AIWG Framework

You can't ship your code to a hosted sandbox.

Your work touches production data, regulated workloads, or proprietary tooling. The hosted-sandbox vendors all begin with "upload your project to our infrastructure" — and that's exactly the constraint your team can't accept. e2b is impressive engineering. So is Modal. So is Daytona's hosted plane. None of them run on your hardware, in your network, with your security team's sign-off.

Meanwhile, the autonomous-agent narrative has shifted from "execute untrusted code safely" (the 2024 question) to "operate persistent autonomous processes for hours at a time" (the 2026 question). The substrate question is settled — microVMs work, containers work, virtiofs works. Trust and operations are the new battlegrounds, and the open self-hostable side of that battleground is where AIWG's optional isolation runtime lives.

agentic-sandbox is the optional VM/container isolation runtime in the AIWG suite. It is a Rust-based management server (gRPC + WebSocket + HTTP) that spawns and supervises QEMU/KVM virtual machines or Docker containers, one per agent process, sharing storage with the host via virtiofs. It runs entirely on your hardware. There is no hosted plane.

It is the third layer of the three-layer AIWG suite. The cognitive architecture (agents, skills, rules, memory) deploys to your AI tools. The orchestration runtime (Agent Loop, daemon, Mission Control) supervises long-running work. agentic-sandbox is what runs underneath when isolation matters — regulated industries, multi-tenant internal platforms, security-conscious teams, agents that run for 6–8 hours autonomously where hosted economics break down.

Your data stays on your hardware. Self-host first. No telemetry-back-to-vendor. No prompts shipped to a hosted analytics service.

Long-running agent processes. Sessions persist until the task completes — not until your laptop sleeps, not until the chat times out. External Ralph survives crashes; aiwg ralph --attach reattaches you to the running loop.

Process isolation. Each agent gets its own VM (or container, your choice) with full dev tooling. Agents cannot reach across to each other or to the host without explicit shared-storage paths.

Survives server restarts. Session reconciliation re-attaches running agents to their state after the management server restarts. Agents don't lose progress when ops is doing maintenance.

Runs unprivileged. Rootless Docker support; resource limits enforced. No requirement that the management server runs with elevated privileges.

Real-time monitoring. Web dashboard, Prometheus metrics, live terminal access. Full operator observability without phoning home.

Other substrates are good. They solve different problems.

e2b — Hosted code-interpreter SDK with microVM isolation. Excellent for short-lived sandboxes triggered programmatically.

e2b wins when: hosted is fine, you want a managed plane, you spawn many short-lived sandboxes from your application code.

agentic-sandbox wins when: self-host is required, sessions run for hours, your security team needs to sign off on data residency.

Daytona — OSS dev environments, container-first, strong long-running workspace story.

Daytona wins when: you want full IDE-grade dev workspaces, container-only isolation is acceptable, hosted plane is fine.

agentic-sandbox wins when: you need VM-grade isolation alongside containers, agent-process focus over IDE workspace focus, telemetry and reconciliation built for autonomous agents specifically.

OpenHands runtime — Full-stack open agent system with EventStreamRuntime.

OpenHands wins when: you want a complete open-source agent stack from prompt to execution and you're committing to their agent loop.

agentic-sandbox wins when: you have an existing agent toolchain (Claude Code, Cursor, AIWG) and you want isolation without adopting a new agent runtime on top.

Devin — Closed enterprise autonomous-agent product.

Devin wins when: you want a turnkey enterprise contract with a vendor and you accept the closed-source tradeoff.

agentic-sandbox wins when: open source is required, on-prem is required, or you want to compose with your existing AI tooling rather than replace it.

agentic-sandbox is the runtime substrate for the AIWG suite. The orchestration runtime (Agent Loop, daemon, Mission Control, aiwg serve) drives agent processes; agentic-sandbox isolates them.

┌─────────────────────────────────────────────────────────┐
│  Cognitive architecture                                  │
│    agents · skills · rules · memory · ensembles          │
└─────────────────────────────────────────────────────────┘
                          │
                          ▼
┌─────────────────────────────────────────────────────────┐
│  Orchestration runtime                                   │
│    Agent Loop · daemon · Mission Control · aiwg serve    │
└─────────────────────────────────────────────────────────┘
                          │
                          ▼
┌─────────────────────────────────────────────────────────┐
│  Isolation runtime  (optional)                           │
│    agentic-sandbox · QEMU/KVM or Docker · virtiofs       │
│    telemetry · audit · reconciliation                    │
└─────────────────────────────────────────────────────────┘

You don't need agentic-sandbox to run AIWG. Most projects don't. You add it when isolation matters — production-touching agents, regulated workloads, multi-tenant deployments, or when 6+ hour autonomous runs make hosted-sandbox economics untenable.

For the governance and HITL story see /team. The HITL drawer in aiwg serve renders sandboxed agent state the same way it renders unsandboxed agent state — the operator interface is identical.

The Rust management server runs on the host. Each agent gets its own QEMU/KVM VM (or Docker container, your choice). Agents share storage with the host through virtiofs — a global read-only mount for shared tooling, plus per-agent inbox and outbox mounts for task inputs and artifact outputs.

┌──────────────────────────────────────────────────────────┐
│                    Host System                           │
│  ┌────────────────────────────────────────────────────┐  │
│  │           Management Server (Rust)                  │  │
│  │   gRPC :8120  WS :8121  HTTP :8122                  │  │
│  │   Orchestrator · Tasks · Secrets · Pool             │  │
│  │   Registry · Dispatcher · Telemetry · Reconcile     │  │
│  └────────────────────────────────────────────────────┘  │
│                         │                                │
│  ┌──────────────────────┴───────────────────────────┐    │
│  │  Agent VM 01 │ Agent VM 02 │ Agent VM 03 │ ...   │    │
│  │   Claude     │   Claude    │   Claude    │       │    │
│  │   Health     │   Health    │   Health    │       │    │
│  │   Metrics    │   Metrics   │   Metrics   │       │    │
│  └──────────────────────────────────────────────────┘    │
│                         │                                │
│  ┌──────────────────────┴───────────────────────────┐    │
│  │              Agentshare (virtiofs)               │    │
│  │  /global (RO)  /inbox/{id}  /outbox/{id}         │    │
│  └──────────────────────────────────────────────────┘    │
└──────────────────────────────────────────────────────────┘

Linux host with KVM support. Ubuntu 24.04 base image. libvirt + QEMU; Docker 24+ for the container runtime path. Default agent VM: 4 CPUs, 8GB RAM, 40GB disk — configurable.

Full quickstart and prerequisites in the agentic-sandbox README. Three-step path:

# 1. Build management server + agent client

# 2. Provision an agent VM

# OR launch a Docker sandbox if you don't need VM-grade isolation

# 3. Submit a task to the running agent

> agentic-sandbox repo — full README, prerequisites, profile catalog, deployment guides.

> agentic-sandbox docs — install, profiles, runtimes, and deployment guides.

> /team — evaluating governance and HITL? Sandbox is the substrate; /team is the surface.

> /loop — running multi-week projects? See the agent-memory and Agent Loop story.

> agentic-sandbox docs — full documentation: install, profiles, runtimes, and guides.

> agentic-sandbox on GitHub — the repo, the README, the issues.

On the roadmap: a head-to-head against Devin (the closed alternative) under /vs/devin.