Summary

Overlord is an open-source, model-agnostic execution layer for programs and AI agents. It gives each run a writable copy of a target directory, records file mutations and their causes, and keeps changes out of the real tree until a person commits them. On the Linux kernel backend, capability grants can restrict paths, network access, execution time, and resource usage through namespaces, overlay filesystems, AppArmor, seccomp, No New Privileges, cgroups, and resource limits; a FUSE backend is available but does not claim to provide the same jail or network guarantees. Sessions support manifests, savepoints, rewind, resume, fork, comparison, selective commit, rollback, conflict detection, and line-level blame linked to sessions, turns, tool calls, and prompts. The built-in agent can use Anthropic, OpenAI, Azure OpenAI, OpenAI-compatible endpoints, or Gemini, with streamed replies, provider-specific generation settings, live model listing, usage accounting, and safeguards that prevent truncated or refused replies from executing tool calls. Model Context Protocol connectors run outside the transaction, so each connector is granted explicitly, non-read-only calls pause for approval, and calls, decisions, and results are added to a keyed audit chain because they cannot be undone. The project also includes a localhost web workspace, a document-oriented review console, accounts and roles, TLS and OpenID Connect support, policy brokering through a daemon and SDK, project and user memory, skills, webhooks, vault-backed secrets, cost budgets, signed exports, retention, and optional off-box audit witnessing. Its threat model explicitly excludes kernel exploits and determined user-namespace escapes. The repository describes the project as Linux-specific, with WSL2 and Docker deployment paths for Windows and macOS hosts, and identifies the strong containment guarantee as dependent on the kernel backend.