About this project
Today an agent that needs to run code gets a shell, a container, or a cloud key. The grant is all-or-nothing and invisible: agents ask for 16 GB and root "to be safe" because the alternative is failure, and blocked agents retry against an opaque wall with no machine-readable reason to reason about. BouldersGate makes the grant itself a conversation. request_compute evaluates a request against human-authored policy and returns one of three answers — and creates no environment in the process, so an agent can find the edge of what it may have before committing to anything. Quantitative excess comes back as reduced (16384 MB → 4096 MB), scope excess as narrowed (unrestricted egress → none), each as structured data with path, requested, granted, and reason, so the caller can replan against the real grant. Capabilities with no safe reduced form — privileged, hostFilesystem, dockerSocket — are denied outright with no offer attached, never quietly downgraded to something adjacent. Policy is never exposed as an MCP resource: agents learn the shape of their grant through outcomes, not by reading the ruleset. Multi-tenancy is enforced, not assuma distinct opaque identity — agent_plus a SHA-256 fingerprint — so the responses. Environments belong to that identity, and ownership is checked o_environments, andrelease_environment: one agent canno another's environment, and the testsuite asserts exactly that. list_audlling agent's own decisions, withcommand contents and credentials nevGrants are enforced rather than prom image digest resolved from the OCIregistry at negotiation time, and acexact digest — a mutable tag cannot be re-pointed between the promise and ts with zero inherited environment variables, egress removed, and the fironment's own workspace, on a container backend where a Docker daeess backend where none does. Both are verified by assertions in the test sve NitroCloud deployment.
Open Innovation track
Solve any real-world problem with AI, regardless of industry or domain.