An engineering brief for global systems integrators — how many parallel AI agents ship verified work across hundreds of client engagements, without a single line of client code pooling anywhere it shouldn't.
It dies three weeks later, in a room with a security architect and a delivery partner. The output was never the issue. These five questions were.
Claw Forge answers all five with mechanisms that already ship — mostly built for reasons other than enterprise sales.
The instinct is to centralise the database so leadership gets one pane of glass. For a firm holding many clients' confidentiality obligations, that instinct is the risk — a shared task store spreads every engagement's obligations across all of them.
Client segregation stops being a policy someone enforces and becomes a property of the architecture. There is nothing shared between engagements because there is nothing shared to begin with.
The OS-level jail is on by default — agent.isolation ships as sandbox, not none.
| Layer | What it actually denies |
|---|---|
| 1 | File tools — Read/Write/Edit/Glob/Grep confined to the project directory |
| 2 | Exempt-command jail — path arguments to git, npm, python checked too |
| 3 | Prompt boundary — the parent project's path is deliberately never named to the agent |
| 4 | OS filesystem jail — sandbox-exec on macOS, bwrap on Linux |
| 5 | Container isolation — opt-in; the parent project is absent from the namespace entirely |
| 6 | Supply chain — npm_ignore_scripts and home_protection both default true |
| 7 | Vanished-worktree fail-closed — every tool denied the moment the worktree stops existing |
Layer 6 is the one reviewers care about most and ask about least. A malicious postinstall runs as an npm child process, not as a command the harness sees — command-level review cannot catch it. npm_ignore_scripts stops it executing at all.
Every telemetry envelope passes assert_structural on its way to disk, from spool.write, with no code path around it.
A leaf key that is not declared is a violation, not a pass-through. 91 declared keys, each with a declared kind.
A path, repo name, branch, client identifier or error string cannot arrive by accident — there is no field shaped to receive one.
Free-text feature categories are classified at the edge into a closed 30-value vocabulary. The original text stays on the machine.
A random install UUID — never hardware, hostname or username — and HMAC-SHA256(install_id, repo_key) per project. The repo key is never transmitted.
Proof it's load-bearing, not decorative. The version-string grammar was tightened because an earlier pattern would have admitted free text after a leading digit. The worked example left in the source is a string shaped like 1-acme-bank-production-secret-name. A client name in a version field is precisely the leak this exists to prevent — and it was closed before it shipped.
Procurement is usually the longest pole. Eight provider types route through one pool — including the three you've already papered.
Route by priority, round-robin, weighted random, least-cost or least-latency. Every provider carries its own circuit breaker.
A rate limit on one account rotates to the next rather than ending the run. Capacity on an existing AWS or GCP agreement, with direct contract as overflow.
ollama covers the engagements where nothing may leave the building at all.
| Control | What it enforces |
|---|---|
| Acceptance | Re-runs the suite in the task's worktree after the agent claims success and before the merge. Non-zero exit returns the task to failed. |
| Baseline | Measures the same suite on the target branch in a throwaway worktree first, so inherited breakage isn't charged to this task. A bug fix is deliberately not forgiven — the inherited failure is its assignment. |
| Assembly | Runs on the target branch after everything merges. The one gate that can see integration, because integration only exists between neighbours. |
| Merge gate | A dependent task waits until its parent is both completed and merged. |
| Attribution | Every failure records agent, infrastructure, integration or unknown — so a broken build box never reads as a bad model. |
The success rate your delivery leads see counts only the failures the agent could have prevented. The denominator is always shown.
Most tooling treats the backlog and the bug tracker as separate worlds that reconcile in a status meeting. Here they share one session, one dependency graph, one lock namespace.
caused_by resolves to the actual feature task that introduced the defect — not a free-text reference someone maintains by hand.
One file-claim namespace means a fix cannot be dispatched against files an in-flight feature already holds.
A defect planned while agents are working is picked up by the running dispatcher on its next wave. No restart.
Bug priority maps above the entire feature range, so a critical defect pre-empts queued work instead of joining the back of the queue.
Several specifications, run in sequence against one repository.
Past a few hundred features the constraint stops being the specification and becomes the run: merge catch-up grows, shared directories serialise, interfaces cannot be frozen mid-flight.
Each subsystem owns one module root, and roots may not overlap. Subsystems cannot collide — by construction, not by care.
after: is the contract freezeThe boundary between runs is where a human reads what the last one produced and decides the interface is settled. A dependency graph inside one spec cannot express that.
Declared in umbrella.yaml, so claw-forge umbrella check reports the two failures no single specification can see: a requirement nobody owned, and one somebody claimed but never built.
Delivered, not designed. One logistics programme on this pattern carries 2,221 completed tasks across 138 categories — 16 subsystems, per-subsystem module footprints, dedicated integration runs for the cross-subsystem flows. Its brief estimated ~1,900 features; the delivered system came in above that. Counts read from the project's task database, not from the brief.
It does not design the decomposition — catalogue, contracts and run order are an architect's work, and that judgement is why it held. Claw Forge makes that structure checkable, not a table someone is trusted to have read.
| Concern | Where it lives |
|---|---|
| Execution | Per engagement — one repo, one state.db, agents in worktrees |
| Model capacity | Per-engagement pool config pointed at the firm's Bedrock / Vertex / Azure accounts |
| Secrets | Per engagement, via ${ENV} expansion and a gitignored local overlay |
| Control plane | Per engagement, bound to loopback or behind a bearer token |
| Reporting | Scheduled claw-forge export --scope all into your warehouse |
| Audit trail | Event log plus agent transcripts, exported with the rest |
Two defaults to change on day one. The state service binds 0.0.0.0 and is unauthenticated until you set CLAW_FORGE_STATE_TOKEN. And agent transcripts are retained in state.db by default — local and never transmitted, but retained. Set a retention window or disable them.
Your review board will find this list. Better that it comes from us — the gaps are what make everything on the previous slides credible.
None of these block an engagement-scale deployment, which is what Claw Forge is built for today. All of them matter if the goal is one shared platform across the whole firm.
The decision at day 90 is not "does it work". It's whether the gaps on slide 10 are worth funding for your firm's scale — answered with your own delivery data rather than a vendor's.
Per-engagement execution with seven containment layers, on by default.
91 declared fields, a closed vocabulary, enforced at every write.
Bedrock, Vertex and Azure through the pool you already pay for.
Tests re-run after the agent and before the merge, with inherited breakage separated from regressions.
Features and defects in one graph, one lock namespace, real lineage.
No shared plane, no RBAC, no compliance pack — stated up front.
The full technical treatment is Part X of the Claw Forge handbook, Claw Forge in the Enterprise — including the configuration keys behind every control on these slides.