v1.2.5: Autonomous agentic systems have just been solved.

The workplace that superpowers humans becomes the engine for governed autonomous agents. Codeflare v1.2.5 extends its Enterprise Zero Trust foundations into reusable autonomous execution: packaged agents, scoped identity, externally enforced capabilities, durable execution records, and a workspace that keeps autonomous work visible. The same engine that gives people an authenticated engineering environment now provides the foundations on which autonomous systems can be built.

Accompanying article: Read the blog post on Graymatter.

The ambition is not to scatter agents, credentials, and bespoke control planes throughout an enterprise. It is to make Codeflare the place an autonomous agent slots in like a LEGO brick: a defined purpose, an approved package, a constrained set of capabilities, and a visible owner.

That is the important continuity. Human-directed work and autonomous execution do not need unrelated security architectures. They need different execution profiles on shared foundations—identity, routing, guardrails, persistence, review, and operational evidence—with permission enforced outside the model rather than entrusted to its prompt.

This release covers the complete source promotion since v1.2.4, including the earlier session, Storage, Bedrock, and image-tooling promotions. The autonomous platform is the central change; the workplace beneath it also gains D1-backed session authority, multi-repository restoration, governed personal Pi providers, a refreshed native Pi interface, safer Vault readiness, and substantial runtime and supply-chain maintenance.

From a human workplace to autonomous execution

The enterprise does not end at an agent platform

Azure AI Foundry, AWS agent services, SAP, or another platform may be the starting point. The engineering work does not stop at that platform's boundary. It crosses cloud services, on-premises infrastructure, applications, and sites. An agent runtime gives code somewhere to execute; runtime isolation alone is not an enterprise-wide access and enforcement model.

Codeflare takes the human workplace's Zero Trust foundation and makes it the foundation for autonomous execution too. An Operator's permitted reach is not tied to where its runtime sits or where a target system is hosted. With the required connectivity configured, it can reach, change, and operate across the enterprise estate—wherever Zero Trust policy and its admitted capabilities allow. The agent does not need a separate runtime beside every target, or a parallel security architecture for each integration.

The boundary is policy, not the location of the agent. Identity and externally enforced permissions govern what it can reach and what it can do there. Runtime placement grants no additional authority; the same policies can also restrict access using the context they require.

That gives the Operator model the scope to support the entire spectrum of engineering activities: application engineering, infrastructure configuration, system integration, and operational work. A package can address one bounded job or carry work through an end-to-end delivery. Conductor and Dispatcher provide the reusable execution types; compatible packages supply the purpose. This is the engine's scope, not a claim that every enterprise workflow is already available as a finished package.

Autonomy belongs inside a governed environment

A useful autonomous agent must do more than produce an answer. It must reach approved systems, use the right identity, preserve its work, expose its failures, and stop acquiring authority when that authority expires or is revoked.

Codeflare's Enterprise Operator platform gives those concerns a common home. Packages declare their purpose, input contract, resources, and requested capabilities. An installation pins an exact verified release. Management and invocation grants are separate. Environment ceilings, operator permissions, and installation restrictions narrow what a run may do before its code executes.

The agent does not choose its principal, owner bucket, platform credentials, or authority lifetime. The parent platform binds each Activity to a verified identity, immutable package and policy identities, and the actual Access expiry. Protected operations recheck their applicable authority and execution generation. A stale caller, changed configuration, or expired lease cannot turn remembered context into fresh permission.

The model can decide what to propose. It cannot grant itself the capability to carry it out.

Enforcement outside the agent

Operators reuse the platform's infrastructure access, GitHub, inference, storage, and egress boundaries instead of receiving a parallel credential-bearing integration stack. Access to approved infrastructure stays within the invoking identity's authority and the Operator's admitted capabilities; installing a package does not grant it unrestricted access to the environment.

Repository and method restrictions are checked before GitHub credentials are resolved. Storage access is tied to parent-selected ownership and permitted prefixes. Inference intersects the invoking human's eligible routes with admitted policy; an agent cannot replace that selection with a provider credential or arbitrary model endpoint. Restricted operator containers require interception even when ordinary sessions use a different egress preference.

