Active2026
Agentbox: local agent work as a reviewable branch
A local coding-agent runner that starts from a scratch checkout and returns a branch, diff, and report. The agent container has constrained access; the launcher and model gateway remain trusted.
Implementation and automated test tooling are public. Adversarial containment validation remains open.
Tools and project details
- Status
- Implementation and automated test tooling are public. Adversarial containment validation remains open.
- Stack
- Python
- Docker
- MCP
- gVisor
- vLLM
- Ollama
- Git
- Role
- Runner, launcher boundaries, and result-collection workflow
- Result
- Reviewable Git branch
Case study
How a task comes back
I built the runner, launcher boundaries, and result collection. The agent works in a container with no network interface, a read-only root filesystem, dropped capabilities, and access to a task-scoped model gateway.
A trusted shadow Git directory collects the result without executing Git hooks from the agent-controlled checkout. A separate tool runs checks on the returned branch.
The trust boundary
The Docker launcher and model bridge are trusted components. gVisor is optional and changes the kernel boundary only when installed and selected. Public smoke tests do not establish resistance to every escape or replace an independent security assessment. Returned patches still require review.