Architecture · 06 of 19 · Run anatomy

What a run gets, and the only two ways out

The contract is small on purpose so any framework fits: environment in, a workspace and an output folder, two audience-bound tokens, and two places to send traffic. Nothing inside holds a credential.

What a run gets, and the only two ways out Architecture of a run namespace containing an agent container of any framework, optional bundled MCP sidecars, optional attached components, a projected run identity, a scratch workspace and guard rails, with exactly two egress paths, to Clearance for tools and to the model proxy for models, and no provider keys inside. RUN NAMESPACE · AGENT-R-<ID> · POD SECURITY RESTRICTEDMCP · RUN TOKENLLM CALLS · SESSION AS CALLERLOCALHOSTAgent containerany framework · any languageMCP sidecarsbundled tools · no credentialsAttached componentsPostgres · Redis · queueRun identityprojected tokens · aud clearance, model-proxyWorkspaceemptyDir · scratch and /run/outputGuard railsquota · limits · default-deny egressClearancetools · policy · auditModel proxyallowlist · budget · caller idLEGENDAgent and gateIdentityGuardOptionalGoverned call

Principle honored

Least privilege by construction. Default-deny egress with two exceptions, no secrets in the namespace (the quota forbids them), a token that names its audience.

What changes

  • Environment: HANGAR_RUN_ID, TASK_ID, SESSION_ID, EXPIRES_AT, LIMITS, INPUT, CLEARANCE_URL, MODEL_PROXY_URL.
  • Files: /workspace to work in, /run/output for results, tokens under /var/run/hangar.
  • On SIGTERM, checkpoint within 30 seconds. Sidecars get the same lockdown and no env.

Consequence

Kubernetes has no pod exec here by policy, so a human cannot shell into a run. Debugging is via output, logs and the audit record. Decide whether that is acceptable before promising it to users.

Hangar · Autopilot