Skip to content
sdlc

Run agent work in a bounded, observable execution environment

State: open/proposed

Statement

Section titled “Statement”

Every run Foreman executes is isolated — its own worktree today, and a sandboxed runner context later: deny-by-default egress, bounded resources, an event feed the operator watches, and one-click amend of a blocked action.

Who/what it affects

Section titled “Who/what it affects”

Anyone handing agent work to Foreman, and the operator watching runs through SDF. Trust scales with containment: an agent given a bounded order in a bounded environment can be trusted with more, which is what lets the human gate move from every step to the merge — and, for the gated class, past it.

Evidence

Section titled “Evidence”
  • N-41AZ-vision, “The scheduler and the secure execution environment”: the Contain row — “every run is isolated: its own worktree today; the runner-context port is where a sandbox goes — deny-by-default egress, bounded resources, an event feed the operator can watch and amend (the cage patterns).”
  • D-VSLI-distributed-work-runner-architecture: the runner-context and agent-driver ports name the swap points — “engine-supervised child process, container, remote runner” and “other harnesses, local/OSS models”.
  • D-0018-sdf-control-plane-app: the sksizer/zoo contribution — “secure-agent cage patterns: deny-by-default egress policy, live event feed (bounded store, batched delivery, virtual scroll), streamed step-runner provisioning, discriminated-union state machines, reconcile-on-startup, blocked-event → one-click-amend.”
  • PR-FRMN-foreman’s boundary: the execution plane — claims, leases, fencing, heartbeats, supervision — is inside the product; the runner context is a named port, not a fixed implementation.

Toward resolution

Section titled “Toward resolution”

M-E1YP lands the engine. M-KBH8 runs one real work order through it, worktree-isolated. The sandboxed runner — deny-by-default egress, resource bounds, the event feed, one-click amend — is a later implementation behind the same runner-context port; no milestone carries it yet.

← Back to Drivers