AEGIS scheduler

AEGIS is the Adaptive Execution Guard and Isolation Scheduler. It makes isolation selection part of scheduling, so capacity pressure cannot silently downgrade a workload's security boundary.

Phase 1: workload risk

Risk is a saturated score from 0 to 100. A request is classified from its data sensitivity, network access, repository trust, generated-code execution, secret need, host mounts, public exposure, privilege, and requested lifetime.

Signal	Points
Data: public / internal / confidential / restricted	0 / 10 / 25 / 45
Network: deny / restricted / open	0 / 10 / 25
Untrusted repository	20
Executes generated code	20
Needs secrets	15
Host mounts	25
Public or TCP exposure	15
TTL over 24 hours	10
Privileged request	100 and public-API rejection

auto selects microVM isolation at or above policy.microvm_risk_threshold, which defaults to 55. An explicit microVM request is honoured; an explicit container request above the threshold is upgraded to a microVM, never downgraded.

Phase 2: hard gates

Unsafe nodes are removed before ranking. A worker is ineligible when its heartbeat is stale, it is draining, pressure is invalid or over policy, the required tier is unsupported, a requested resource cannot fit, the sandbox limit is reached, a placement label mismatches, or the allocation would cross the dominant-resource reserve.

Hard gates are not score penalties. A nearby or warm node cannot win after failing a safety or capacity constraint.

Phase 3: ranking

Each surviving worker is ranked from post-allocation capacity. AEGIS derives the remaining fractions of CPU, memory, disk, and PID capacity, then rewards safe headroom and image warmth while penalising fragmentation and host pressure.

12345678910dominant_headroom = min(cpu_remaining, memory_remaining, disk_remaining, pids_remaining)
fragmentation      = max(remaining_fractions) - min(remaining_fractions)

score = 1000
      + round(dominant_headroom * 500)
      + warm_image_bonus          # 120
      + preferred_region_bonus    # 80, or 20 with no preference
      + packing_bonus             # 70 below 35% dominant headroom
      - round(fragmentation * 220)
      - round(host_pressure * 300)

This is best-fit packing with a reserve floor. It consolidates low-pressure work without selecting a host that has spare capacity in one dimension but cannot fit realistic workloads in another. UUID order gives the final tie-break deterministic behaviour.

Examples

A confidential coding-agent workload that runs generated code from an untrusted repository and uses a brokered secret scores at least 80, so it needs microVM capacity under the default policy.

A trusted internal build with no network scores 10 and can run on a hardened container worker. The developer Compose profile raises the threshold to 101 for laptop usability; do not carry that override into production.

Continue with Sandbox security, operations, and the server setup guide.