Svalinn

Post-Cloud Security Architecture: Edge gateway for verified container operations.

Svalinn is a Deno-based HTTP gateway that validates container operation requests and delegates to Vörðr. It provides REST API access, JSON Schema validation, policy enforcement, OAuth2/JWT authentication, and a Compose-compatible orchestration CLI (svalinn-compose).

Project Status

Component	Status	Description
Edge Gateway	Complete	Hono-based HTTP server with JSON Schema validation (Deno)
Vörðr Integration	Complete	MCP/JSON-RPC client delegating to Vörðr
Policy Engine	Complete	Configurable allow/deny rules per operation
Authentication	Complete	OAuth2/OIDC + JWT token validation middleware
svalinn-compose	Complete	Compose-compatible multi-container orchestration CLI

Architecture

                    ┌─────────────────────────────────────────────┐
                    │         VERIFIED CONTAINER ECOSYSTEM        │
                    └─────────────────────────────────────────────┘
                                          │
          ┌───────────────────────────────┼───────────────────────────────┐
          │                               │                               │
          ▼                               ▼                               ▼
  ┌───────────────┐            ┌─────────────────┐            ┌─────────────────┐
  │   SVALINN     │            │     VÖRÐR       │            │  CERRO TORRE    │
  │  Edge Shield  │───────────▶│   Container     │◀───────────│    Builder      │
  │ (ReScript/    │  delegates │    Engine       │  produces  │   (Ada/SPARK)   │
  │    Deno)      │            │  (Rust/Ada)     │            │                 │
  └───────┬───────┘            └────────┬────────┘            └─────────────────┘
          │                             │                               │
          │         ┌───────────────────┴───────────────────┐           │
          │         │                                       │           │
          ▼         ▼                                       ▼           ▼
  ┌───────────────────────────────────────────────────────────────────────────┐
  │                      VERIFIED-CONTAINER-SPEC                              │
  │                   (Protocol Specification)                                │
  │         Attestation Format │ Trust Model │ Verification Semantics         │
  └───────────────────────────────────────────────────────────────────────────┘

What Svalinn Does

• Edge Gateway — REST API for container operations (Hono/Deno)

• Request Validation — JSON Schema validation against verified-container-spec

• Delegation — Forwards verified requests to Vörðr via MCP/JSON-RPC

• Policy Enforcement — Configurable allow/deny rules per operation type

• Authentication — OAuth2/OIDC and JWT token validation

• Compose Orchestration — Multi-container deployment via svalinn-compose

What Svalinn Does NOT Do

• Container Runtime — That’s Vörðr

• Image Building — That’s Cerro Torre

• Formal Verification — That’s the Idris2/Elixir layers in Vörðr

Getting Started

Prerequisites

# Deno runtime (>= 2.0)
curl -fsSL https://deno.land/install.sh | sh

# Just command runner (optional but recommended)
cargo install just

Configuration

export SVALINN_PORT=8000           # Gateway port (default: 8000)
export SVALINN_HOST=0.0.0.0        # Bind address (default: 0.0.0.0)
export VORDR_ENDPOINT=http://localhost:8080  # Vörðr MCP endpoint
export SPEC_VERSION=v0.1.0         # Spec version for validation

Build and Run

# Development (hot reload)
just dev

# Production server
just serve

# Compile to binary
just build

# Run tests
just test

svalinn-compose

Compose-compatible orchestration with security extensions.

# Start services defined in svalinn-compose.yaml
svalinn-compose up

# Start in detached mode
svalinn-compose up -d

# Stop and remove containers
svalinn-compose down

# List running services
svalinn-compose ps

# View logs (follow mode)
svalinn-compose logs -f web

# Scale a service
svalinn-compose scale web=3

# Validate compose file
svalinn-compose config

Compose File Format

version: "1.0"
services:
  web:
    image: nginx:alpine
    ports:
      - "8080:80"
    x-svalinn:
      policy: strict
      verify: true

x-svalinn:
  policy: standard
  attestations:
    require-sbom: true
    require-signature: true

REST API

Endpoint	Method	Description
/healthz	GET	Health check with Vörðr connection status
/v1/containers	GET	List all containers
/v1/containers/:id	GET	Get container info
/v1/run	POST	Run a container (validated against schema)
/v1/verify	POST	Verify image attestations
/v1/containers/:id/stop	POST	Stop a container
/v1/containers/:id	DELETE	Remove a container
/v1/images	GET	List images

Project Structure

svalinn/
├── src/
│   ├── main.ts             # HTTP gateway entry point
│   ├── gateway/            # Request routing
│   ├── validation/         # JSON Schema validation
│   ├── policy/             # Policy engine (evaluator, store)
│   ├── auth/               # OAuth2, JWT middleware
│   ├── compose/            # svalinn-compose orchestrator
│   ├── integrations/       # Cerro Torre, verified-container-spec
│   ├── vordr/              # Vörðr MCP client
│   ├── mcp/                # MCP tool definitions
│   └── tests/              # Test suite
├── spec/                   # JSON Schema definitions
│   └── schemas/            # gateway-*.json, container-*.json
├── Justfile                # Build commands
└── deno.json               # Deno configuration

Integration with Svalinn Ecosystem

Component	Role	Link
Vörðr	Container engine with formal verification	vordr
Cerro Torre	Provenance-verified image packaging	cerro-torre
verified-container-spec	Protocol specification	verified-container-spec

Development

Justfile Commands

just                    # List all commands
just dev                # Development server (hot reload)
just serve              # Production server
just build              # Compile to binary (dist/svalinn)
just test               # Run test suite
just check              # Type check
just lint               # Lint code
just fmt                # Format code
just precommit          # fmt + lint + check + test

Contributing

• Language Policy: Deno/TypeScript only (no Node, npm, bun)

• Security: HTTPS in production, no hardcoded secrets

• Licensing: PMPL-1.0 OR PMPL-1.0-or-later, SPDX headers required

License

This project is dual-licensed under:

• Palimpsest-MPL-1.0 License

• PMPL-1.0-or-later

See LICENSE.txt for details.

References

• Vörðr Container Engine

• Verified Container Specification

• Cerro Torre Builder

• ReScript

• Deno

• Model Context Protocol