Control node and worker nodes

openagentix separates deciding from doing.

Control node (control plane)

The control node runs the API, the console, authentication and RBAC, the agent registry (all published agents.md versions), event ingest, the scheduler and run queue, the policy engine (audit gates and the control agent), the audit trail, the cost ledger and the metrics endpoint.

It never executes tools itself. A compromised or misbehaving agent therefore never runs inside the process that holds the audit trail, the policies and the credentials catalogue.

Worker nodes (data plane)

Each run (or each group of steps of a run) is executed by a short-lived worker that a runner starts. A worker:

1. receives a prepared run: the agent definition, the event, a signed short-lived run token and references to the secrets it may use;
2. calls the model provider and asks the control node’s policy gate before every tool call;
3. streams every step back over an authenticated channel (mTLS or the signed run token);
4. is torn down when the step ends; its scoped secrets are revoked (container runner: on main, opt-in, ships with 0.2; the Kubernetes runner is not wired in yet).

            ┌──────────────── control node ────────────────┐
 event ───▶ │ ingest → queue → policy engine → audit chain │
            │      registry · costs · metrics · RBAC       │
            └───────▲───────────────┬──────────────────────┘
       steps,       │               │ run token, agent version,
       gate queries │               ▼ secret references
            ┌───────┴──────── worker node ─────────────────┐
            │ toolbox image: only the tools this agent needs│
            │ egress allowlisted · read-only · non-root     │
            └──────────────────────────────────────────────┘

Toolbox images

Planned for 0.2: workers run in toolbox images, minimal images that contain only the binaries an agent declares in runtime.toolbox, built from a catalogue, pinned by digest, signed and scanned. Toolbox images are still planned; the container runner on main starts a generic, hardened run-node image.

What is available when

Piece	Status
Control node with the same interfaces as later releases	Available in 0.1
In-process and local workers	Available in 0.1
Kubernetes Job runner as a building block on main, not wired into the platform	Roadmap 0.2
Spawned workers in containers with per-step credentials (container runner and credential broker: on main, opt-in, ships with 0.2)	Next release (0.2)
Toolbox images (signed, scanned, pinned by digest)	Roadmap 0.2
AWS Lambda and CI workers	Roadmap 0.3

Hinweis

Release 0.1 already uses the run token and the gate protocol between worker and control node, even when the worker runs in the same process. Moving to spawned workers changes where the code runs, not what it is allowed to do.