Governance infrastructure only earns trust when you can read it.
fluidbox decides what AI agents may do with your repositories and credentials. That is not a product category where "trust us" works — the policy engine, the sandbox contract, the credential custody, and the audit ledger are all MIT-licensed and in one repository, together with the threat model that critiques them.
The repository is the product.
100% Rust backend, presentation-only dashboard, any direct-connection Postgres. No enterprise fork, no held-back core.
crates/fluidbox-core policy engine · state machine · RunSpec · redaction crates/fluidbox-server /v1 API · gate · approvals · broker · facade · SSE crates/fluidbox-db Postgres repositories · migrations · RLS floor crates/fluidbox-provider sandbox lifecycles (Docker · Kubernetes) crates/fluidbox-cli drive runs from the terminal images/ both runner images + the shared runner contract apps/web dashboard · this site · the docs you're reading deploy/ compose stacks · Helm chart (OCI-published) docs/ guides · OpenAPI 3.1 · threat model · runbooks scripts/ the e2e acceptance suites (real sandboxes)
Run it where your code already lives.
The Docker eval stack is one compose command against published images. The Helm chart is the production shape — sandboxes as Jobs with admission-gated deny-all egress, the runner contract on a separate listener. The multi-user hosted posture (per-org SSO, tenant isolation with a row-level-security floor, KMS envelope sealing) ships in the same repository behind explicit flags, with documented rollout gates ↗ instead of marketing claims.
A hosted fluidbox offering will be the same open control plane, operated for you — early access, not for sale yet. See pricing for the honest version.
Locked decisions, written down.
The backend is 100% Rust — the only sanctioned non-Rust code is the agent payload inside sandbox images. The dashboard renders decisions; it never makes them. PLAN.md's convergence invariants — frozen RunSpecs, append-only history, the always-wired permission callback, redaction-enforced ledger, credential inversion — govern every change, including yours.
Before proposing architecture: PLAN.md ↗ · Code of conduct ↗