- A session is a machine
- Every session boots its own disposable Linux computer and cuts its own branch. Thousands can run in parallel on one configuration without touching each other. The machine is real: the agent has a shell, a filesystem and the network.
- Work lands through a change request
- What an agent means to keep is committed on the session branch and proposed back toward main. Merge is default-deny for agents; an admin can grant project.cr.merge in singulacomp.yaml, and widening that grant is itself a reviewed change.
- Approval gates are off until you set them
- The shipped default is permissive — an action runs unless you have said otherwise. Set Ask on what should pause and Block on what should never happen, per action or with a pattern rule that can read the arguments in the call.
- Connector credentials never enter the machine
- The sandbox carries one project-scoped SingulaComp token and no third-party keys. The real credential is decrypted server-side and attached to the outbound call. A runtime secret you deliberately grant is different: it is a real environment value the agent can read.
- Everything is a file you own
- Agents, skills, connectors, triggers and memory are text in a git repo. You can read the whole company, diff what changed, and revert it. Open source and self-hostable — SingulaComp Cloud, your own VPC, or your own on-prem network.