Supervised Agent Execution on Your Bare Metal
Deploy isolated worker sandboxes with hard token budgets, policy admission gates, and cryptographic result receipts. Zero silent failovers.
Three Beats of Supervised Execution
From intake to verification, every phase guarantees bounded cost and container containment.
Preflight & Quota Locking
Admissions check verifies token reservations upfront against the SQLite ledger. Zero silent failovers or rogue loops.
Gated Tool Boundary
Actions execute inside ephemeral branches or scoped Docker containers with dropped root capabilities. Mutating actions require explicit operator sign-off.
Cryptographic Receipt
Every token consumed is tracked in wire logs and returned alongside test pass/fail output and reproducible diff hashes.
# 1. Admission gate preflight & token reservation
> dot2 worker_submit --repo=/home/jack/code/app --profile=test --limit-tokens=400000
✓ Reserved 262,144 context window on omniroute/glm/glm-5.3
✓ Sandboxed docker container spawned: cap-drop ALL, no-new-privileges
# 2. Wire log completion with exact token accounting
> [wire.jsonl] completion 1/4: input=1,420 output=312 cache_read=0
> Policy gate check: tool 'Bash' command 'pytest tests/test_calc.py' -> APPROVED
> Policy gate check: tool 'Edit' on 'src/calc.py' -> COMMITTED to ephemeral branch
# 3. Final cryptographic execution receipt
✓ Job finished with exit code 0. Signed receipt: receipt_791ca08f.json
Wire-Level Token Protection
No surprise bills from runaway loops. Every completion reserves exact token boundaries before network dispatch. If an upstream drifts or pollutes context, the ledger terminates the run instantly.
Docker & Host Isolation
Full support for Docker execution profiles with dropped capabilities, scoped network bridges, and read-only host binds. Mutating actions require operator approvals through HMAC channels.
GrokBot & Feed Ingestion
Native integration points for real-time X/GrokBot event loops, webhook monitoring, and multi-channel agent handoffs without leaking host API credentials.
Engineered for Agencies & Dedicated Runners
Self-hosted infrastructure with turnkey onboarding, tailored policy gates, and ongoing reliability monitoring.
Paid Pilot
Complete bare-metal setup, model route tuning, and team onboarding
- 1 Dedicated Linux Host or Container Runner stack
- OmniRoute + GLM-5.3 & GLM-5.3 Flash configuration
- GrokBot / X webhook ingestion integration
- Custom tool policy gate & Docker boundary hardening
- 1-on-1 handoff with signed test execution receipts
Pro Maintenance
Ongoing updates, daemon observability, and priority SLA
- Continuous dot2 daemon upgrades & runtime patches
- Ingest latency & token quota monitoring
- Direct Discord / private operator response channel
- Model route failover calibrations & upstream fixes