Tools / 03 · SI · Agent sandbox
Realm
Status: Open source · Pre-release
v0.1.x is the first release line. The realm up command refuses to start until an AgentOS driver is bound, the default advisory mode does not contain, and Linux is the only verified platform.
Realm, the home of AI Generated Code, is the agent sandbox of the GSD-Core USSR Stack. It runs an agent’s execution and file mutations inside a locked-down sandbox. It is open source under AGPL-3.0-only and pre-release, and it contains an agent only if you opt into fail-closed policy. Built by Spectrum Web Co in Sydney.
The user can see whether the realm is active or disconnected.
About
What is Realm?
Realm is the agent sandbox component of the GSD-Core USSR Stack. It is open source under AGPL-3.0-only and in its first release line, v0.1.x. It sits between an agent and the files it changes: under fail-closed policy, what an agent executes and writes happens inside the sandbox under policy instead of on the host.
- Agent execution and file mutations in a sandbox
- Fail-closed policy is opt-in; advisory by default
- Omp plugin, CLI, MCP and ACP surfaces
01 — What it is
One sandbox, several ways in.
Realm ships an Omp plugin that autostarts per session, a standalone realm command-line tool with a long-running local daemon (realm up, down, status, doctor, mcp and acp), and MCP and ACP surfaces over stdio. The MCP and ACP surfaces let Muse Code, Claude Code, Grok Build and Hermes Agent use the same sandbox.
- Omp plugin, autostarted per session
- realm CLI with a local daemon
- MCP and ACP over stdio
02 — The guarantee
Contained only when you opt in.
Under the fail-closed policy, every file mutation either lands inside the realm under policy or fails closed, and the user can see whether the realm is active or disconnected. The default advisory mode does not contain: while the realm is disconnected, the Omp guard warns and still allows host write and edit calls. Containment requires opting into fail-closed.
- Fail-closed is opt-in
- Advisory by default: warns, does not block
- Visible realm active or disconnected state
03 — One contract
6 tools, one schema.
An agent inside Realm gets 6 tools behind one frozen schema: exec, read, write, list, status and retry. Paths are workspace-relative, exec is argument-vector first, and shell mode is gated by policy. The documented design is an OpenShell gateway running rootless on the host, a Podman driver that creates one rootless, digest-pinned sandbox container per session, and AgentOS as the workload inside it, with Anda Engine as a separate HTTP service. Realm needs Podman 5.x and does not install it.
- exec, read, write, list, status, retry
- Workspace-relative paths
- One rootless container per session
04 — Status
Pre-release, and plain about it.
v0.1.x is Realm’s first release line, for milestone v1.0, a provisional name. realm up refuses to start with AGENTOS_NOT_CONFIGURED until an AgentOS driver is bound, and that driver is deferred to a follow-up milestone. Podman-gated and host-gated checks await human verification on a Podman 5.x host. Linux is the only verified platform, and the package is private: it ships as a release tarball, not on npm.
Who it’s for
For teams whose agents write files.
Realm is for teams that run agents that execute commands and mutate files and want that work confined by policy. It is pre-release, so evaluate it on a Linux host with Podman 5.x and read the status notes before relying on it for anything important.
- Teams running agents that mutate files
- Omp, Claude Code, Grok Build, Hermes Agent and Muse Code users
- Platform and security teams who want policy-bound execution
- Evaluators comfortable with a pre-release on Linux
FAQ
Realm, answered.
01What is Realm?
Realm, the home of AI Generated Code, is the agent sandbox component of the GSD-Core USSR Stack, which is Ultrathink, Substrate, Swarm and Realm. It runs an agent’s execution and file mutations inside a locked-down sandbox. It ships an Omp plugin, a standalone realm command-line tool with a long-running local daemon, and MCP and ACP surfaces so other agent hosts can use the same sandbox. The code is public on GitHub under AGPL-3.0-only.
02Does Realm contain my agent by default?
No. Realm’s default advisory mode does not contain: while the realm is disconnected, the Omp guard warns and still allows host write and edit calls. Containment requires opting into the fail-closed policy. Under fail-closed, every file mutation either lands inside the realm under policy or fails closed, and the user can see whether the realm is active or disconnected for the session.
03Can I run Realm today?
Partly. Realm is pre-release: v0.1.x is the first release line, for a milestone provisionally named v1.0. In that milestone, realm up refuses to start with the error AGENTOS_NOT_CONFIGURED until an AgentOS driver is bound, and that driver is deferred to a follow-up milestone. Podman-gated and host-gated checks still await human verification on a Podman 5.x host. You can build and test Realm from a clone with npm ci, npm run build and npm test.
04Which agents can use Realm?
Realm ships an Omp plugin that autostarts per session, and MCP and ACP surfaces over stdio (realm mcp and realm acp) that let Muse Code, Claude Code, Grok Build and Hermes Agent use the same sandbox. Per-host setup notes live in the repository’s docs, and for Claude Code the MCP route is claude mcp add realm -- realm mcp. ACP setup is not documented for every host, so check the host notes before relying on it.
05What does Realm need to run?
Realm needs Node.js 22.13.0 or later. Linux is the only verified platform, and macOS and Windows are out of scope. The live sandbox suites need Podman 5.x, and Realm does not install or upgrade Podman for you.
06How is Realm licensed and versioned?
Realm is licensed AGPL-3.0-only. Versions follow 0.<milestone>.<part>, and each green push to main publishes the next part as a GitHub release with a packed tarball attached. The latest release is v0.1.3, and the package is private: it is distributed as that release tarball, not on npm.
07How does Realm relate to Ultrathink, Substrate and Swarm?
Realm is the agent sandbox component of the GSD-Core USSR Stack, alongside Ultrathink (planning), Agent Substrate (runtime, memory, skills and ledger) and Agent Swarm (the SDLC agents). Each has its own page on this site. Realm’s README does not document a runtime coupling to the other three, so treat it as a component of the same stack rather than a dependency of them.
08What tools does an agent get inside Realm?
An agent inside Realm gets 6 tools behind one frozen schema: exec, read, write, list, status and retry. Paths are workspace-relative, exec takes an argument vector first, and shell mode is gated by policy.
Open source
github.com/swcstudiospace/realmView the repo on GitHub ↗Part of the GSD-Core USSR Stack: Ultrathink · Agent Substrate · Agent Swarm