HotCell runs untrusted media conversion in an unprivileged sibling container with no network, reached over a Unix socket that carries file descriptors rather than paths or bytes. This gem holds what both sides must agree on: the request and response format, SCM_RIGHTS marshalling, descriptor access-mode verification, payload validation, and the error taxonomy. It performs no I/O of its own and loads no media library.