The main thing
MVM: a hard boundary beneath agent behavior
I am building the substrate I want autonomous software to run on: isolated microVMs with no ambient network authority, explicit capability grants, bounded delegation, fresh identity across forks, auditable communication, and receipts that explain what actually happened. The hard part is not launching a VM. It is making sure the controller cannot quietly make itself more powerful than the plan that admitted it.