Skip to content

v5.17.0 - Perpetual Runtime (opt-in)

Choose a tag to compare

View all tags
@Jovancoding Jovancoding released this 27 Oct 17:22
· 15 commits to main since this release
v5.17.0
0eb0e3d

Perpetual Runtime (opt-in)

Agent swarms can now run indefinitely, improve themselves, and fund their own work while humans keep control. A run continues only while an operator-signed policy keeps renewing its lease. Nothing starts automatically; unused integration points cost one check.

Three invariants hold whatever the configuration:

  • I1: the external stop always works without agent cooperation. An out-of-process LeaseAuthority issues short-lived Ed25519 leases. LeaseGuard halts the run when its lease is revoked, paused, expired, or cannot be renewed (dead-man switch), and EgressProxy refuses all traffic without a live lease.
  • I2: agents can modify themselves, never their limits. GuardedPaths makes governance files and blackboard keys writable only with a single-use, operator-signed approval of the exact content.
  • I3: self-funding stays inside human-set ceilings. Ceilings live in the signed policy. Agents can lower but never raise them, and payments go only through the egress proxy with per-request and per-run caps.

What's included

  • Leases and dead-man switch: LeaseAuthority and LeaseGuard, hooked into AgentRuntime, GovernedModelGateway and LockedBlackboard.
  • Egress proxy: credentials are injected per route and scrubbed from responses; financial limits are enforced in the proxy process.
  • Guarded paths: operator approvals are signed, single-use, and bound to the exact content.
  • Sandbox: ContainerSandboxRunner defaults to gVisor, with a read-only root, no capabilities, and either no network or egress-proxy-only.
  • Sentry swarm: read-only detectors for velocity, denied-access probing, prompt injection, blackboard poisoning, guarded-path attempts, canary leaks and goal drift. Each sentry has its own authenticated identity, and a sentryQuorum setting means one compromised sentry cannot stop or steer runs.
  • Self-improvement pipeline: static checks, sandbox tests on a copy of the project, multi-model-family consensus, then a signed receipt bound to the patch hash. Tiers are auto, human, and operator (guarded paths always need the operator).
  • Self-healing state: HMAC-signed, hash-chained snapshots. A canary failure stops renewal, rolls back to the last verified snapshot, and purges the session.
  • Budget balancer: uses only operator-approved sources, picks the cheapest one with headroom, and throttles effort as the budget runs down.
  • CLI: network-ai perpetual keygen | sign-policy | authority | proxy | sentry | status | pause | resume | revoke | tighten | install-policy | sign-guarded | sign-budget | snapshot | rollback

Also

  • LockedBlackboard.write() / delete() now honour the lease option as well.
  • Docs updated across README, ARCHITECTURE, SECURITY, THREAT_MODEL, DATA_LOCATIONS, SUPPLY_CHAIN, ENTERPRISE, AUDIT_LOG_SCHEMA, INTEGRATION_GUIDE, QUICKSTART, CONTRIBUTING and references/.
  • 4,180 tests across 43 suites; tsc --noEmit clean.

Limits: the guarantees assume the operator key, role secrets and credentials stay outside the agents' reach, and that agents run sandboxed with network access only through the proxy.

Full details: CHANGELOG

Assets 2
Loading