Add Tier 6: Self-Improving Fleet (Engineering Agent) to roadmap#150
Open
Add Tier 6: Self-Improving Fleet (Engineering Agent) to roadmap#150
Conversation
Adds a comprehensive 5-phase plan for a containerized engineering agent that observes fleet performance and applies improvements — without breaking the security model. Key design decision: the engineering agent runs in a standard container with the same hardening as every other agent (UID 1000, no-new-privileges, 512MB mem, no Docker socket). Fleet data flows through new mesh API endpoints. Config changes go through validated admin endpoints with schema checks, security guards, and automatic backups. Code improvements go through git clone → test → PR with human review. Phases: - 6.1: Fleet Observability API (mesh endpoints for fleet-wide data) - 6.2: Config Management API (validated read/write of deployment config) - 6.3: Engineering Agent Definition (agent config + ODIT system prompt) - 6.4: Heartbeat Diagnostics Publishing (agents self-report performance) - 6.5: Improvement Tracking & Feedback Loop (before/after metrics, auto-rollback) Also updates competitive positioning table (no competitor has this) and "Our Moat" / "Next Differentiators" sections.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ROADMAP.md— a comprehensive 5-phase plan for a containerized engineering agent that observes fleet performance and applies improvementsArchitecture Decision
The engineering agent runs in a standard container with the same hardening as every other agent — no host access, no Docker socket, no special privileges. This was a deliberate choice over a host-side tool:
.envaccess (all API keys)Phases
Security
Every threat was analyzed and mitigated — see the Security Summary table in the roadmap. Key properties: no privilege escalation (deadman's switch on admin API), human review for code PRs, auto-rollback for config regressions, allowlisted workspace file access only.
Test plan