Where identity propagation is needed, optional Access assertion stamping attaches the current verified human assertion at the authorized HTTPS boundary. It is off by default; configured destinations or explicitly acknowledged all-HTTPS disclosure remain an operator decision. Caller assertions are stripped, redirects require their own authorization, and stamping grants neither network permission nor a longer identity lifetime.

These are concrete containment measures, not a promise that arbitrary agent code is harmless. An allowed operation can still have consequential effects. Repository protections, provider permissions, customer Gateway policy, and careful capability configuration remain part of the system.

Two Operator types, one engine

Not every autonomous task needs a complete interactive workplace. Codeflare provides two reusable Operator types so a package can use the execution environment its job needs without rebuilding the platform around it.

Dispatcher builds on Flue and the Cloudflare Agents SDK for package-driven execution in an Activity-private managed Worker runtime, with isolated durable state and parent-bound capabilities. Flue supplies the agent workflow runtime; Codeflare supplies its governed platform integration. The child receives approved bindings rather than the Worker's environment or unrestricted direct networking. Operations have durable identities and receipts; completed identical requests can be read back without performing the effect again.

Conductor supports workflows that need an owned container and structured Pi execution. Its restricted profile uses a private Activity tree, image-owned managed models, empty personal authentication, bounded verified inputs, and explicit scoped persistence. It does not restore the human's whole home, start ordinary whole-home bisync, or inherit personal provider logins. Generic host services provide structured tasks, observation, steering, cancellation, attachment restoration, and independent persistence verification.

The distinction matters: reuse the workplace's scaffolding and capabilities, not its unrestricted personal state. Codeflare owns the generic compiler, host and enforcement platform; the installed package owns its task-specific orchestration and policy.

The package defines the job

Conductor and Dispatcher are the reusable Operator types; the use cases built on them are interchangeable packages. PR Review and Renovate management are examples, not the definition of either type or the limits of Codeflare. Another compatible package can bring a different engineering or operational purpose while reusing the engine's identity, infrastructure access, inference, persistence, guardrails, and visibility.

That is what makes Codeflare an engine rather than a collection of narrowly integrated bots. Change the package's intent and task-specific policy—not the security architecture around every new agent. Compatibility, approved capabilities, and explicit installation decisions still apply; swapping a use case does not widen its authority.

Autonomy an operator can see

Runs and Installed, where work happens

The Enterprise header control brings autonomous work into both dashboard and terminal contexts. Runs shows owned work and retained outcomes; Installed makes configured packages and permitted actions reachable without leaving the workplace. Managers have a dedicated catalog and detail workspace for releases, grants, restrictions, and runtime permissions.

The compact dropdown follows Codeflare's existing visual language: anchored desktop presentation, a mobile bottom sheet, bounded scrolling, keyboard access, inline search, and readable detail. Runs and Installed search filter the currently loaded page, not an unseen global inventory; pagination remains available. Data refresh is explicit through opening, navigation, actions, Refresh, or retry—not a new timer-, focus-, or reconnect-driven polling loop.

Installed now enumerates all authorized installation identities in five-entry pages. Runs and Installed share Load 5 more / Newer 5 navigation while keeping their own context and retry state. Search focus styling is inset within the field border without changing its height.

Activity detail separates execution, cleanup, collection, and attention. A result is not proof that compute has stopped. Where an exact original SDK release receipt exists, the interface says SDK release confirmed; it does not turn SDK bookkeeping into physical-cessation evidence.

Follow the evidence, not the last reassuring message

The diagnostics work distinguishes boundaries that are easy to conflate: parent admission, upstream inference, child receipt, canonical persistence, settlement, result collection, and cleanup.

The source includes bounded owner-scoped lifecycle readback and retained causal diagnostics with summary, history, individual records, and resumable export. Correlation uses digests and closed metadata rather than prompts, response bodies, credentials, raw exception text, or private execution identifiers. Missing capture, import gaps, retention loss, and unavailable platform evidence stay visible instead of being filled with an inferred cause.

One operator-wide Enable logging control governs optional execution diagnostics. Functional records and mandatory authority fences remain independent. Diagnostic reads do not grant execution, replay, renewal, or result collection.

