AI Work Hub
Enterprise supervisor-worker agent orchestration in isolated disposable VM sandboxes.
The Problem
Running untrusted AI-generated code and automated worker pipelines directly on enterprise host machines introduces severe risks of privilege escalation, lateral network movement, and accidental system destruction.
My Role
Engineered the supervisor-worker orchestration architecture, disposable Hyper-V VM isolation pipelines (Stage 1), secure loopback Model Context Protocol (MCP) tunnels, and fail-closed capability gates.
Highlights
- Two-tier Supervisor/Worker architecture separating strategic planning from untrusted task execution
- Stage 1 disposable Windows Hyper-V VM sandboxes with zero host network interfaces and detached virtual disks
- Strict ADR security model completely disabling dangerous capabilities during initial unverified execution stages
- Secure local MCP (Model Context Protocol) stdio and authenticated loopback transport bridges
- Immutable evidence-based acceptance verification enforcing cryptographic hash locks on execution bundles
Stack
Constraints
- Total host boundary defense: no untrusted code execution outside disposable VM sandboxes.
- Strict offline operation: worker sandboxes operate with zero virtual NICs to prevent exfiltration or external command injection.
- Cryptographic determinism: every provisioned execution harness must verify against candidate hash manifests.
System Architecture
Key Trade-offs
The decisions worth defending — what I chose, what I turned down, and why.
Execution sandbox technology
Chose
Disposable Hyper-V Generation-2 VMs with read-only mounted volume injection
Rejected
Windows containers or simple process tokens / AppContainers
Windows containers share the host kernel and have known breakout CVEs; generation-2 hypervisor virtualization provides true hardware-assisted isolation.
Capability rollout strategy
Chose
Strict fail-closed capability gating (ADR-0001: hub.ping only until Stage 1 proof)
Rejected
Gradual allowlist of file operations during development
Allowing partial mutations before complete sandbox boundary evidence is established violates security-first release gates.
Protocol integration layer
Chose
Standardized Model Context Protocol (MCP) over authenticated loopback
Rejected
Custom proprietary RPC protocol
MCP allows seamless interoperability with modern AI model tools and IDE extensions while keeping authentication strictly local.
What I'd Do Differently
An honest retrospective — the stuff I'd change with more time, more users, or a second pass.
- 1Automate memory reclamation and snapshot recycling to lower the 2GB host RAM startup reservation overhead.
- 2Build automated CI integration for Hyper-V nested virtualization testing on cloud runners.
- 3Expand runbook diagnostics to automatically detect host memory pressure before launching provisioners.
Hyper-V Disposable Sandbox Console
Interact with the quarantined isolation supervisor (sandbox boot, mcp bridge, quarantine status, eval "calc.exe").
Technical Deep-Dive
Architecture, specifications, and implementation details.
Stage 1 synthetic isolation evidence
Status: INCOMPLETE / failed closed (stage1Passed:false). Latest review verdict: NEEDS_REVISION.
#Interpretation
Track independently:
- Implemented in source
- Observed in a guest
- Accepted by review
No current result satisfies all three for Stage 1.
#Current candidate — not attributed to a guest run
| Item | Value |
|---|---|
| Bundle ID | c448bada42de4fe8a324c7593e60f99f |
| Bundle SHA-256 | 2C4E662FD3947A7372FC648A2E7BB83A2ACD3D52A6FA2F69B8E2043B99010CC8 |
| Harness source | FF97B8FE2181AE235CF6B294C0E20C3EB6F3B4ED045A74F4E85AC59E4D5F627E |
| Probe source | 48AE5A5DD31E8B13F21360D4905EA4237D748F81683BBFC9609D7834107FC085 |
| Candidate manifest | 5/5 hashes matched |
Read-only verification found seven archived ZIPs with five entries each: 35/35 matched in aggregate. This candidate has five entries, including archived README SHA-256 617F6A75305962753649939A4BB1EC6AED0ED384FA81053B7B94A82080B2C02A.
Source contains atomic PID/result publication and sharing-violation retry. This is not proof of corrected guest execution.
#VM chronology
| Suffix | Observation | Cleanup | Evidence state |
|---|---|---|---|
4f75947c | Partial isolation evidence; network probes timed out | true | Narrow historical evidence only |
a13f9c72 | WIN32_87 | false | Failed |
c5e701b4 | RACE_READY_TIMEOUT | false | Failed |
d91ac602 | Retry 3 timeout plus inherited-handle fatal in four roles | true | Failed |
e74b08d1 | Sharing violation on pids.txt | false | Failed; later code mitigation exists |
f15c2a90 | Provisioning failed with 0x800705AA | No guest result | Evidence directory absent |
Do not assign the current bundle to these runs without evidence-side identity.
mountPointVolumeTarget is PASS in the actual result.json files for a13f9c72, c5e701b4, d91ac602 and e74b08d1; 4f75947c records mountPointFixture:PASS but lacks mountPointVolumeTarget. Current source implements a real mount point using SetVolumeMountPoint and checks the volume GUID target. These historical observations do not prove complete current-candidate acceptance.
#Host snapshot — 2026-09-14 22:23:16 Europe/Bucharest
- All six VMs were
Off, with zero network adapters,MemoryAssigned:0and unattached VHDX files. - No relevant host process was observed.
- Free physical memory was 1,475,704 KiB, below 2 GiB startup memory.
- Five compile-only host temporary directories remained.
C:\Windows\TempandC:\Windows\SystemTempwere uninspectable.- Guest disks were not mounted.
This does not establish guest profile deletion, ACL restoration, fixture absence or recovery completion.
#Current host snapshot - 2026-09-15 13:00:06 Europe/Bucharest
Supervisor read-only observation: six VMs Off, no virtual NICs, VHDX files unattached/unmounted; f15c2a90 VM ID 7750a32d-8f01-47a6-9d7c-1a44eacaad91; free RAM about 1.14 GiB, below the fixed 2 GiB startup allocation; no new f15c2a90 evidence directory. This is host-state evidence, not guest cleanup. The correction task performed no guest run or VM mutation and ran no new tests.
#Open review gates
- Attributable network denial.
- Complete accepted evidence with candidate identity for the already implemented real volume mount point.
- Current-candidate separate hostile-root and per-type race proof.
- Complete descendant/detached/breakaway/token/handle/shell coverage.
- Complete guest evidence and acceptance for implemented registry, pipe, device, clipboard and shell gates; remaining cancellation, crash, revocation and recovery cases remain open.
- Independently verified cleanup for the same complete run.
File mutation and terminal execution remain disabled.