Assisted pilot · enterprise development teams
Delegate the task. Keep the control.
Agent Workspaces runs an AI agent inside a governed Linux workspace attached to your approved repository. It investigates, edits, and runs tests. You see the exact patch and evidence, then approve publication.
- Access
- Repository-scoped, default-deny egress
- Execution
- One Linux container per session
- Publication
- Frozen patch, explicit approval
The workflow
From a task to a reviewable change
-
01
Submit
Describe the task in the CLI or dashboard. The run is admitted against your tenant quota and pinned to a project.
-
02
Prepare
A server-side identity check selects an approved repository and an explicit base commit, then installs from the lockfile.
-
03
Execute
The agent works in an isolated container. Setup and execution use different network policies; credentials never enter the sandbox.
-
04
Checkpoint
Portable R2 checkpoints capture source, Git metadata, and test evidence. Lost containers restore the latest complete checkpoint.
-
05
Review
The frozen patch, changed files, test command, and results are bound to a digest before approval.
-
06
Approve
Approve or reject publication. Rejection preserves the work and never implies the task failed; approvals expire after 24 hours.
Built for review
Security is in the shape of the product
The agent does not receive your GitHub token, model key, or MCP credential. Trusted Worker code injects credentials only for approved destinations, strips client-supplied authorization, and enforces repository paths at the network boundary.
Execution traffic is denied by default. Setup permits only the hosts a project needs. Ports, private ranges, loopback, and metadata endpoints are rejected, and every policy decision is recorded without payloads.
- Tenant isolationScoped tokens, tenant-checked lookups, and immediate revocation.
- Durable runsOrdered events, stable dispatch ids, and no duplicate submission after a restart.
- Honest recoveryRestore reports the checkpoint timestamp and any lost uncheckpointed work.
- Bounded executionThirty minutes of active work and thirty model turns per run.
Deployment model
Dedicated resources in our Cloudflare account
Each customer gets a dedicated Worker, D1 database, R2 bucket, Durable Object namespace, and container application. Resources are isolated by configuration and tenant checks, but they share our Cloudflare account. We do not claim independent-account isolation, provider certifications, or a particular compliance certification for the pilot.
Current boundary
What the pilot covers
Node.js and TypeScript repositories with a lockfile, one approved GitHub repository set, and read-only HTTPS MCP tools. Automated pull-request creation is being completed; during the pilot the reviewed patch is exported and publication is explicitly gated.
Pilot offer
30 days, up to five developers
$500 assisted pilot
We onboard your repositories, identity, and model credentials, run a kickoff session, and review every output with you. The pilot includes up to 100 runs or 20 container-hours and 5 GB of retained storage. Model usage is customer-funded.
What you get
- Dedicated staging tenant and named operator support
- Repository-scoped access and default-deny network policy
- Review packages with patch, tests, and audit trail
- Recovery, cancellation, export, and deletion drills
What we ask
- Two developers and three concrete tasks
- A security contact and a permitted sample repository
- Feedback on usefulness, review effort, and blockers
Renewal is discussed around day 25 at $299/month. Renewal is explicit; there is no automatic overage billing during the first pilot. Contact the founder to request a pilot.