Host any agent as a worker.
Every runtime is a real adapter on your Mac, gated on what's actually installed. Bring the agent you already use. Operator supervises it the same way.
Claude Code
The reference runtime, always available. Streams over stdio; PreToolUse hooks pause for approval.
Codex CLI
Drives the Codex app-server over JSON-RPC; blocks on server→client approval calls.
Gemini CLI
ACP plus a BeforeTool hook gateway that runs both gates, fail-closed by design.
ACP agents
One adapter speaks the whole ACP category. Name the executable in a profile.
OpenCode
Headless opencode server over HTTP+SSE; pairs with open-weights backends (Ollama / vLLM).
Computer Use
Agents driving isolated Lume VM sandboxes, every click gated, screenshot at approval.
Ten lines to a supervised worker.
A zero-dependency TypeScript or Python SDK registers any program as a worker over the Operator ingest protocol. Emit semantic events, raise approvals, and inherit Operator's policy, approvals, and hash-chained audit for free. Crypto and policy stay host-side; your code never implements them.
import { OperatorRuntime } from "@operator/runtime-sdk";
const op = await OperatorRuntime.connect({ url, token, workerName: "my-agent" });
op.emit({ kind: "tool", title: "Edit src/app.ts" });
const ok = await op.requestApproval({
title: "Deploy to staging",
command: "kubectl apply -f k8s/",
});
if (ok) deploy();Green auto. Yellow ask. Red never.
Policy is a plain policy.md, the single source of truth, not a hidden settings store. A conservative risk ladder classifies every action; a built-in floor you can't switch off rejects the truly dangerous.
# policy.md
- auto-approve: reads
- auto-approve: installs (≤ 20 / session)
- ask: execution
- ask: network
- require approval: writes
- require biometrics: destructive
# floor (cannot be disabled)
- reject: rm -rf
- reject: secrets accessEvery decision, in a chain you can verify.
Each event is written to an append-only log where every row carries the hash of the one before it. Recompute the chain from the database alone and prove nothing was altered or removed, including every verdict the policy engine made on your behalf.
Pair every Mac. One fleet on your phone.
The Mac is the source of truth; your devices send decisions, never state. Pair a second Mac and its workers interleave into the same fleet, each machine live or offline at a glance, each approval one tap from your wrist even when your phone is asleep.
macOS does the work. Your wrist makes the call.
Cloud-agnostic by design: a zero-knowledge Cloudflare relay today (it only ever sees ciphertext), with a portable self-host container (Helm / Kubernetes, air-gap-ready) on the roadmap.