AI Work Hub
Enterprise supervisor-worker agent orchestration in isolated disposable VM sandboxes.
The Problem
Running untrusted AI-generated code and automated worker pipelines directly on enterprise host machines introduces severe risks of privilege escalation, lateral network movement, and accidental system destruction.
My Role
Engineered the supervisor-worker orchestration architecture, disposable Hyper-V VM isolation pipelines (Stage 1), secure loopback Model Context Protocol (MCP) tunnels, and fail-closed capability gates.
Highlights
- Two-tier Supervisor/Worker architecture separating strategic planning from untrusted task execution
- Stage 1 disposable Windows Hyper-V VM sandboxes with zero host network interfaces and detached virtual disks
- Strict ADR security model completely disabling dangerous capabilities during initial unverified execution stages
- Secure local MCP (Model Context Protocol) stdio and authenticated loopback transport bridges
- Immutable evidence-based acceptance verification enforcing cryptographic hash locks on execution bundles
Stack
Constraints
- Total host boundary defense: no untrusted code execution outside disposable VM sandboxes.
- Strict offline operation: worker sandboxes operate with zero virtual NICs to prevent exfiltration or external command injection.
- Cryptographic determinism: every provisioned execution harness must verify against candidate hash manifests.
System Architecture
Key Trade-offs
The decisions worth defending — what I chose, what I turned down, and why.
Execution sandbox technology
Chose
Disposable Hyper-V Generation-2 VMs with read-only mounted volume injection
Rejected
Windows containers or simple process tokens / AppContainers
Windows containers share the host kernel and have known breakout CVEs; generation-2 hypervisor virtualization provides true hardware-assisted isolation.
Capability rollout strategy
Chose
Strict fail-closed capability gating (ADR-0001: hub.ping only until Stage 1 proof)
Rejected
Gradual allowlist of file operations during development
Allowing partial mutations before complete sandbox boundary evidence is established violates security-first release gates.
Protocol integration layer
Chose
Standardized Model Context Protocol (MCP) over authenticated loopback
Rejected
Custom proprietary RPC protocol
MCP allows seamless interoperability with modern AI model tools and IDE extensions while keeping authentication strictly local.
What I'd Do Differently
An honest retrospective — the stuff I'd change with more time, more users, or a second pass.
- 1Automate memory reclamation and snapshot recycling to lower the 2GB host RAM startup reservation overhead.
- 2Build automated CI integration for Hyper-V nested virtualization testing on cloud runners.
- 3Expand runbook diagnostics to automatically detect host memory pressure before launching provisioners.
Hyper-V Disposable Sandbox Console
Interact with the quarantined isolation supervisor (sandbox boot, mcp bridge, quarantine status, eval "calc.exe").
Technical Deep-Dive
Architecture, specifications, and implementation details.
AI WORK HUB ENTERPRISE DOCUMENT PACK Version 1.1 | 12 September 2026
Read in order: 01_Product_Requirements.docx — AI Work Hub Product Requirements 02_Supervisor_Worker_Workflow.docx — AI Work Hub Model Workflow 03_Architecture_and_Security.docx — AI Work Hub Architecture and Security 04_Delivery_and_Acceptance_Plan.docx — AI Work Hub Delivery Plan
This pack supersedes the initial single-file plan for implementation planning. It explicitly adds the supervisor and coding-worker workflow. It contains design specifications, not an installed plugin or a security certification. All four DOCX files are editable. No model credentials are included.