fluidbox runs underneath agent harnesses, not instead of them. You register versioned agents; it gives every run an isolated sandbox, a policy gate, human approvals, budgets, and an append-only record.
A capture of the shipped product, not a mockup.
Dashboard, CLI, API trigger, webhook, or schedule — every entry point converges on one code path that freezes an immutable specification: model, system prompt, task, a full policy snapshot, budgets, the exact tool surface, and who invoked it. Nothing that governs the run can change afterwards.
The credentialed git fetch or copy happens control-plane-side, before the agent exists. The sandbox will only ever see a bind-mounted copy at /workspace; the original repository is never touched.
A disposable container from the harness's runner image. Its only credential is a per-session token — disguised as its model API key — and it has no network egress to use anything else.
Claude Agent SDK or Codex, behind the same HTTP runner contract: tool calls to /permission, message streams to /events, liveness to /heartbeat, the outcome to /result. Model calls ride the LLM facade, which meters usage as it streams.
Budget, frozen tool surface, argument schema, trust tier, policy, approvals — in that order, for every tool call. Ask-a-human pauses the run; deny returns a tool error the model can react to; in autonomous mode the ask verdict rewrites to the policy fallback with both verdicts recorded.
The server is the single status writer. Terminal entry enqueues result deliveries — signed webhooks, GitHub comments and checks — decoupled from the run, so a dead receiver can never mutate one. What remains is reviewable: what changed, what it cost, and why each step was allowed.
Two stages sit above policy and cannot be approved away: budgets, and the read-only trust tier frozen onto runs from fork pull requests.
Ordered rules over tools, paths, and shell; append-only version history with authors and summaries; every run judged against the snapshot it froze — never against what the policy says today.
Policies →Idempotent by (run, tool call); settled by compare-and-swap; expiry denies. Personal-credential calls are decidable only by their owner — no admin override in either direction.
Approvals →The facade swaps in the real model key; git fetches happen before the agent exists; brokered MCP tools execute control-plane-side with credentials sealed at rest. The workload can't leak what it never holds.
Security model →Gapless per-run sequence numbers, resumable streaming, and redaction enforced by the type system — prompts cannot reach storage, digests and verdicts do.
Runs & the timeline →Sandbox tools are credential-free subprocesses contained by the container. Brokered tools are called by the control plane against per-run frozen bindings. Attach is never allow — the gate decides every call.
Capabilities →Subscription-scoped API tokens, exactly-once cron schedules, GitHub PR events with fork runs frozen read-only. Same creation path, same RunSpec, same gate.
Triggers & schedules →One compose command runs the whole stack from published images. The Helm chart deploys the production shape: sandboxes as Jobs behind admission-gated deny-all NetworkPolicies, the runner contract on a separate listener, published OCI images and chart.