Bounded Agent Runtime v0.2.0

Bounded Agent Runtime v0.2.0

Run AI coding agents. Keep authority outside the model.

v0.2.0 is the first hardened public release of Bounded Agent Runtime, a model-agnostic reference runtime for AI coding agents with bounded authority, verified evidence, independent review and authenticated Human Gates.

Why this release matters

Coding agents are increasingly capable. This project focuses on the other half of the problem: what an agent is allowed to do, what must be independently verified, and where human authorization remains mandatory.

The runtime keeps model output, repository text, handoffs, memory and tool output as untrusted context. A deterministic controller owns task authority, budgets, evidence verification, candidate identity and protected-action authorization.

Highlights

• deterministic controller state machine
• task-bound allowed actions, protected actions and paths
• lease and fencing checks
• model-call, retry and wall-clock budgets
• controller-derived Git commit and tree identity
• exact candidate re-verification after review and before protected authorization
• HMAC-authenticated evidence bound to task, commit and tree
• HMAC-chained journal with truncation detection inside the documented controller trust boundary
• Ed25519 Human Gate approvals with approver identity and public-key fingerprint pinning
• persistent one-time nonce consumption to block approval replay
• hostile Git hook and inherited GIT_* environment hardening
• Windows role accounts, protected ACL zones and real worker-token access verification
• model-agnostic adapter guidance for Claude, Codex, OpenCode, local models and MCP-enabled workflows

Reference flow

Task -> Controller -> Builder -> Git verification -> Independent Reviewer -> Re-verification -> Human Gate -> Protected-action authorization

The reference implementation intentionally performs no real merge, deploy, release or other remote mutation. External side-effect adapters must be separately implemented, bounded and re-verified.

Manual release evidence

Final public main candidate:

bb96f13842323d0f7bbd80c7d125203a75110e65

Security-reviewed runtime candidate before the docs-only positioning commit:

f4acfc6000614a5bdc1aed772695703d4290c52f

Independent adversarial review verdict on f4acfc6:

RELEASE_GO

Final fresh-clone verification on bb96f13:

• npm test: 32 tests, 32 pass, 0 fail, 0 skipped
• node --check: PASS across runtime and test .mjs files
• Windows PowerShell parser check: PASS across repository .ps1 scripts
• git diff --check: PASS
• clean fresh clone: PASS
• privacy/secret-pattern scan: no project-private references or secret patterns found
• GitHub Actions: intentionally disabled; verification was performed manually against the exact candidate

Security scope

This is a reference implementation, not a security certification. Demo child processes do not claim OS-account isolation. Protected deployments must verify actual worker identities, filesystem ACLs, credentials, installed tools, network policy and every real mutation adapter on the target host.

Getting started

Clone the repository, run npm test, then follow the 5-minute demo in the README. The expected demo stop is HUMAN_GATE_REQUIRED.

License

Apache-2.0.