Main Navigation Docs CLI Reference

Appearance

Sidebar Navigation

Getting Started

Getting Inference

Choose a Runtime

Configuring GitHub

Configuring GitLab

Repo Management

Migrating to Manifest-Driven Install

Operations

Runtimes

Claude Code

Pi

Codex

OpenCode

Agents

Triage

Code

Review

Fix

Retro

Prioritize

User Guides

Adopting Fullsend Incrementally

How fullsend authenticates

Using an inference gateway

Bugfix Workflow

Issue Commands

Customizing Agents

Overview

Configuring with AGENTS.md

Configuring with Skills

Configuring Agent Behavior

Default vs. Custom

Escalation Ladder

Bring Your Own Agent

Custom Agent Identity

Chaining Follow-up Workflows

Config Reference

Harness Field Reference

CEL Triggers Reference

Building custom agents (deprecated)

OWNERS File Authorization

Running Agents Locally

Jira Integration

How To Emit Traces

Tracing with MLflow

Concepts

Vision

Architecture

Glossary

Reference

Config Reference

Harness Field Reference

Infrastructure

Infrastructure Reference

Mint Administration

Standalone Mint

Private Repositories

Tracing Reference

Eval Measurements

Gate Binaries

Advanced Setup

OpenAI Workload Identity

Inference Gateway Operator

Layered Config Reference

Contributing

Development

Behaviour Drivers

Behaviour Testing

CLI Internals

E2E Testing

Testing Workflows

Tracing Internals

Contributor Guidelines

Architecture Decision Records (ADRs)

Bot Identities

CEL Triggers and Normalized Events

CI Workflows

Configuration source inventory

Key Design Decisions

Documentation

Forge Abstraction

GitLab Role-Credential Contract

Go Code

Harness Composition

Harness Field Reference

Mintcore Architecture

Implementing an agent runtime

Sandbox Image Topology

Shell Scripting

Terminology: Tier Conventions

Vouch System

Workflow Contracts

Roadmap

Archived roadmaps

Index

August 2026 roadmap

July 2026 roadmap

June 2026 roadmap

Foundation (April–May 2026)

