MetaSpace Membrane

MetaSpace Membrane

A deterministic safety membrane for machine-generated software.

MetaSpace Membrane turns an undecidable question — "is this AI doing the right thing?" — into a decidable one — "is this effect inside the declared boundary?" — and enforces the answer deny-by-default. One .bio constitution, three membranes, two products.

Part of the MetaSpace.Bio Engine Project — Szőke László-Ferenc ([email protected]). Patent pending.

---

Watch the 60-second explainer

Containment, not correctness — the idea in one minute. ▶ click to play

---

Screenshots

The Warden control panel (metaspace ui) — a localhost web UI to configure the membrane per working directory. No config files to hand-edit; every project shows its mode (observe / dry-run / enforcing) at a glance.

The one-line pitch — the agent can be completely deceived; the harmful effect still cannot occur.

---

Why

You cannot prove that a generated program does the right thing (Rice's theorem — undecidable). So we stop verifying intent and contain effects instead. A membrane sits at a chokepoint, reads the constitution, and blocks anything not explicitly granted. A bug becomes a deviation from the constitution — machine-measurable and enforceable.

The guarantee is only as hard as the chokepoint is unbypassable — each tier's exact strength and condition is recorded in docs/CLAIMS.md:

heuristic    ->  language guard  ->  harness hook  ->  WebAssembly
(advisory)       (bypassable)        (hard on agent)   (unbypassable)

Case study — "Friendly Fire" (AI Now Institute, 2026): a prompt-injected coding agent is steered by a malicious repo into running a payload → RCE. We assume the model is fully deceived and still make the effect unreachable. A real functional payload fires without the membrane and never with it. See docs/THREAT_FRIENDLY_FIRE.md · reproduce with python evidence/run_friendly_fire_proof.py.

Install & try (60 seconds)

pip install metaspace-membrane
metaspace install     # user-level, starts in dry-run (observe, no blocking)
metaspace demo        # live self-test: watch it block the attack, then `metaspace enforce`

metaspace demo running the real hook: the agent is assumed fully deceived, yet every attack effect is blocked while normal work still runs.

Requires Python 3.10+ (the hook has zero third-party dependencies — nothing else to install). The membrane installs outside any project's write scope, so a prompt-injected agent cannot disable it. Full guide + honest scope: docs/INSTALL.md.

---

Two products, one engine

	Product A — App membrane	Product B — Agent membrane
Contains	any application ⊂ its .bio	the coding assistant ⊂ its limits
Chokepoint	WebAssembly capability import	Claude Code PreToolUse hook
Guarantee	unbypassable (hard, WebAssembly only)	hard on the agent (sits outside it)
Status	WebAssembly/WASI or OS-sandbox (Landlock): real native programs, kernel-contained	Warden MVP — install → enforce → report loop, proven end-to-end

Both are built on the same core/ decision engine (guard.py) and the same .bio file.

---

Status & maturity