Bounded Agent Runtime v0.5.0

Bounded Agent Runtime v0.5.0

BAR v0.5.0 hardens real-agent adoption while preserving bounded authority and Human Gate control.

Highlights

• deterministic Builder/Reviewer auto-selection with no silent mid-run fallback
• explicit auth readiness for Codex, Claude and OpenCode
• Codex Reviewer isolated read-only; Codex Builder is explicit user-config opt-in only in v0.5
• shell-free Windows npm launcher resolution for Codex/OpenCode
• Claude Safe Mode, no session persistence and strict MCP settings
• unprivileged Docker Builder/Reviewer with network disabled
• Steerion Boundary v0.1 composition layer: capability registry, authority engine, agent/provider routing, evidence binding, skill intake and improvement observer

Release evidence

• main: 96/96 tests PASS
• exact release tree: Linux Docker E2E 2/2 PASS
• fresh clone install/tests/quickstart/package smoke PASS
• quickstart stops at HUMAN_GATE_REQUIRED
• npm pack dry-run PASS

No npm package was published by this release. Protected remote actions remain outside BAR execution and require Human Gate authorization.

Bounded Agent Runtime v0.4.0

Bounded Agent Runtime v0.4.0

Safer to adopt. Easier to understand. Same bounded authority model.

Highlights

• Guided bar quickstart that reaches HUMAN_GATE_REQUIRED without architecture knowledge
• Clearer bar status and safe next-step error guidance
• Adapter conformance contract for Codex, Claude Code and OpenCode
• Verified Git clone and GitHub ZIP onboarding paths
• Public roadmap, contribution safety guidance and issue templates
• Reusable “Why BAR” comparison and architecture diagram

Verification

• npm test: 65/65 PASS, 0 fail, 0 skipped
• Docker E2E: 2/2 PASS
• Clean clone install: PASS
• GitHub ZIP install: PASS
• npm pack --dry-run: PASS
• Independent Codex final gate: Agent Integrations 9/10, UX 9/10, Installation 9/10, Adoption Readiness 9/10, FINAL PASS

BAR still performs no automatic merge, deploy or release. Protected authority remains outside the model and behind deterministic checks plus the Human Gate.

Bounded Agent Runtime v0.3.0

Bounded Agent Runtime v0.3.0

Run autonomous coding agents. Keep authority outside the model.

v0.3.0 turns BAR from a reference runtime into a usable, model-agnostic security runtime for AI coding agents. Builders can modify code, reviewers can inspect exact candidates, deterministic verification produces controller-observed evidence, and protected actions remain behind an authenticated Human Gate.

Highlights

• Bounded task authority for paths, actions, workers and budgets
• Separate Builder and Reviewer workspaces bound to the exact Git commit and tree
• Deterministic verification on disposable candidate copies
• Ed25519 Human Gate with pinned approver identity, fingerprint and replay protection
• Lease/fencing, authenticated journal chain and recovery protections
• Read-only MCP and dashboard surfaces with no protected authority
• Optional HTTPS broker with allowlists, DNS/private-address checks and controller-side secret injection
• First-party adapters for Codex, Claude Code and OpenCode
• Optional Docker Builder/Reviewer isolation with --network none and no host .git
• Windows protected mode with separate role accounts, SID-based ACLs and real worker-token probes

Verified release candidate

Release candidate head: 62b5f753183cc9e037e28cd3e3cc98d74c64796e

• npm test: 62/62 PASS, 0 fail, 0 skipped
• Docker isolation E2E: 2/2 PASS
• Windows host baseline: PASS
• Static SID/ACL verification: PASS
• Real Builder/Reviewer worker-token access proof: PASS
• git diff --check: PASS
• Release target on main: cb8c137c0cdc09e7ac2f8a9ec41d6b70bc94827b

Security boundary

BAR intentionally does not provide a real merge, deploy or release adapter. Model output, prompts, repository text, reviewer prose, MCP/tool output and agent handoffs remain untrusted input. The deterministic controller owns authority and protected-action authorization.

BAR also does not claim that a normal child process is an OS sandbox or that the HTTPS broker is a firewall. Protected deployments still need real host/container isolation and explicit egress controls.

Quick start

git clone https://github.com/steerion-labs/bounded-agent-runtime.git
cd bounded-agent-runtime
npm install
npm link
bar doctor
npm run demo:reset
npm run demo:init
npm run demo:run

Expected stop:

HUMAN_GATE_REQUIRED

See the README, SECURITY.md, the threat model and the Windows quickstart for the complete architecture and deployment guidance.

What's changed

• v0.3 usable bounded agent runtime: #1
• Full changelog: v0.2.0...v0.3.0

Bounded Agent Runtime v0.2.0

Bounded Agent Runtime v0.2.0

Run AI coding agents. Keep authority outside the model.

v0.2.0 is the first hardened public release of Bounded Agent Runtime, a model-agnostic reference runtime for AI coding agents with bounded authority, verified evidence, independent review and authenticated Human Gates.

Why this release matters

Coding agents are increasingly capable. This project focuses on the other half of the problem: what an agent is allowed to do, what must be independently verified, and where human authorization remains mandatory.

The runtime keeps model output, repository text, handoffs, memory and tool output as untrusted context. A deterministic controller owns task authority, budgets, evidence verification, candidate identity and protected-action authorization.

Highlights

• deterministic controller state machine
• task-bound allowed actions, protected actions and paths
• lease and fencing checks
• model-call, retry and wall-clock budgets
• controller-derived Git commit and tree identity
• exact candidate re-verification after review and before protected authorization
• HMAC-authenticated evidence bound to task, commit and tree
• HMAC-chained journal with truncation detection inside the documented controller trust boundary
• Ed25519 Human Gate approvals with approver identity and public-key fingerprint pinning
• persistent one-time nonce consumption to block approval replay
• hostile Git hook and inherited GIT_* environment hardening
• Windows role accounts, protected ACL zones and real worker-token access verification
• model-agnostic adapter guidance for Claude, Codex, OpenCode, local models and MCP-enabled workflows

Reference flow

Task -> Controller -> Builder -> Git verification -> Independent Reviewer -> Re-verification -> Human Gate -> Protected-action authorization

The reference implementation intentionally performs no real merge, deploy, release or other remote mutation. External side-effect adapters must be separately implemented, bounded and re-verified.

Manual release evidence

Final public main candidate:

bb96f13842323d0f7bbd80c7d125203a75110e65

Security-reviewed runtime candidate before the docs-only positioning commit:

f4acfc6000614a5bdc1aed772695703d4290c52f

Independent adversarial review verdict on f4acfc6:

RELEASE_GO

Final fresh-clone verification on bb96f13:

• npm test: 32 tests, 32 pass, 0 fail, 0 skipped
• node --check: PASS across runtime and test .mjs files
• Windows PowerShell parser check: PASS across repository .ps1 scripts
• git diff --check: PASS
• clean fresh clone: PASS
• privacy/secret-pattern scan: no project-private references or secret patterns found
• GitHub Actions: intentionally disabled; verification was performed manually against the exact candidate

Security scope

This is a reference implementation, not a security certification. Demo child processes do not claim OS-account isolation. Protected deployments must verify actual worker identities, filesystem ACLs, credentials, installed tools, network policy and every real mutation adapter on the target host.

Getting started

Clone the repository, run npm test, then follow the 5-minute demo in the README. The expected demo stop is HUMAN_GATE_REQUIRED.

License

Apache-2.0.