Landscape

Architecture Decisions

1. Use ADRs for decision making

2. Initial Fullsend Design

3. Org-level configuration lives in a conventional repo

4. Go as the implementation language for core tooling

5. Forge abstraction layer

6. Ordered layer model for install, uninstall, and analyze

7. Per-role GitHub Apps with manifest-based creation

8. workflow_dispatch for cross-repo agent dispatch

9. Use pull_request_target in shim workflows

10. Stored browser session for e2e authentication in CI

11. Canonical schema for admin-managed org config.yaml (v1)

12. Normative v1 Git-tracked files under `.fullsend` for admin install

13. Admin install: repository enrollment v1

14. Admin install: GitHub Apps and `.fullsend` credential surface (v1)

15. Normative implementation contracts live under docs/normative/

16. Unidirectional control flow through the execution stack

17. Credential Isolation for Sandboxed Agents

18. Scripted pipeline for multi-agent orchestration

19. Web source under web/ and Cloudflare project under cloudflare_site/

20. Composable single-responsibility agents with individual sandboxes

21. JSONL reasoning trace exposure from sandboxed agents

22. Harness-level output schema enforcement

23. User documentation structure

24. Harness definitions and shared directory layout

25. Provider-based credential delivery for sandboxed agents

26. Stage-based dispatch for agent workflow decoupling

27. Allowed and Disallowed Tools for Agents

28. GitLab Support Architecture

29. Central token mint and shared apps for a secretless .fullsend

30. OpenShell sandbox interaction model

31. Reusable workflows for action-installed distribution

32. safe-push wrapper binary for sandboxed agents

33. Per-repo installation mode

34. Centralized shim routing via dispatch.yml

35. Layered content resolution

36. Agent Execution Sandbox Architecture

38. Universal harness access via URLs and paths

39. TOTP automation for e2e 2FA

40. Org pool for parallel e2e tests

41. Synchronous workflow_call for event-driven agent dispatch

42. Use /fs- prefix for all slash commands

43. Add upstream source headers to managed scaffold files

44. Deprecate per-org installation mode

45. Forge-portable harness schema

46. Host-side API server design for sandboxed agents

47. Vendored installs with --vendor

48. Automatic Updates

49. Agent configuration environment variable convention

50. Framework-native distributed tracing with OpenTelemetry

47. agent-eval-harness for test infrastructure

48. Functional tests for agent pipelines

53. Agent-driven branch targeting for the code agent

54. Require authorization on all agent dispatch paths

55. Unified environment variable delivery for harness runner and sandbox

56. Per-repo pre-commit tools registry

57. Repos management for per-repo installations

58. Agent registration

59. Public mint mode with wildcard allowlists

60. Cross-org mint authorization via org variables

61. Harness CEL triggers and fullsend dispatch drivers

62. Resolving per-repo dispatch version skew

63. Polling-based work discovery via dispatch drivers

64. Deprecate customized/ directory overlay

65. Provider-backed policy composition

66. Behaviour tests with Gherkin and pluggable drivers

67. GitLab cron-polling event dispatch

68. Public community mint architecture

69. Ready-made configuration presets for simplified installation

70. Portable provider and profile resolution

72. Pre-script skip signalling via the pre-script output protocol

73. Named mint privilege levels under agent roles

74. Repos command consolidation

75. Local-path support for profiles and providers

76. Slash command entity-context separation

77. Mint repos scope hardening with PER_ORG_FOREIGN_COMPAT

78. Simplified mint authorization policy

80. config.yaml vs. agent env vars: where a config option belongs

81. Reserve CI workflow env: for infrastructure plumbing, not agent behavior

82. Separate workflow-host allow-list from caller allow-list

83. Repo-level foreign allow-list

86. Conversation surface for agent participation

87. Eval measurements as online trace scoring with portable export

88. CEL-guarded overlays in the harness schema

89. PR-level risk assessment scoring

90. Runtime-neutral sandbox tool hooks contract

91. Per-agent runtime, model and effort on agents: entries

92. OpenAI WIF credential delivery — runner-side exchange, run-scoped provider

93. Event-source routing for run-status notifications

94. Plugins are runtime-scoped harness resources

95. OpenAI WIF mapping scope — repository-only by default

98. Evaluate harnesses against entities with optional event context

99. Codex credential delivery — custom model provider with a runner-seeded token file

100. Sandbox tool hooks on Codex — a translating adapter with per-invocation verification

102. Generate custom agents from the CLI

104. Sub-agent model resolution is a runner concern

105. The runner owns the iteration budget

106. Serialize agent runs and coalesce subsequent events

107. Resolve bot identity before dispatch authorization

108. Tool-call span topology

112. Harness overlays may set any harness field

114. GitHub Packages access through a host-bound provider fed by the workflow token

116. Dummy-playback runtime for multi-agent e2e scenarios

122. Declaring managed repository configuration in repos.yaml

123. Tenant configuration from repos.yaml

124. Criteria for adding a built-in agent role

125. Hybrid GitLab dispatch (webhook fast-path + poller backstop)

126. Fullsend-owned mechanism for Codex sub-agents

127. Harness schema versioning and field types

128. preflight_check is a literal host command, not a script resource

129. Extend preflight coverage to pre_script and post_script

131. GitLab dispatch via pipeline inputs, not Owner-role pipeline variables

132. Occurrence-aware shared poller state for the GitLab webhook driver

133. Apply a data security boundary to authorized actor-attributed content

136. Pass user secrets to host-side scripts through one stored secret

137. An inference gateway is a credential route of its own

138. The inference gateway route has an api-key credential mode

139. The agent functional-test suite lives in the agents repo

140. Sign GitHub scaffold commits server-side with createCommitOnBranch

141. Deterministic filtered entity-context-snapshot staging

142. The inference gateway route can send its credential as x-api-key for Messages-dialect models

145. Keep the credential deny-list out of the runner-secret refusal

Design Documents

Adaptive Agent Selection

Agent Architecture

Agent-Compatible Code

Agent Infrastructure

Agentic SDLC Adoption and Organizational Communication

Applied Problem Considerations

Agent Setup Evaluation Tools

Applied: konflux-ci

Architectural Invariants

Autonomy Spectrum

Code Review

Codebase Context

Contribution Volume

Contributor Guidance

Cross-Run Memory

Debugging Agentic Workflows

Downstream/Upstream

Flapping and Convergence

GitLab Support Implementation Details

Governance

Graduated Approval Policy

Human Factors

Intent Representation

MCP Configuration Drift

Operational Observability

Performance and Load Impact Verification

Platform Nativeness

Production Feedback

Repo Readiness

Review Autonomy Evidence

Security Threat Model

Testing the Agents

Tool Call Risk Assessment

Trustworthiness Evidence

Spikes

SPIKE: Community token mint hosting (GCP vs Cloudflare)

Experiments (Exploratory)

1. Agent outage fire drill

2. Claude-based ADR drift scanner

expected

Expected Analysis: modelcar-oci-ta vs ADR-0046

fixtures

46. Build a common Task Runner image

results

modelcar-oci-ta

3. ADR-0046 drift scanner

4. Zero-config autonomous bug fix engine with self-improving meta-loop

5. Agent scoped tools triage

agents

completeness-assessor

duplicate-detector

reproducibility-verifier

triage

6. Code agent evaluation

variants

V8-hybrid

agents

7. GitHub Actions agent runtime MVP

issues

001: Fix Agent Cycle Time (7-21 min)

002: Fix Agent Workflow Push Permission (Resolved)

