Corey James- 0commits by the coding agent's worker to the main repository
A sandbox declared once per persona
Agent Swarm: every new agent tends to arrive with its own idea of what it may touch. I wanted the isolation floor declared once, as data, and inherited by every agent class. Each persona in the catalog carries a sandbox section, so a new agent class gets the floor without new code.
Checks before any tool body runs
The persona launcher starts one container per persona with a scoped token, a workspace and a budget. Inside the runtime, the frozen tool pipeline enforces per-call resource quotas read from procfs, and timeouts, before any tool body runs. The trust plane refuses connection strings that are not TLS.
A coding agent that stops instead of pushing
I tested the floor with a coding agent on a local open-weight model.
A separate long-lived agent opened the merge request.
Scored as a pass: stopping is the correct behaviour.
That is A coding agent that never holds the keys. How agents receive credentials and certificates, the plane under Agent Swarm, is the part of this work I keep private. The outcome is that an agent cannot call what it was not granted and never holds a credential it does not need.
Work across Unix users, vouched for by the kernel
AgentOS has to deliver work between processes owned by different Unix users without widening anyone's access. I used the primitives Linux already has. The activation bridge is a systemd socket-activated Unix domain socket.
On a single host the kernel already knows who is calling, so I check peer credentials on local sockets and keep shared secrets off that path.
Delivery reaches the operator's interactive session without any AgentOS service reading the operator's home directory.
The bridge starts on demand under systemd, so no privileged process sits idle waiting for work. Each cross-UID path does one job for one caller; I avoided a general privileged service. The same pattern carries messages into a frontier model command-line tool's local messaging socket for managed seats. All of it is ordinary operating-system machinery used carefully: kernel-reported identity, containers, socket activation and narrow cross-user paths, with no kernel modules and no custom security tooling.