Hands: governed execution for AI coding agents

SEC. 03b: GOVERNED EXECUTION

Hands

The only memory that can act. Every command is declared in kontexta.json, sandboxed by contract, and gated by human approval when destructive.

KONTEXTA.JSON · CONTRACT

{
  "tools": {
    "deploy-staging": {
      "description": "Deploy to staging Cloud Run",
      "command": ["gcloud", "run", "deploy",
                  "my-service", "--region", "us-central1"],
      "danger": "moderate",
      "confirm": true,
      "timeout": 180000
    }
  }
}

// argv is fixed. no interpolation, no drift.

RUNTIME · APPROVAL LOOP

agent → deploy-staging()

kxta ← token: 7f3a…c1 (expires 60s)

you → approve

kxta → hands.confirm(token)

exec → gcloud run deploy …

FIG. 4d: HUMAN IN THE LOOP

left: the tool as a contract · right: the agent asks, you approve, kontexta runs it

P-01

Declared, not conjured

Every command lives in kontexta.json. The agent can only invoke tools you wrote down. No rogue shell, no argv smuggling, no surprise.

P-02

Sandboxed by contract

Parameters carry regex patterns. argSeparator blocks path injection. Timeouts, working directories, and danger levels ship with the tool definition.

P-03

Approval-gated when it matters

Set confirm: true on anything that mutates a remote system. The first call returns a 60-second token; nothing runs until a human approves.

The memory-MCPs remember. Kontexta acts.