The newer retained diagnostic capture and package instrumentation still require their own exact-artifact qualification and hosted acceptance. They are not a retrospective explanation of uncaptured failures, and passing source checks does not supply missing runtime evidence.

Reusable scaffolding for developers

Package the intent; keep the platform boundary

The shared Operator compiler emits deterministic manifest, bundle, resource-digest, and optional provenance artifacts. Acquisition verifies immutable GitHub release/build identity, approved workflow/source, exact bytes, and digests before installation. Refresh can reuse unchanged verified releases while retaining pinned and rollback versions; it cannot silently replace a retained identity with different bytes.

Installation, release promotion, enablement, grants, and invocation remain separate decisions. Capability changes are revision-fenced and require explicit re-enablement of affected installations. The current management workspace replaces the retired legacy Operator administration routes.

This is the LEGO-brick model in engineering terms: a reusable execution contract, not a custom security architecture for each agent. Structured Pi tasks, opaque attachments, scoped storage, inference selection, operation receipts, and operator visibility are platform capabilities that another compatible package can reuse. The platform does not pretend that declaring a capability authorizes it, or that packaging a workflow certifies its decisions.

Dispatcher tuning also becomes explicit: source-response hierarchy, shared inference request/response bounds, operation and submission attempts, message/tool/token limits, result sizes, and execution budgets have described controls and draft-only resets. Larger byte limits do not enlarge a model's context window or bypass Environment ceilings, platform limits, immutable receipts, or uncertainty fences.

A stronger human workplace underneath

D1-backed session authority and resilient recovery

Complete non-secret session records and ordered lifecycle projections move to D1. Generation and observation-sequence checks reject delayed writers. starting, running, unreachable, and stopping retain workload ownership; a transient SDK flag, timeout, or stale dashboard projection is not sufficient evidence to start a replacement.

Positive current-generation exit evidence or confirmed destruction releases that ownership. Verified surviving runtimes can be reached through no-start forwarding, including native Browser IDE WebSocket transport. Client connectivity is presented separately from backend lifecycle, preserving mounted workspace state through uncertainty rather than manufacturing a stopped session.

The additive deployment migration opens clean D1 admission without importing or automatically deleting legacy KV session records. Credentials, preferences, entitlements, user files, and unrelated KV records stay with their existing owners. Historical session records are not a compatibility authority.

More than one repository, without losing the session

Workspace observation tracks a validated inventory of up to 20 repositories, in addition to a distinct creation-time primary repository. Resume restores them within existing clone and startup budgets, with the primary first. Incomplete observation does not discard a valid saved inventory.

Sessions can be renamed without restarting them or changing stored files and ownership. Persistent coding-agent defaults remain independent of existing session identity. The Worker-routed application also regains browser voice input.

Models, tools, and the Pi experience

Sanctioned routes and personal providers stay distinct

Enterprise administration gains a default-off, group/fallback-scoped permission for personal Pi provider logins and API keys alongside sanctioned Gateway routes. Native forwarding checks current administrative permission and the bound active session/generation, including reused WebSocket effects; it does not depend on a browser-derived Review authority lease. Revocation and uncertain ownership deny access, and strict egress and redirect isolation still apply.

A personal Pi provider is not an administrator-managed Native Route. Operators receive neither personal authentication nor the interactive user's /model selection: their inference stays on the eligible managed route/reasoning path. This exception does not put platform credentials in containers or silently widen sanctioned access.

Bedrock compatibility without invented capability

Dynamic Bedrock contracts can translate supported JPEG, PNG, GIF, and WebP data-URI images when authoritative route inventory is entirely compatible Anthropic Bedrock models. Mixed inventories retain their existing representation. Existing assignments adopt the changed contract through explicit Discover and Save, not silent rewriting.

Native adapter v5 tightens authentic active tool replay while permitting deterministic aliases for completed foreign historical tool pairs. Incomplete tool proposals are not published as executable calls; supported text-only recovery can abandon an unexecuted proposal without fabricating signed state. Discovery's canary uses ordinary task wording while preserving tool/replay qualification.

