Backends and OUDA
The shipped agent backends are Hermes and Claude Agent. Hermes runs as a subprocess against the configured model provider. Claude Agent uses the Anthropic SDK in process. Both are launched only through the OpenShell sandbox path.
| Phase | What happens |
|---|---|
| Observe | Collect the user request, thread state, source metadata, memory, and tool surface. |
| Understand | Build the prompt and reason over approved business context. |
| Decide | Choose whether to answer, create cards, propose memory, request an action, or produce workflow output. |
| Act | Return through broker-mediated tools so the control plane can persist, approve, audit, or execute. |
The default agent turn budget is roughly nine minutes. Long-running operations should become workflow or action work rather than a single unbounded chat turn.
Request flow
- An operator sends a message in a thread or a channel plugin creates a thread event.
- The web app records the message and the worker creates a work_run.
- The worker prepares memory, source metadata, plugin action surfaces, and policy context.
- OpenShell launches a sandboxed agent job with explicit network and model egress policy.
- The agent reads approved context, uses broker-mediated tools, and returns output to the control plane.
- The control plane creates cards, memory proposals, action requests, workflow outputs, and audit events.
Sandbox boundary
The sandbox is not the control plane. The box receives the run payload, policy-constrained tools, and placeholder model credentials. The broker is the only trusted channel back to OpenNeko for privileged operations.
- Run identity comes from the broker token binding, which the sandbox cannot forge.
- Model provider keys stay with the OpenShell provider and gateway proxy.
- Data-source and model egress are added as explicit OpenShell policy endpoints.
- The host prologue and epilogue stay outside the sandbox and are handled by the worker.
Outputs
| Output | When it appears | Review path |
|---|---|---|
| Briefing card | The agent or workflow has a concise summary, decision, or status update | Shown in the thread UI |
| Pending memory | The agent proposes durable context from a run | Accepted or declined by an operator |
| Action request | The agent wants to call an external or privileged operation | Evaluated by action policy and possibly queued for approval |
| Workflow output | A scheduled, watched, or manual workflow produces an artifact | Stored with freshness and dedupe metadata |