Start a session and its own isolated Linux machine boots, clones your project repo, and cuts a fresh branch named after that session. The agent gets the whole machine. Only what it commits survives.
One machine per session · Pre-configured · Nothing runs on your laptop
Four things happen before the agent writes its first token. None of them happen on your laptop, and none of them are a setup step you own.
A Linux machine boots from the sandbox image your project declares. It is its own isolated machine: its own filesystem, its own process table, its own network. Nothing is shared with another session.
The machine clones the project repo into /workspace. Your agents, skills, memory, connectors and triggers arrive with it, because all of them are files in that repo.
The machine cuts a branch named after the session. Every edit, commit and stray file the session produces lives on that branch and nowhere else.
OpenCode runs inside the machine as the agent harness, with your models, your tools and your secrets injected at runtime. The machine is ready. The agent begins.
The agent has the whole computer — a shell, a package manager, a filesystem, the network. Not a list of permitted actions with a machine somewhere behind it.
Nothing on the machine is precious. A bad install, a wrong migration, a wiped directory — the machine goes away and takes it with it. Only what the agent commits survives.
The repo is cloned, the tools are installed and the dependencies are resolved before the agent starts. There is no setup step, and no local machine is involved at any point.
Long work does not depend on your tab. Close the laptop and the machine keeps going; open the session tomorrow and the work is where the agent left it.
Each session is its own machine on its own branch, so no two sessions can touch each other. Run one, or run hundreds of thousands at once — each one a different version of the company, working at the same time.
1 session = 1 computer = 1 branch
and every other session you start, each on its own machine
Two agents edited the same file? git has handled that for twenty years. It is a merge. Nothing reaches main without a person approving it.
The sandbox image, its CPU and memory, and which agent gets which machine are declared in kortix.yaml. Change the file, open a change request, and every session started after it boots the new machine.
# the machine every session of this project bootskortix_version: 2runtime: opencode sandbox: default: python templates: - slug: python name: Python 3.12 image: python:3.12-slim cpu: 2 memory: 4 disk: 20 agents: researcher: # this agent gets the python machine sandbox: python# the repo is already here. nothing to set up.$ pwd/workspace # the branch is named after the session$ git branch --show-current9f4c2b7e-1d83-4a6f-b0c2-5e71a9d4c188 # root on a real machine — install whatever the job needs$ uv pip install pandas duckdb$ python analyze.py > report.md # only what it commits survives the machine$ git commit -am "add the q3 revenue report"$ kortix cr→ change request opened toward mainAgents, skills, memory, connectors and triggers are not rows in a database you cannot see. They are files and config in the repo the machine cloned — readable by a person, editable by an agent, versioned like code.
An agent rewriting its own prompt shows up the same way a code change does: a commit, on a branch, in a change request someone reads.
The repo is the company. Fork it, branch it, roll it back, or hand it to a new machine — the whole configuration comes with it.
A machine an agent can do anything on is only safe if the walls are real. They are enforced below the agent, not asked of it.
Open source and self-hostable. Any model, your keys. Kortix Cloud, your own VPC, or fully on-prem.