Unsafe planning fails closed
Review-required, malformed, and unavailable classifications stop before command execution.
Pinned project · Local systems agent
Public alpha 0.1.0a1 · developmentSysOps Agent
A local-first, model-assisted operations control plane that wraps host execution in deterministic policy, typed verification, bounded recovery, and redacted audit evidence.
Engineering thesis
Autonomy without enforceable bounds is not an operations feature.
Only objectives classified as safe reach planning. Model output remains subordinate to command classification, workspace write policy, declared success predicates, bounded recovery, and explicit process outcomes.
Two supervised local model roles separate navigation from command authoring. An optional remote oracle is disabled explicitly when strict local processing is required.
Verified alpha evidence
What the repository proves
Commands are policy-gated
Host mutations are refused; workspace writes, subprocess behavior, verification, and recovery are bounded.
Outcomes remain inspectable
Redacted events, typed predicates, distinct exit codes, and recovery traces expose control-flow decisions.
Multi-OS gates execute
713 tests plus Ruff, Mypy, package, dependency, and secret gates pass on protected development.
Safety boundary
Application policy is not host isolation.
- SysOps Agent executes commands on the host and is not an operating-system sandbox or production-ready unattended agent.
- Windows is actively exercised; Unix paths pass CI but are not yet a certified support claim.
- A remote oracle receives redacted operational context and changes the privacy boundary; redaction cannot guarantee removal of arbitrary secrets.