Native provider-prefix permission remains exact-target and evidence-bound; at least one qualifying positive mapping can grant cache serialization without pretending every reasoning level demonstrated reuse. Gateway whole-response caching is still a different measurement. Adapter changes require current verification and normal next-start adoption, not automatic inheritance from old receipts.

Authorized Native targets receive a Worker-owned 120-second Gateway first-byte allowance. Client timeout headers cannot override it. Dynamic Routes retain the timeout settings in their Gateway graph; this is not a universal two-minute completion deadline or a latency promise.

Native Pi UI and lazy capabilities

The committed runtime advances to Pi 1.3.0, with matching SDKs and coordinated extension preparation. Open TUI supplies the native header, footer, prompt editor, and /open-tui settings. Codeflare contributes repository/branch status rather than another competing footer. Startup enforces the managed presentation defaults while preserving unrelated safe configuration; unsafe configuration falls back without blocking execution.

Fullscreen terminal reattachment preserves the terminal's actual SGR mouse-encoding mode, restoring wheel-input forwarding without globally forcing mouse modes on ordinary terminals. Review consent and result delivery remain fenced to the current session, stored checkout, repository, PR, and exact head; delivery-triggered review rounds retain their exact-head CI obligation.

The managed Usage extension and its /usage provider-quota workflow are retired. Native UI token/context displays are not a replacement for subscription-quota reporting, and Codeflare billing and historical usage remain separate.

Capability discovery searches bounded tool-and-skill metadata without loading skill bodies, connecting servers, or activating tools merely because they matched. Optional exposure remains explicit. Goal and Plan keep separate workflow ownership and generation-fenced controls; installing them does not activate either workflow.

The Pi questionnaire now has a five-minute unanswered-question boundary. It preserves completed answers, labels defaults applied to unanswered items, and keeps cancellation and abort distinct. An automatic answer is not user authorization.

MCP and browser work remain bounded

Managed Pi MCP configuration moves losslessly to mcp-adapter.json, preserving custom originals and unrelated configuration. The adapter remains the managed lifecycle owner; startup disables Pi's eager native MCP owner rather than running two competing integrations.

MCP requests and managed browser tool/CDP protocol waits use a six-minute timeout profile. That is separate from the three-minute idle lifetime of an interactive Browser Run session. Custom settings outside the managed timeout fields, authentication, and routing retain their owners. Equal timeout budgets do not guarantee a structured timeout response at every layer.

Storage, Vault, and image-owned capabilities

Ordinary Storage uploads and deletions outside possible managed namespaces remain available during managed updates. Managed roots, overlapping folders, and mixed selections retain readiness and resource-policy checks. Downloads retain their existing authorization and administrator restrictions.

Vault readiness now requires evidence from the current controlling service worker and complete synchronization polls. Encrypted bootstrap waits for the exact replacement worker, page control, and acknowledged key import before marking completion. Unreadable remote listings abort rather than masquerading as an empty store and authorizing local deletion.

Synchronization excludes regenerable Python caches and transient root Pi work-evidence state without removing adjacent personal content or persisted review markers. Memory and graph documentation now states the actual prompt-cadenced, bounded, publication-before-counter contracts; documentation consolidation does not invent a new memory service or certify a fresh graph.

The image adds Pillow, rsvg-convert, ImageMagick, pip/venv support, and DejaVu fonts for local graphics work. Native prerequisites are build-owned; no model weights or paid image-generation provider are added. HTTPS Debian package sources retain certificate and repository-signature validation.

The native Impeccable toolchain advances with source-pinned engine preparation and preserved managed-skill ownership. Graphify, browser research, and design guidance track the upgraded runtimes without granting self-update or external-provider authority.

CI, security, and managed delivery

The verification line advances to Vitest 5 and the current Cloudflare plugin, with updated Workers/Node boundaries, measured backend/frontend partitioning, independent frontend build validation, and fail-closed suite and coverage reconciliation. Exact-tree receipts remain source evidence; complete-image smoke remains a separate deployment gate. The feedback-time target is not a guarantee, and retired failing Miniflare workloads are not counted as successful qualification.

