We open-sourced the runtime our agent fleet runs on: Enclave

We open-sourced the runtime our agent fleet runs on

We run a small fleet of autonomous agents. Not demos — long-running operators that wake up on a timer, read their own memory, pick the next step, and do it, tick after tick, without a human in the loop. Doing that safely and without setting fire to your model bill turns out to be most of the work.

The agent logic is the easy part. The runtime around it — the sandbox, the credential scoping, the memory that survives a restart, the cost governor that keeps a frontier model from burning your whole cap on a heartbeat — is where the weeks go.

Today we're open-sourcing that runtime. It's called Enclave, it's Apache-2.0, and it's the same code our own fleet runs on right now.

github.com/wartzar-bee/enclave — public alpha, Apache-2.0.

git clone https://github.com/wartzar-bee/enclave.git enclave && cd enclave
./bin/enclave init      # wizard: name, brain, model, port, paste your credential
./bin/enclave run       # build + start, opens a browser chat at 127.0.0.1:8888

What it is

Enclave runs one autonomous agent in a hardened container with scoped credentials and a local web chat. docker compose up, and you talk to your agent in the browser — a real Claude-Code conversation, resumable, multi-thread, at the agent's own model.

It's brain-agnostic: one env var, BRAIN=claude | api | local | optimize. Same container, same security guard, whether you run it on a Claude subscription, any OpenAI-compatible key, or a local model server. Switching brains keeps the agent's memory intact.

What "constrained" actually means (read this before you trust it)

We're allergic to security theatre, so here's the precise boundary — the part most "agent framework" READMEs hand-wave:

• The container boundary is enforced by the kernel, always. The agent runs --cap-drop=ALL --security-opt=no-new-privileges with no inbound ports. It sees exactly the mounts you gave it and a read-only secrets/ — nothing else on your disk. A prompt injection does not change that; it's architectural, not a policy the model can be talked out of.
• The network boundary is enforced only when you turn it on. The egress allowlist ships in report-only mode by default — it logs disallowed hosts rather than blocking them, so a first run doesn't fail in a way you can't diagnose. For anything real, set GUARD_EGRESS_ENFORCE=1. We'd rather tell you that up front than have you discover it in an audit.

A PreToolUse guard (platform/agentd/hooks/guard.py) fires even under --dangerously-skip-permissions and blocks git, foreign-secret reads, and — via opt-in profiles — cloud writes and production mutations. You can verify all of this by reading the code, which is the point.

The part we care about most: cost discipline

A persistent fleet on a frontier model burns your subscription or API cap fast. At fleet scale, that's the binding constraint — not latency, not quality. Enclave ships two layers to keep judgment quality while cutting spend, both toggled by an env flag:

• Model-tier routing (ROUTER=on) — routine heartbeats and mechanical directives (post / measure / narrate / commit) run on a cheaper model, reserving the top model for actual judgment (decide / design / review). It's safe-by-default: anything ambiguous, or any upstream error, resolves up to the top model. You never silently downgrade a decision that mattered.
• Manager→worker delegation — when BRAIN=claude, a capable manager is forced to hand bulk code-writing to a cheap or local worker instead of spending frontier tokens on keystrokes. The manager plans and reviews; the worker does the labor under a verify-gate. The guard self-disables for api/local brains, which already are the cheap worker.

This is the same thesis behind our other tools — tokenscope (measure where the tokens actually go) and our CI cost-regression guardrail (block a PR that spikes token cost). Enclave is where those patterns run in production.

Memory that survives a machine wipe

The agent's memory is one linked, markdown, git-trackable vault — an LLM-maintained wiki plus operational memory and skills, navigable as a graph, no DB or GPU required. The runtime auto-snapshots after every tick, and every snapshot is scan-gated and fail-closed: a credential pasted into memory blocks the commit, because git history is forever. Opt-in qmd semantic search and a codegraph symbol/call graph layer on top when you want them.

What it deliberately isn't (the honest gaps)

Open-sourcing a thing you use daily means publishing its rough edges too:

• macOS + Linux only. Developed on Apple silicon and Linux; Windows is untested (WSL2 is the likely path, unverified). If you run it elsewhere, reports are genuinely welcome — that's a big reason to open it up.
• Host capabilities (bridges) aren't bundled. Browser automation, transcription, TTS live outside the container as host services. Enclave ships the pattern (docs/BRIDGES.md + a working tools/bridge-template/), not the services. Out of the box an agent can think, read/write files, and call APIs — it can't drive a browser until you stand a bridge up.
• Public alpha. The API and layout still move. It runs a live fleet daily, but pin your version.

The most useful contribution is a bridge — a new host capability behind a narrow, audited surface. If you've wanted an agent runtime you can actually read end-to-end before you trust it with a credential, this is that.

⭐ github.com/wartzar-bee/enclave (Apache-2.0). Kick the tyres, file an issue with your enclave status output, and tell us what breaks on your OS.