Bigwave

Appearance

Coding-agent harness ​

Design-partner pitch + intake. This page is the public-facing brief for one of Bigwave's two lead wedges. If you're scoping whether Bigwave fits, read this end-to-end before opening a Discussion.

The pitch ​

You have one or more autonomous AI coding agents — Cursor, Continue.dev, Claude Code, Aider, Devin, an in-house ReAct loop — running against your codebase. The agents work, until they don't: an agent rm -rfs a working tree, exfiltrates a secret to a public gist, or burns a weekend chasing a hallucinated symbol. The base model is fine. The harness — the rails the agent runs on — is the gap.

Bigwave is the open-source harness those agents plug into. It takes the OpenAI- and Anthropic-compatible serving surface as a given and stacks the four properties an agent needs to ship work unsupervised on top of it: isolated tool execution (sandboxed python_exec / file_read / file_write / shell_exec so the blast radius of any single tool call is bounded), deterministic guardrails (DSL rules that block harmful actions before the model can take them), validation loops (eval-as-a-gate that refuses regressed agent activations at the manager call), and workspace-scoped accountability (every tool call logged, attributable, replayable).

Ideal customer profile ​

Concrete buyer signals that say "this wedge is for you":

  • Engineering org running 5–20 AI coding agents across one or more product teams, with growing fleet count and zero shared control plane.
  • You've had at least one agent-caused incident — destructive filesystem op, secret leak, hours of compute burned on a hallucinated path — and the postmortem named "no sandbox" or "no guardrail" as a root cause.
  • You can't ship Cursor's hosted backend because of data residency, AppSec sign-off, or regulated-industry constraints. You need self-hosted infrastructure that speaks the OpenAI / Anthropic protocol so the IDE-side tool keeps working without changes.
  • You're operating multiple agent stacks (Continue + Aider + an internal harness, say) and want one audit log, one guardrail policy, one sandbox posture across all of them.
  • You already run vLLM / Ollama / TGI / SGLang for serving and don't want to replace your serving layer to get a harness — you want the harness to ride on top of what you've already picked.

If two or more of those describe you, you're in scope. If none of them do, this probably isn't the right wedge.

What ships today vs roadmap ​

We are honest about this. Every "today" claim below is verifiable in the repo on main.

TodayRoadmap
Sandbox ABC (packages/sandbox/base.py) with subprocess + Docker sibling-container adaptersFirecracker, gVisor, E2B, Bubblewrap, WASM adapters
ToolRegistry + four built-in tools (python_exec, file_read, file_write, shell_exec) all dispatched through the sandboxPer-tool-call cost ledger pivot (/admin/inference/{id} → tool-call timeline)
Workspace-uploaded tools (PUT /admin/workspace-tools/{name}) — shell-template + python-template handlers, both sandboxedlm-evaluation-harness adapter so partner-side eval suites import unchanged
MCP client (packages.agent_runtime.mcp_import.import_mcp_tools) lands remote tools in the same ToolRegistrySandbox snapshot / fork primitives for branching trajectories
MCP server (/admin/mcp/tools, /admin/mcp/call) re-exposes Bigwave admin reads to MCP-aware clientsSandbox-shared FS overlay so agents can collaborate on the same scratch directory
Deterministic guardrail DSL (packages/guardrails/) — regex / deny / allow / rewrite / warn, hot-reloads on session startAutomated drift-detection scheduler (operators currently call DriftDetector.report() themselves on a window)
Binding deployment gate (packages/eval/gate.py, EvalGate) wired into ReplicaManager.activate — GateBlock returns 422 and the old adapter handle is preserved
trajectory_match scorer (packages/eval/scorers/trajectory_match.py) — Levenshtein edit distance over tool-call sequences
hallucination_probe scorer (packages/eval/scorers/hallucination_probe.py) — refusal-rate scorer with severity weighting + 15-probe starter set
jailbreak_resistance scorer (packages/eval/scorers/jailbreak_resistance.py) — role-retention scorer + 12-attempt starter set across 6 attack families
llm_judge scorer (packages/eval/scorers/llm_judge.py) — rubric-DSL scoring via injected JudgeCallable; make_engine_judge wires to any ServingEngine
DriftDetector (packages/eval/drift.py) — windowed PSI / JS-divergence over trajectory signatures with top-N alerts
Per-workspace sandbox policy (memory / cpu / pids / wall-clock + fs allowlist + network allowlist) at /admin/sandbox/policy, hot-reloads on next session start
Append-only audit log (packages/shared/audit.py) of every dataset upload, training submit, adapter activation, gate decision, channel rotate
Token + tool-call budgets persisted on the agent_sessions row so a runtime restart preserves the running tally

