Declarative orchestration for agent workloads
Declare the task.
The fence comes with it.
An agent workload is neither a stateless service nor a batch job. It accumulates state, calls out to model APIs, and can burn money in a loop if nobody is watching.
Stated by the project
Core concepts, protocols and specifications are still being refined, with major breaking changes likely before a stable release.
ax.io/v1alpha1Apache 2.0
- Task
- The isolated runUntrusted agent code in a sandbox with CPU and memory limits.
- Workspace
- A warm startGit repos, MCP servers and skill packages pre-wired before the agent begins.
- Gateway
- The outbound fenceTraffic locked to an explicit host allowlist.
- Model
- The platform's own LLMConfigured with credentials from a cluster secret.
One file, applied with one command
kind: Task
spec:
workspaces:
- name: golang
goal: "Ensure that Go tool chain is available"
debug: trueManifest condensed from the project's own example; nothing is invented.
Deliberately kubectl-shaped: apply, get, describe, watch, delete, plus agent-specific verbs.