Agent Runtime
The domain-neutral core beneath Autonomous Operators: the layer that makes a persistent agent durable state rather than a process, and makes every side effect a governed, ledgered, verifiable, recoverable fact.
A one-way boundary
The runtime is a strictly bounded core: it knows nothing about UI, routes, hosting APIs, Scout, or any particular database — persistence and effects live behind ports the product layer implements. That boundary is what makes operators portable across models, stores, and execution environments.
agent-runtime domain-neutral runtime (no site imports)
▲
autonomous-operators product layer · Scout configuration
▲
web / API / demo command-shaped public surface
The arrow never points down. The kernel gate fails the build
if it ever does.The ports
AgentRepository TaskRepository RunRepository OperationLedger EventStore CheckpointStore ArtifactStore EnvironmentProvider ModelAdapter
Today the site implements these with Postgres and a budgeted model client; the kernel gate proves the whole runtime against in-memory implementations with zero model calls. A real sandbox provider, a different store, or a different model vendor is a new adapter, not a rewrite — replacing a model never creates a new agent.
What the runtime owns
Every intended side effect is a persistent LogicalOperation whose idempotency key is hash(agent, task, operation) — identity is never reconstructed from arguments. Attempts are separate records; AMBIGUOUS outcomes block retry until a deterministic probe reconciles them. At most one committed side effect per key, enforced by the database, not by application discipline.
Deterministic, inspectable, default-deny policy evaluation with a human approval gate where policy demands it. The model can propose and can never authorize; policies and grants are frozen data from the governed agent's perspective.
Completion is the verifier's verdict, never the model's claim. Durable agent state mutates only through a verified run's commit — a ledger transition and its events commit atomically in one transaction, so replay and recovery can never disagree.
Environments are disposable workspaces; checkpoints are durable resumable snapshots taken at every commit; artifacts are durable proof. Destroying a computer destroys none of the information recovery or evidence needs — recovery restores the checkpoint, skips committed operations visibly, and resumes.
These are exactly the invariants a governed external agent runtime cannot be trusted to own for you — a conclusion independently reinforced by a source-level audit of a major open-source agent runtime, which validated the external-governor pattern without becoming a dependency of this system.
Proven in the open
The runtime is exercised daily by the sealed public demo, whose world is deliberately simulated — sandboxed workspaces, a fictional-products corpus, session-scoped agents — while the runtime mechanics stay production-shaped and gate-verified: the ledger, authority, verification, checkpoints, and recovery you can watch working are the real thing.