task_submit
Submit a task to the Kart sandboxed execution queue and receive a task_id for polling. Tasks run network-isolated by default; network or database access requires operator-signed authorization envelopes and explicit capability flags.
Instructions
Submit a task to the Kart sandboxed execution queue. Returns task_id for polling.
Tasks run network-isolated by default. Egress needs the task_net capability,
standing consent.internet, a live operator lease, and an operator-signed
per-task envelope passed as network_authorization. The envelope binds the
submitter, task id, agent, normalized task hash, network scope, expiry, and
nonce. The signed task id is the queue primary key, preventing the envelope
from authorizing a second row. # allow_net and # allow_localhost remain
requests, never authority.
Local Postgres access (socket mount + PG/POSTGRES env) requires allow_db=True
and the separate task_db manifest capability — not granted by task_queue or
full_access. # allow_db in task text is a request, never authority. When the
operator sets WILLOW_MCP_ENFORCE_DB_PERIMETER (off by default), allow_db
additionally requires an operator-signed per-task db_authorization envelope
(db scope) from willow-mcp sign-db-task — mirroring the network perimeter, so
a task_db holder can no longer submit arbitrary psql.
The Kartikeya executor verifies all host gates and the signed envelope again
immediately before shell launch. Missing attribution or envelope, an invalid
signature, expiry, replay, task mutation, unavailable verifier, or a strict
trust-root failure denies network. Signing is available only through the local
interactive willow-mcp sign-net-task CLI; no MCP tool can mint authority.
Task text is security-scanned at SUBMIT time (defense-in-depth): a task the
Kart scanner would refuse — destructive, exfiltration, secret access, obfusc-
ation, or resource-exhaustion (fork bomb / spin / disk-fill) — is rejected
here before it ever occupies a queue slot, not only when the worker later
picks it up. The worker re-scans at execution regardless; this just denies
earlier and keeps a bomb from sitting pending.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| lane | No | fast | |
| task | Yes | ||
| agent | No | kart | |
| app_id | Yes | ||
| allow_db | No | ||
| allow_net | No | ||
| allow_localhost | No | ||
| db_authorization | No | ||
| network_authorization | No |