Board columns show ticket status. The steps below are the execution workflow inside a ticket. Human decisions always pause the walkthrough.
Worker template
Approved image, repository setup and tools. The initial harness is OpenCode in an isolated workspace.
Model connection
Provider, model and approved data routing. Custom OpenAI-compatible endpoint first (provider to confirm); native provider connections later. Provider keys stay in the broker.
Capability policy
Allowed tools, domains, paths, methods and datasets. Deny rules override allow rules.
Preview profile
Identity access, isolated test data, application permissions and expiry. Independent of the worker’s access.
Agent workspace
No live service keysNo direct outbound
Policy gateway
Identity + capability checkOutside the workspace
External service
Approved API / toolApproved model provider
Gateway injects credentials and filters responses. Workspace tokens are short-lived and scoped.
Illustrative decisions. Checks include caller, tool, domain, normalized path and HTTP method. Redirects and resolved addresses must be checked too. Private networks and cloud metadata are denied unless explicitly required and approved.
Constraints that cannot be bypassed with a script
- Network enforcement covers every process in the workspace.
- Tests and preview apps have their own limited identities.
- Use isolated test datasets; mask sensitive sample data.
- Deploy through a trusted Greenhouse action, never an admin token in the worker.
Control and evidence
- Default deny. A matching deny rule always wins.
- Refused actions stop or follow an approved failure route.
- Audit decisions with redacted content; never log secret values.
- Access boundaries reduce risk. They do not guarantee that generated code or permitted actions are harmless.
Deliver one complete journey, then generalize.
Each phase has a visible outcome and a release condition. A preview is the first delivery target.
Establish the boundary
Secret brokerage, enforced outbound policies, isolated worker and preview identities, audit and termination.
Acceptance: attempted key extraction and forbidden requests fail in adversarial tests. The operator can revoke a run’s access.
Turn requests into plans
One repository, one OpenCode worker profile, durable ticket history, clarification and explicit plan approval.
Acceptance: submit a request, answer questions, approve the plan, and resume safely after an interruption.
Ship the preview pilot
Implementation, deterministic checks, bounded repair, independent review and protected test deployment.
Acceptance: the edit modal works on test data, evidence is attached, and the preview expires as configured.
Make it reusable
Workflow editor, versioned templates, environment administration, MCP / API intake and optional integration with existing CI services.
Acceptance: another repository reuses a pipeline without permission escalation, with clear ownership and history.
Build on what is already there
Repository deployment workflows, commands, LLM and live verification, deployment to another existing test app, CLI / MCP and logs. App secrets currently live in Coolify runtime environments; provider keys use a private server environment file.
From deployment to ongoing development
Durable coding tickets, user-defined development workflows, human gates, isolated coding workers, a central encrypted secret vault, capability brokerage and per-ticket protected previews with expiry.