Open infrastructure for dependable AI agents

Build the boundary.
Measure the result.

Run agent code with Sandbox. Verify website delivery with Site. Review Kubernetes package changes with Infra. Three independent open-source projects, built for operators who want explicit boundaries and inspectable results.

Explore the systems ↓ Read the source ↗
New: Infra Public Alpha — explore the GitOps compiler ↗
Self-hostedKubernetes nativeIndependently usableMIT licensed
hullwork / control path● LIVE
AGENT WORKLOADRun → Ship → Verify
01IntentHTTP · CLI · MCP
02SandboxgVisor runtime
03SiteKubernetes delivery
04EvidenceHTTP 200 · SHA-256
boundary enforced deployment measured
RUNTIMEgVisorisolated
✓
Proof recordedstatus + body digest
01Execution boundaryOne gVisor Pod per runtime
02Credential boundaryTenant identity from the key
03Delivery evidenceReal HTTP status + body digest
04Operator ownershipYour cluster, state, and credentials
One dependable path

From agent intent
to observable evidence.

Models propose. Hullwork makes the surrounding system explicit: who is asking, where code runs, what gets deployed, and how success is proven.

01

Agent intent

A narrow request enters through HTTP, CLI, SDK, or MCP.

authenticated request
02

Secure runtime

Untrusted work executes inside a tenant-scoped gVisor Pod.

fail closed
03

Verified delivery

The workload converges through Kubernetes and becomes reachable.

desired → observed
04

Evidence

The live address is fetched and bounded proof is recorded.

status + sha256
Public systems

Three focused projects.
Start where you need one.

Adopt each project independently. Infra works with external packages and an existing Argo CD installation; it is not a prerequisite for Sandbox or Site.

01 Secure execution plane

Sandbox

Run an agent's shell and file operations inside its own Kubernetes gVisor Pod. Durable workspaces outlive disposable runtimes. Missing dependencies never become permission to execute on the host.

  • gVisor RuntimeClass
  • Tenant-scoped credentials
  • Durable workspaces
  • Python SDK · CLI · MCP
Open Sandbox site ↗Source on GitHub ↗
sandbox — quickstart
$ make quickstart

[1/5] checking host prerequisites
✓ kubeadm cluster ready
✓ gVisor kernel verified
✓ workspace survived restart
✓ host fallback blocked

sandbox-ready
runtime / gvisor● HEALTHY
02 Verified delivery plane

Site

Turn an agent request into a real Kubernetes deployment. Site handles admission, builds, workloads, ingress, observability, and scale-to-zero—then proves the address serves traffic.

  • HTTP verification
  • Status + SHA-256 evidence
  • Multi-tenant admission
  • HTTP · CLI · MCP · Console
Open Site website ↗Source on GitHub ↗
site / run details● LIVE
APPLICATIONhello-site
RUNNING
REVISIONrev-18a42c
REPLICAS1 / 1
ROUTEREADY
✓
TRAFFIC VERIFIEDHTTP 2005e7f06f9…12178242
desired stateworkload readyresponse measured
03 GitOps package compiler · Public Alpha

Infra

Catch invalid package combinations before deployment. Infra validates declared capabilities and artifact locks, then compiles your records into deterministic Argo CD YAML for review.

  • Offline validation
  • Per-cluster capability checks
  • Explicit artifact locks
  • No controller to install
Try the working example ↗Source on GitHub ↗

Use your existing Argo CD; no companion repository or Lima management cluster required. Static checks validate your records, not live cluster readiness.

Alpha release ↗Tested scope & limitations ↗
infra / reviewed configuration
Package catalog + Stack
ClusterProfile + VersionLock
               ↓
Validate contracts & capabilities
               ↓
Compile Argo CD YAML
               ↓
Review and commit to Git
               ↓
Existing Argo CD reconciles
same inputs → same YAMLOFFLINE COMPILER
Engineering posture

Trust is an output.
Not an input.

01

Boundaries over promises

Identity, runtime, resource, and network boundaries are concrete architecture—not prose around a model call.

tenant ≠ request field
02

Evidence over labels

A green API response proves admission. Hullwork follows the system until the running result can be measured.

deployed → fetch → record
03

Fail closed

If isolation, control, or runtime dependencies disappear, the operation stops. There is no convenient local escape hatch.

fallback_to_host = false
04

Operator owned

Workspaces, credentials, control-plane state, and the Kubernetes substrate stay in the environment you operate.

your infra · your data
Start from source

Pick the boundary
you need first.

All three projects are independent and MIT-licensed. Sandbox and Site offer local deployment quickstarts. Infra starts with offline validation; its working example takes you through deployment with Argo CD.

Infravalidate & render offline
git clone https://github.com/hullwork/infra.git
cd infra
python3 -m venv .venv
.venv/bin/pip install -r requirements-dev.txt
make validate
make render-applications

This demo renders a placeholder package. Use the hello walkthrough ↗ for a real deployment.

Sandboxsecure execution
git clone https://github.com/hullwork/sandbox.git
cd sandbox
make quickstart
Siteverified delivery
git clone https://github.com/hullwork/site.git
cd site
make quickstart
Hullwork on GitHub

Build the boundary.
Measure the result.

Bring a real workload. Help improve package examples, first-run docs, and validation errors, or contribute reproducible OCI and remote-cluster checks for Infra.

Build with us ↗