Runewrd Labs
ConsoleGet early access
MenuClose

Rune Box docs

Concepts

Rune Box is a small control plane in front of a pluggable backend, and every agent action takes one governed path.

The governed path

request -> policy engine -> approval gate -> guardrails -> backend exec -> audit ledger

REST, the dashboard and MCP all use it. If any stage says no, the action is denied or paused, and the outcome is recorded either way.

Building blocks

Concept Rune Box name What it is
Sandbox Citadel One isolated environment with its own workspace, egress policy and limits.
Policy Charter The sandbox's security contract. Anything not granted is denied. See Policies.
Approvals Conclave Queue where a human allows or denies require-approval actions.
Simulation Oracle Advisory preflight of an action against a policy. It authorizes nothing: the live action still faces current policy, approvals and budgets.
Signed audit trail Chronicle Append-only, hash-chained, ed25519-signed ledger, verifiable offline.
Network controls Perimeter Deny-by-default egress allowlist.
Budgets Rationing Caps on time, execs, egress requests, tokens and cost, plus retry-loop detection.
Agent group Cohort N sandboxes sharing a task board (Command Board). See Agent groups.
Policy bundles Archive Signed policy bundles and approved policy templates.

The Rune Box names are the real identifiers in CLI commands (runeward cohort), REST paths (/v1/citadels), MCP tools (runeward_create_citadel), Kubernetes CRDs and policy tables ([rationing]). JSON body keys (such as profile and sandbox), SDK method names, [[policy]] and snapshot keep their old spellings.

Backends

  • Docker/Podman: zero setup, for laptops and CI. Egress goes through an in-process SNI-filtering proxy.
  • Kubernetes: Pods and PVCs, strict L3 egress through a sidecar, CRDs, an admission webhook and multi-tenancy hardening.

Everything above the backend is the same.

Verdicts

Each action gets allow, deny or require-approval, from the engine the policy selects: builtin, cel or rego. When a budget cap is hit, further actions are denied and logged.

Warning: The audit ledger is single-writer. Give each Rune Box instance its own RUNEWARD_STATE_DIR. Sharing one breaks the hash chain, and verification then reports tampering.

Gotchas

  • A sandbox never mounts your project. copy_from copies once; runeward export gets results out.
  • Agent group workers have separate workspaces. Coordinate through the task board.

Surfaces

  • CLI: runeward (CLI).
  • REST API (REST API).
  • MCP server for IDEs and agents (Cursor, Claude Desktop, VS Code).
  • Web dashboard, served by runeward serve.
  • Browser IDE (experimental): code-server in the sandbox through a ticketed proxy. It does not replace host MCP or desktop apps.

Written from docs/concepts.md at commit 1ee29ff4ab36. Rune Box is open source under Apache-2.0.