003: GitHub Event Throttling After ~20 Reviews

004: Concurrent Bot + Human Fixes Conflict

005: Review Verdict Entries Accumulate in PR Timeline

006: Prompt Injection Scan Missing Detail on Flagged Snippet

007: Reusable Workflows for Multi-Repo Deployment

009: Triage Agent Only Triggers on `issues.opened`

010: Fix Agent Modifying Workflow Files Breaks Agent Pipelines

011: run-gemini-cli Output Parsing Failure (Upstream Bug)

012: Prompt Injection Scan Truncates Diff at 1000 Lines

013: GITHUB_OUTPUT Multi-Line Value Injection

014: Triage Agent Multi-Label Race Condition

015: Replace Static GCP SA Key with Workload Identity Federation

016: Export Gemini CLI Metrics to GCP Cloud Monitoring

8. Guardrails evaluation

9. Hermes-inspired security patterns

10. Host-side API server for sandboxed agents

agents

Host-Side API Server Test Agent

Host-Side API Server Experiment — Findings

results

agent-baked-instructions-full-3803974-1780069315

iteration-1

agent-baked-instructions-full-4005358-1779242542

iteration-1

agent-baked-instructions-restricted-3395961-1780273527

iteration-1

agent-baked-instructions-restricted-4080040-1779243702

iteration-1

agent-openapi-discovery-full-3412828-1780273794

iteration-1

agent-openapi-discovery-full-4038775-1779243123

iteration-1

agent-openapi-discovery-restricted-3445554-1780274427

iteration-1

agent-openapi-discovery-restricted-4097617-1779243949

iteration-1

agent-tooluse-discovery-full-3460017-1780274693

iteration-1

agent-tooluse-discovery-full-4061051-1779243439

iteration-1

agent-tooluse-discovery-restricted-3481065-1780274959

iteration-1

agent-tooluse-discovery-restricted-4121470-1779244303

iteration-1

superpowers

Host-Side API Server Experiment Design

Host-Side API Server — Implementation Plan

Placeholder target repo

11. Integration Service design doc drift analysis

12. Model Armor vs AI agent triage

results

20260330-221136

Experiment Results Analysis — 2026-03-31

13. OpenShell policy bypass

14. OpenShell sandbox evaluation

15. Prompt injection defense-in-depth

Results

16. Promptfoo for agent evaluation in CI

17. Reasoning monitor agent for prompt injection detection

Experiment 005 Results

18. Runner hello world

Claude Code + Vertex AI Authentication Flow

19. Skills

20. Target repository skills in triage

docs

Experiment: Target Repository Skills in Triage

superpowers

plans

User API

21. Tool scoping

agents

bypass-no-tools

coordinator-disallowed

coordinator-tools

deny-test

disallowed-bash

dontask

subagent-disallowed-bash

subagent-tools-bash

tools-bash-skip

tools-bash

tools-write

22. Claude GitHub App auth

23. Review cache publication policy

test-data

results

Test Execution Results

Test Results - Review Cache Experiment

24. CODEOWNERS + GitHub App approval matrix

25. Subagent Process Isolation via PreToolUse Hooks

26. Statistical significance for non-deterministic evals

27. Software Development Life Cycle

Software Development Life Cycle (SDLC) Diagram

Experiment: Agent Evaluation via MLflow + OpenTelemetry

Doc Site

Site Deployment

0.49.0

Other Doc Versions

stable

edge

dev

see all versions

Other Releases

On this page

Versions

Applied Problem Considerations

2. Claude-based ADR drift scanner

expected

fixtures

results

5. Agent scoped tools triage

agents

6. Code agent evaluation

variants

V8-hybrid

7. GitHub Actions agent runtime MVP

issues

10. Host-side API server for sandboxed agents

agents

results

agent-baked-instructions-full-3803974-1780069315

agent-baked-instructions-full-4005358-1779242542

agent-baked-instructions-restricted-3395961-1780273527

agent-baked-instructions-restricted-4080040-1779243702

agent-openapi-discovery-full-3412828-1780273794

agent-openapi-discovery-full-4038775-1779243123

agent-openapi-discovery-restricted-3445554-1780274427

agent-openapi-discovery-restricted-4097617-1779243949

agent-tooluse-discovery-full-3460017-1780274693

agent-tooluse-discovery-full-4061051-1779243439

agent-tooluse-discovery-restricted-3481065-1780274959

agent-tooluse-discovery-restricted-4121470-1779244303

superpowers

12. Model Armor vs AI agent triage

results

20260330-221136

15. Prompt injection defense-in-depth

17. Reasoning monitor agent for prompt injection detection

18. Runner hello world

20. Target repository skills in triage

docs

superpowers

21. Tool scoping

agents

23. Review cache publication policy

test-data

results

27. Software Development Life Cycle

Versions ​

Versions