Agent Runtime
The domain-neutral core beneath Autonomous Operators: the layer that makes a persistent agent durable state rather than a process, and makes every side effect a governed, ledgered, verifiable, recoverable fact.
A one-way boundary
The runtime is a strictly bounded core: it knows nothing about UI, routes, hosting APIs, Scout, or any particular database — persistence and effects live behind ports the product layer implements. That boundary is what makes operators portable across models, stores, and execution environments.
agent-runtime domain-neutral runtime (no site imports)
▲
autonomous-operators product layer · Scout configuration
▲
web / API / demo command-shaped public surface
The arrow never points down. The kernel gate fails the build
if it ever does.The ports
RuntimePorts
Table<T> stores agents · assignments · tasks · runs ·
operations · attempts · approvals ·
artifacts · checkpoints · verifications ·
states · environments
EventStore append-only, sequenced per session
Clock injected — the kernel owns no wall clock
atomically the one transaction seam every commit usesToday the site implements these with Postgres and a budgeted model client; the kernel gate proves the whole runtime against in-memory implementations with zero model calls. A different store or a different model vendor is a new adapter, not a rewrite — replacing a model never creates a new agent. The honest exception: environments today are in-kernel simulated workspaces, and the provider contract a real sandbox would attach behind is designed, not yet a seam in code.
What the runtime owns
Every intended side effect is a persistent LogicalOperation whose idempotency key is hash(agent, task, operation) — identity is never reconstructed from arguments. Attempts are separate records; AMBIGUOUS outcomes block retry until a deterministic probe reconciles them. At most one committed side effect per key, enforced by the database, not by application discipline.
Deterministic, inspectable, default-deny policy evaluation with a human approval gate where policy demands it. The model can propose and can never authorize; policies and grants are frozen data from the governed agent's perspective.
Completion is the verifier's verdict, never the model's claim. Durable agent state mutates only through a verified run's commit — a ledger transition and its events commit atomically in one transaction, so replay and recovery can never disagree.
Environments are disposable workspaces; checkpoints are durable resumable snapshots taken at every commit; artifacts are durable proof. Destroying a computer destroys none of the information recovery or evidence needs — recovery restores the checkpoint, skips committed operations visibly, and resumes.
These are exactly the invariants a governed external agent runtime cannot be trusted to own for you — a conclusion independently reinforced by a source-level audit of a major open-source agent runtime, which validated the external-governor pattern without becoming a dependency of this system.
Proven in the open
The runtime is exercised by every run of the sealed public demo, whose world is deliberately simulated — sandboxed workspaces, a fictional-products corpus, session-scoped agents — while the runtime mechanics stay production-shaped and gate-verified: the ledger, authority, verification, checkpoints, and recovery you can watch working are the real thing.