Skip to main content
Comis is an open-source, self-hosted runtime under active development. This page summarizes limits that matter when deciding what access to grant and where to deploy it.
Read the repository threat model for the complete trust boundaries, defended threats, residual risks, and operator checklist.

​
Execution isolation depends on the path and host

Linux with a working Bubblewrap provider is the strongest supported execution boundary. macOS sandbox-exec is best-effort and does not provide the same boundary. The ordinary exec tool can run directly on the host when its sandbox is disabled or unavailable. Some terminal and durable orchestration paths fail closed or downshift when their jail cannot be established, but that stronger behavior does not apply to every tool. MCP stdio servers, in-process Node tools, and browser processes are outside the ordinary exec sandbox. Verify the exact path used by each integration instead of describing the whole deployment as sandboxed.

​
Least-privilege defaults require operator configuration

  • The default agent tool-policy profile is full.
  • An empty per-agent secrets.allow list is unrestricted.
  • Human approvals are disabled by default and run only on explicitly wired paths when enabled.
  • Action classification informs policy and audit; classification alone does not pause an action.
Narrow tool policy and secret patterns before accepting untrusted input. If a workflow requires human confirmation, verify that the specific action reaches an enabled approval gate.

​
Skill and code extensions

Prompt-skill manifests can declare permissions and allowed tools, but those fields are advisory metadata unless the same limits are enforced through runtime tool policy and deployment controls. The core plugin registry currently exposes lifecycle hook registration to source-integrated plugins. Comis does not yet ship a stable third-party code plugin loader or marketplace. Adding code-level tools, routes, adapters, or configuration normally requires a source change and composition-root wiring.

​
API and protocol coverage

The OpenAI-shaped HTTP surface implements selected request and response shapes. It is experimental and is not a complete compatibility layer. Agent Client Protocol support is early, library-level bridge work. Comis does not yet ship a daemon entrypoint, non-text prompt support, complete capability negotiation, in-flight cancellation, or a complete approval response round trip. No external A2A protocol implementation is currently shipped. Internal agent-to-agent routing and delegation are not the same as implementing the A2A standard.

​
Context recovery is not an unbounded active prompt

The default DAG context engine keeps canonical messages and tool results recoverable beneath budget-bounded summaries. The active prompt can still contain lossy summaries of older regions. ctx_search, ctx_inspect, and ctx_expand recover selected detail on demand. Configured durable graphs can resume from node-boundary checkpoints. General exact replay of arbitrary agent, provider, network, and tool behavior remains incomplete.

​
Observability has deployment boundaries

Comis provides traces, trajectories, audit events, incident explanation, delivery and system health, memory diagnostics, provider cost accounting, and opt-in spend ceilings. This evidence is broad but does not guarantee that every external side effect can be reconstructed exactly. The standalone Prometheus endpoint has no built-in authentication. Keep it on a trusted interface or protect it with an authenticated proxy. OpenTelemetry model-call export exists, while standard agent, workflow, and tool semantic spans remain incomplete.

​
Self-hosting does not mean offline

The runtime and stored operational data can run on infrastructure you control. Configured model, embedding, messaging, media, MCP, and tool providers may still receive data deliberately routed to them. Review each provider’s data handling and the credentials granted to it.

​
Enterprise readiness is not claimed

Comis does not yet provide proof of a complete enterprise identity stack, independently audited tenant isolation, high availability, Kubernetes operations, compliance controls, or commercial support commitments. Before critical or regulated deployment, evaluate identity integration, authorization defaults, host isolation, retention, backup and restore, upgrades, rollback, availability, metrics protection, support, and external security review.

​
Provider and deployment coverage

Deterministic tests cover the core runtime extensively, but not every model, provider, channel, media service, tool, or host combination is validated live. APIs and configuration can change during active development. Pin versions, test the exact deployment profile, and review release notes before upgrading.