Two-line summary: the rails AND the agent-aware scorers ship. Sandbox / tool-registry / guardrail / binding-gate / audit substrate is production-ready, and all five agent-aware regression detectors (trajectory match, hallucination probe, jailbreak resistance, LLM judge with rubric DSL, distribution drift via PSI/JS divergence) ship today. The remaining roadmap items (more sandbox adapters, automated drift scheduling, lm-evaluation-harness import) are conveniences, not load-bearing for the wedge claim.

What "validation working" looks like ​

The metric the design partner and Bigwave watch together, weekly:

  • Zero destructive-tool-call incidents outside the sandbox. A shell_exec that escapes its workspace allowlist or a file_write that lands outside WORKSPACE_DIR is a P0 for bigwave.
  • Sandbox latency budget — p99 tool-call dispatch < 250 ms for subprocess, < 1 s for Docker-sibling-container, on the partner's hardware.
  • Guardrail false-positive rate — what fraction of legitimate agent actions does the DSL block by accident? Target < 1 % measured over a 7-day window.
  • Binding-gate effectiveness — once at least one scorer is wired (exact-match today; trajectory-match next), the partner observes ≥ 1 prevented activation per month that would have shipped a regressed agent without the gate.
  • Time-to-onboard a new agent stack — adding a fresh Cursor / Aider / custom harness to the same Bigwave install takes < 1 hour, not days.

If those numbers don't move in the right direction in the first 30 days, something is wrong with the wedge fit and we want to hear about it.

How to engage ​

Demo / quickstart ​

A laptop with a consumer GPU is enough to exercise the wedge end-to-end.

bash
# 1. Install bigwave with the default stack (uv + ollama + sqlite).
git clone https://github.com/bigwaveml/bigwave.git
cd bigwave
./install.sh --non-interactive

# 2. Pull a tool-calling model.  Qwen2.5-7B-Instruct is the
#    safe default for both Ollama and vLLM serving adapters.
ollama pull qwen2.5:7b

# 3. Confirm the runtime is up.
bw status
curl -s http://localhost:8080/healthz

# 4. Start an agent session and watch each tool call land
#    inside the sandbox.
curl -s -X POST http://localhost:8080/v1/agent-sessions \
  -H "Authorization: Bearer $BIGWAVE_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"model":"qwen2.5:7b","tools":["python_exec","file_read","file_write","shell_exec"]}'

# 5. Run the agent and stream per-turn output.  Every tool call
#    shows up in /admin/audit and /admin/inference.
curl -N -X POST \
  http://localhost:8080/v1/agent-sessions/$SESSION_ID/run/stream \
  -H "Authorization: Bearer $BIGWAVE_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"input":"List the files in the workspace and summarise."}'

# 6. Tighten the sandbox policy and re-run.  The new limits hot
#    reload on the next session.
curl -s -X PUT http://localhost:8080/admin/sandbox/policy \
  -H "Authorization: Bearer $BIGWAVE_ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"memory_mb":512,"cpu_quota":0.5,"pids_max":64,"wall_clock_s":30,
       "fs_allowlist":["/workspace"],"network_allowlist":[]}'

The full operator walkthrough — including Docker-sibling-container mode, MCP-tool import, and per-workspace guardrail policies — lives in docs/runbooks/agent-harness.md.

Dual-licensed: MIT OR Apache-2.0

© 2026 bigwave contributors