Autonomous doesn't mean unsupervised.

The agent runs with the least access it needs: an ephemeral OpenShell sandbox per cycle, no push or review credentials inside it, and a record of everything it did.

Ephemeral OpenShell sandboxes

One sandbox per cycle, destroyed on exit, under a deny-by-default runtime policy. The agent never holds provider credentials.

Full audit trail

Every state transition, retry, and comment is recorded — nothing happens off the record.

You stay in control

Pause, resume, or abandon any task at any time. Nothing merges without your review process.

What the sandbox gets

Each cycle runs in an ephemeral OpenShell sandbox, created per cycle and destroyed on exit. Network, filesystem, process, and inference access are denied by default; the resolved policy grants only the declared exceptions. The orchestrator clones host-side, uploads the workspace, executes the agent, downloads the result, then pushes from the trusted host. Provider push and review credentials never enter the sandbox.

version: 1 filesystem_policy: read_only: [/usr, /lib, /proc, /dev/urandom, /app, /etc, /var/log] read_write: [/sandbox, /tmp, /dev/null] process: run_as_user: sandbox

Boundaries

filesystem Only /sandbox, /tmp and /dev/null are writable. A read_write entry naming /, /usr, /lib, /etc, /app, /bin, /sbin, /boot or /var is rejected.

process Process access is denied by default and runs as the unprivileged sandbox user; enforceSandboxFloor re-asserts the floor after any policy override.

network Network access is denied by default. Each run opens only the hosts its adapter declares through allowEgress.

credentials The host owns all push and review credentials and runs the Git plumbing itself. They never enter the sandbox.

mcp surface The internal VE MCP server exposes only ve_submit_review or ve_submit_changes — no network tools, no database, no Docker socket.

Secrets and webhooks

Rotatable per integration

Each integration holds its own webhook secret and credentials. Rotating one never interrupts the others.

Signed deliveries

GitLab and GitHub events are verified with HMAC signatures before anything is queued. Gerrit uses a persistent SSH stream instead.

Audit log — task #4812 append-only

14:02:11 DETECTED redmine#4812 assigned to virtual-engineer

14:02:14 CONTEXT_BUILDING workspace cloned host-side, sandbox ve-a91c created

14:03:40 AGENT_RUNNING patch generated, 3 files, 118 insertions

14:03:52 IN_REVIEW merge request !219 opened on payments-api

14:06:03 REVIEW_VOTE +1 with 2 inline comments

14:11:27 RETRY_CYCLE feedback deduplicated, sandbox ve-b04f created

14:18:09 MERGED merged by a.dupont — branch protection satisfied

Every cycle on the record

State transitions, retries, review votes, and comments are written to an append-only log tied to the task. Nothing is edited after the fact, so a task can be replayed exactly as it ran — including the cycles that failed.

What is stored, what never is

Stored

Task metadata: title, description, and git author fields

Every state transition in state_transitions, with metadata

Diffs and review comments the agent produced

Provider credentials, AES-256-GCM encrypted in SQLite and masked on every admin read

Never stored

Plaintext credentials — plaintext credential writes are rejected

Webhook secrets in readable form after creation — rotation is per integration

Sandbox filesystems — the sandbox is destroyed when the cycle exits

Source code beyond the repositories you bind

Operator controls

PAUSE

Pause a task

Recorded as a state_transitions row, so pausing and resuming are part of the same audit trail.

ABANDON

Abandon a task

Moves the task to the terminal ABANDONED state, persists the reason, and leaves the log intact.

ROTATE

Rotate a secret

Replaces a webhook secret or token per integration, effective on the next delivery.

Common questions

Can the agent merge its own work?

No. It opens the change and votes on review; merging goes through the same branch protection and approvals as any human contributor.

What happens if a cycle crashes mid-run?

SQLite runs in WAL mode and the state machine is persisted, so coding tasks resume at their last recorded state after a restart. AGENT_RUNNING restarts from scratch, since the sandbox is ephemeral.

How do we report a vulnerability?

Privately, to contact@savoirfairelinux.com rather than a public issue. Reports are acknowledged within 48 hours and assessed within 7 days.

Can we run it fully self-hosted?

Yes. The orchestrator, SQLite database, OpenShell gateway, and sandboxes all run on your infrastructure. Keep the Admin UI on loopback or behind a trusted reverse proxy.

Read the sandbox details.

The documentation covers the sandbox policy, the agent engines, and the review lifecycle.

Open the docs