Skip to content

Bounded Agent Runtime v0.3.0

Choose a tag to compare

View all tags
@vebivejseli-hub vebivejseli-hub released this 31 Aug 05:26
v0.3.0
cb8c137
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Bounded Agent Runtime v0.3.0

Run autonomous coding agents. Keep authority outside the model.

v0.3.0 turns BAR from a reference runtime into a usable, model-agnostic security runtime for AI coding agents. Builders can modify code, reviewers can inspect exact candidates, deterministic verification produces controller-observed evidence, and protected actions remain behind an authenticated Human Gate.

Highlights

  • Bounded task authority for paths, actions, workers and budgets
  • Separate Builder and Reviewer workspaces bound to the exact Git commit and tree
  • Deterministic verification on disposable candidate copies
  • Ed25519 Human Gate with pinned approver identity, fingerprint and replay protection
  • Lease/fencing, authenticated journal chain and recovery protections
  • Read-only MCP and dashboard surfaces with no protected authority
  • Optional HTTPS broker with allowlists, DNS/private-address checks and controller-side secret injection
  • First-party adapters for Codex, Claude Code and OpenCode
  • Optional Docker Builder/Reviewer isolation with --network none and no host .git
  • Windows protected mode with separate role accounts, SID-based ACLs and real worker-token probes

Verified release candidate

Release candidate head: 62b5f753183cc9e037e28cd3e3cc98d74c64796e

  • npm test: 62/62 PASS, 0 fail, 0 skipped
  • Docker isolation E2E: 2/2 PASS
  • Windows host baseline: PASS
  • Static SID/ACL verification: PASS
  • Real Builder/Reviewer worker-token access proof: PASS
  • git diff --check: PASS
  • Release target on main: cb8c137c0cdc09e7ac2f8a9ec41d6b70bc94827b

Security boundary

BAR intentionally does not provide a real merge, deploy or release adapter. Model output, prompts, repository text, reviewer prose, MCP/tool output and agent handoffs remain untrusted input. The deterministic controller owns authority and protected-action authorization.

BAR also does not claim that a normal child process is an OS sandbox or that the HTTPS broker is a firewall. Protected deployments still need real host/container isolation and explicit egress controls.

Quick start

git clone https://github.com/steerion-labs/bounded-agent-runtime.git
cd bounded-agent-runtime
npm install
npm link
bar doctor
npm run demo:reset
npm run demo:init
npm run demo:run

Expected stop:

HUMAN_GATE_REQUIRED

See the README, SECURITY.md, the threat model and the Windows quickstart for the complete architecture and deployment guidance.

What's changed

  • v0.3 usable bounded agent runtime: #1
  • Full changelog: v0.2.0...v0.3.0
Assets 2
Loading