Image maintenance includes digest-pinned Node mirror sources, coordinated selected-agent packaging, updated Go-built tools, lock-backed dependency corrections, and fixed Debian PCRE2, Perl, libgit2, and libde265 floors. The promoted source adds an integrity-verified basic-ftp 6.2.3 overlay for code-server and removes its corresponding vulnerability exception. The current scanner policy has no active bounded vulnerability exceptions; unexpected findings still fail the gate.

This is not a vulnerability-free-image claim. No fresh image build, scan, rollout, or session adoption follows merely from these source changes. Signed source releases, signed managed content, immutable Operator packages, and container-image provenance are separate artifacts with separate verification and activation boundaries.

Documentation and specifications are consolidated around owned lanes, with clearer distinctions between generic platform behavior, package policy, private operational configuration, and incomplete acceptance. Those distinctions are part of the release story: autonomy becomes useful when its boundaries are understandable, not when its uncertainty disappears from view.

Dependency highlights since v1.2.4

These are committed source pins or declared floors at the promoted head, not an inventory of an active session.

• Pi 0.85.1 → 1.3.0; Subagents 21.1.0 → 23.4.2; MCP Adapter 2.31.0 → 5.3.1; Web Access 0.27.0 → 0.38.0
• Goal 0.54.4 → 0.54.11; Plan Mode 0.56.0 → 0.59.2; RPIV advisor/questions/todo 2.8.0 → 2.12.0; Open TUI 0.3.11 added; managed Usage removed
• Claude CLI and official extension 2.1.251 → 2.1.296; Codex 0.151.0 → 0.162.1; Copilot 1.0.82 → 1.0.95; OpenCode 1.18.25 → 1.19.0
• code-server 4.141.0 / Code 1.141.0; SilverBullet 2.12.1; Herdr 0.9.5; Graphify 0.9.92; native Impeccable engine 0.1.15
• Bun 1.4.0 → 1.4.3; uv 0.13.0; LazyGit 0.66.2; Chrome DevTools MCP 1.8.0 → 1.10.1
• Wrangler 4.126.0 → 4.148.0; host Agents SDK 0.28.1; Vitest 5.0.5; Cloudflare Vitest plugin 1.4.4
• Hono declared floor 4.13.5 → 4.13.13; Zod 4.4.3 → 4.6.5; Vite 8.2.2 → 8.3.3; Astro 7.2.8 → 7.3.7; TypeBox 1.3.19 → 1.3.36; coordinated runtime locks, security floors, generated seed, and pinned workflow tools

Compatibility and adoption

Enterprise Operators are not a blanket new automation mode for every deployment. They require compatible packages, explicit configuration, grants, enabled installations, and current authority. Installation, enablement, invocation, and any scheduling activation remain separate decisions. Non-Enterprise and ordinary human-session behavior keep their applicable boundaries.

Source and controlled fixtures do not establish universal package compatibility or complete runtime qualification. The promoted source includes the Pi fullscreen-scrolling repair, current-session and stored-checkout Review fences, and the final installation-pagination and inset-focus corrections. The owner accepted completion; no independent deployed mobile-focus readback was performed. Retired development-transport tests establish neither a transport repair nor production acceptance.

Managed curation must match the final runtime/compiler and be independently signed, verified, and adopted. Existing processes do not acquire new behavior simply because a package, seed, or release note was published. Use the documented load/reload or normal next-start path appropriate to the change; do not infer universal runtime adoption.

Delivery evidence

• Published source: 8a3822b272f8744fd13fe737313a1bb6410ef716, the authorized squash promotion of #1232 to main. develop was subsequently aligned to the same commit.
• The promoted tree matches the reviewed develop head ca36f35ccf5896ecd2c75e5174d0fa7a2f3ae724. Its final PR Checks, Integration deployment, and Enterprise Integration deployment succeeded. Both integration deployments reused approved retained container images; they were not fresh image builds or scans.
• Exact-main PR Checks 39127299301 completed successfully. Automatic production Deploy 39127554532 was still in progress when these notes were prepared; its eventual outcome is separate from release publication.
• Release publication identifies the source and starts the separate release-asset signing workflow. It does not itself establish completed signing, production rollout, live traffic allocation, or universal managed-content/session adoption.

Full Changelog: v1.2.4...v1.2.5