Hullwork builds open, self-hosted infrastructure for AI agents that need to execute code and ship software—not just generate an answer.
An agent is dependable only when its execution boundary and delivery evidence are explicit.
Choose the project for your workload: Sandbox provides isolated execution, Site verifies website delivery, and Infra validates Kubernetes package composition before deployment. Each project can be adopted independently.
The execution and delivery path:
agent request → secure execution → verified deployment → observable result
Sandbox — Secure execution for AI agents
Run an agent's shell and file operations inside a dedicated Kubernetes gVisor Pod. The self-hosted control plane manages durable workspaces, tenant-scoped credentials, quotas, checkpoints, and runtime lifecycle—without ever falling back to host execution.
Interfaces: Python SDK · CLI · MCP | Proof: architecture · benchmarks · live project site
Site — Verified website delivery for AI agents
Turn an agent's deployment request into a real Kubernetes workload through HTTP, CLI, or MCP. The control plane handles tenancy, quotas, builds, ingress, observability, and scale-to-zero—then makes a real HTTP request and records the status code and body digest.
Interfaces: HTTP API · CLI · MCP | Proof: architecture · one-command demo · live project site
Infra — Review package changes before deployment
Compose a package catalog, stack, cluster profile, and version lock into deterministic Argo CD ApplicationSet or Application YAML. Infra checks schemas, artifact locks, and per-cluster capability dependencies offline. Review the generated Git change, then let your existing Argo CD installation reconcile it.
Independent by design: no controller, companion repository, or Lima management cluster is required for the existing-Argo-CD path. Package owners keep their charts and application logic; operators own environment configuration. Capability validation checks declared records, not live cluster readiness.
Status: Public Alpha · v0.1.0-alpha.3. Start with the working HTTP example, follow the existing Argo CD guide, and inspect the tested scope and limitations.
| Principle | Engineering consequence |
|---|---|
| Boundaries over promises | Untrusted code runs with explicit identity, resource, network, and runtime isolation. |
| Evidence over status labels | A deployment is successful only when the running address has been measured. |
| Fail closed | Missing control-plane or runtime dependencies never become permission to execute on the host. |
| Composable interfaces | HTTP APIs, CLIs, SDKs, and MCP tools keep products useful without hidden coupling. |
| Operator ownership | Workspaces, credentials, state, and deployment infrastructure stay in your environment. |
- Need to execute agent-generated code safely? Start with Sandbox.
- Need to turn a generated site into a verified deployment? Start with Site.
- Need to validate package composition before Argo CD sync? Start with Infra.
- Evaluating the architecture? Read each repository's explicit known limitations before adopting it.
Try a project with a real workload and tell us where the first run gets confusing. For Infra, we especially welcome external package examples, clearer validation errors, and reproducible OCI or remote-cluster acceptance runs. Read the contribution guide and bring a use case or issue.