AI Work Hub
Enterprise supervisor-worker agent orchestration in isolated disposable VM sandboxes.
The Problem
Running untrusted AI-generated code and automated worker pipelines directly on enterprise host machines introduces severe risks of privilege escalation, lateral network movement, and accidental system destruction.
My Role
Engineered the supervisor-worker orchestration architecture, disposable Hyper-V VM isolation pipelines (Stage 1), secure loopback Model Context Protocol (MCP) tunnels, and fail-closed capability gates.
Highlights
- Two-tier Supervisor/Worker architecture separating strategic planning from untrusted task execution
- Stage 1 disposable Windows Hyper-V VM sandboxes with zero host network interfaces and detached virtual disks
- Strict ADR security model completely disabling dangerous capabilities during initial unverified execution stages
- Secure local MCP (Model Context Protocol) stdio and authenticated loopback transport bridges
- Immutable evidence-based acceptance verification enforcing cryptographic hash locks on execution bundles
Stack
Constraints
- Total host boundary defense: no untrusted code execution outside disposable VM sandboxes.
- Strict offline operation: worker sandboxes operate with zero virtual NICs to prevent exfiltration or external command injection.
- Cryptographic determinism: every provisioned execution harness must verify against candidate hash manifests.
System Architecture
Key Trade-offs
The decisions worth defending — what I chose, what I turned down, and why.
Execution sandbox technology
Chose
Disposable Hyper-V Generation-2 VMs with read-only mounted volume injection
Rejected
Windows containers or simple process tokens / AppContainers
Windows containers share the host kernel and have known breakout CVEs; generation-2 hypervisor virtualization provides true hardware-assisted isolation.
Capability rollout strategy
Chose
Strict fail-closed capability gating (ADR-0001: hub.ping only until Stage 1 proof)
Rejected
Gradual allowlist of file operations during development
Allowing partial mutations before complete sandbox boundary evidence is established violates security-first release gates.
Protocol integration layer
Chose
Standardized Model Context Protocol (MCP) over authenticated loopback
Rejected
Custom proprietary RPC protocol
MCP allows seamless interoperability with modern AI model tools and IDE extensions while keeping authentication strictly local.
What I'd Do Differently
An honest retrospective — the stuff I'd change with more time, more users, or a second pass.
- 1Automate memory reclamation and snapshot recycling to lower the 2GB host RAM startup reservation overhead.
- 2Build automated CI integration for Hyper-V nested virtualization testing on cloud runners.
- 3Expand runbook diagnostics to automatically detect host memory pressure before launching provisioners.
Hyper-V Disposable Sandbox Console
Interact with the quarantined isolation supervisor (sandbox boot, mcp bridge, quarantine status, eval "calc.exe").
Technical Deep-Dive
Architecture, specifications, and implementation details.
ADR-0001: Disable file mutation and terminal execution
- Status: Accepted for Stage 0
- Date: 2026-09-13
#Decision
AI Work Hub exposes only hub.ping during Stage 0 through its authenticated loopback HTTP companion and local MCP stdio adapter. It does not expose file read/write, patch, restore, process, shell, interpreter, package-install, or generic terminal capabilities. Unknown HTTP paths and MCP tool names return a structured CAPABILITY_DISABLED error.
#Rationale
A working directory and command allowlist are not an OS security boundary. The architecture requires Stage 1 proof that a restricted Windows execution identity/environment blocks outside-root access, child-process escape, Windows path edge cases, and host credentials. Enabling mutations or commands before that evidence would violate the approved release gates.
#Consequence
Stage 0 cannot satisfy product requirements PR01–PR03 or the web-to-PC exit criterion. Those remain explicit backlog items. This ADR may be superseded only after Stage 1 isolation tests pass and their evidence is reviewed.