Identity-aware application substrate
Know who is calling. Limit what they can do.
Dodona gives services and AI agents one place to discover each other, prove identity, delegate narrow authority, and run the workload behind the call.
Captured: 2026-07-16 UTC
# Dodona Checkpoint 20260715-bp28-f4694c5
Source commit: `f4694c567ccd9bd21d35f89c594e37af7c2b7c82`
Tag: `checkpoint/20260715-bp28-f4694c5`
Built targets: aarch64-unknown-linux-musl, x86_64-unknown-linux-musl
Debian packages: arm64, amd64
x86 status: built, not locally executed (qemu-x86_64 unavailable)
$ bin/play-single-machine.sh
[play-single] local dist server ready
[play-single] brain installed from staged URL artifacts
[play-single] brain process running
[play-single] node process running
[play-single] greeter workload registered and served HTTP
[play-single] teardown complete
[play-single] PASS
$ bin/play-multi-node-local.sh
[play-multi] brain process running
[play-multi] two node processes running
[play-multi] two nodes joined and served the same service
[play-multi] teardown complete
[play-multi] PASS
Start with your problem
One substrate, three immediate reasons to evaluate it.
Dodona is early. The implemented paths are concrete enough to test, and the boundaries are published beside the claims.
Secure agent access
Give agents stable service names and time-, peer-, and method-limited authority instead of another bearer secret.
Explore agent delegationRun a small platform
Keep identity, discovery, ingress, rollout, observability, and execution in one integrated control plane.
See the operating modelProve execution policy
Enforce residency, record request decisions, and verify signed audit reports offline.
Inspect sovereignty controlsOne call, one trust path
Names, identity, authority, and audit stay connected.
Resolution returns the expected peer identity. Mutual TLS proves the workloads. ACLs and attenuated credentials decide the method. The decision enters a hash-chained audit record.
Evidence, not borrowed credibility
Three narrow proofs available today.
- This site is a Dodona workload
The built static artifact runs as service `dodona.www`; both public hosts route to it through two Dodona ingress replicas.
Read the deployment boundary - Signed distribution
Checkpoint 20260715-bp28-f4694c5 contains deterministic ARM64 and AMD64 tarballs, SPDX SBOMs, checksums, and cosign signatures.
Review the evaluation path - Delegated agent call
A local MCP gateway exercised a peer-pinned, attenuated Biscuit credential and emitted an attestation verified offline.
Follow the call
Early access
Evaluate what exists, with the gaps in view.
The hosted installer and public image registry are not live. The current path is a signed checkpoint shared directly with evaluators.