Foreman Runtime Map: Vercel Labs' eve Factory and Three Boundaries

Foreman is Vercel Labs' eve software factory: one eve agent, five subagents, three inbound channels, and two durable stores. The how-it-works page on ask-foreman.dev is the runtime map — what runs where, how the filesystem defines the agent, and the three boundaries the design actually enforces. The template lives at github.com/vercel-labs/eve-software-factory-template.

This briefing is a builder's read of that document, not a launch recap. If you are evaluating agent factories, the useful part is the isolation model, not the marketing sentence that it turns issues into pull requests.

The announcement

Foreman declares every capability as a file under agent/. eve discovers the surface at build time. agent/tools/read_factory_brain.ts is the tool read_factory_brain; agent/subagents/classifier/ lowers into the tool classifier. Renaming something means moving the file. There is no separate name field for identity.

The four-stage pipeline every work item is supposed to pass is classifier, analyst, implementer, reviewer. A fifth subagent, researcher, is optional and runs before the analyst when the item turns on an external fact. Inbound channels turn GitHub webhooks, Linear Agent Sessions, and local dev requests into sessions. GitHub gets 31 allowlisted github__* tools, 12 of them gated. Linear's hosted MCP server denies writes on unattended runs.

What actually changed

The document's claim is structural, not a new model release. Three decisions are supposed to hold because of wiring, not because a prompt asks nicely. Stations inherit nothing: each declared subagent starts a fresh child session with none of the root's instructions, skills, connections, tools, or sandbox. The orchestrator must pack the work item and every prior stage's output into the delegation message. Stations cannot read the factory brain. Long documents travel as handoff artifact ids, not inline.

Trust is stamped at dispatch. Each channel decides who the caller is from the signed webhook before the model reads anything, and writes that into session auth. agent/lib/trust.ts is the single authority; new capabilities are supposed to gate on its predicates. Each station that needs a repo — analyst, implementer, reviewer — declares its own sandbox.ts and gets a separate Vercel Sandbox with its own clone of FACTORY_REPO. Classifier and researcher get an empty /workspace. Git always targets the literal https://github.com/<FACTORY_REPO>.git URL because remote config inside a sandbox is model-writable.

Who should care

Platform teams already running coding agents against GitHub and Linear, and anyone who has been burned by a single long-lived agent session that inherited too many tools. The reviewer sandbox is called out as the one that matters most: it fetches the pushed branch into a clean checkout and reviews what was actually pushed, not the implementer's working tree.

If you need an agent that can browse the public web as part of a factory run, that is the researcher station, and it is optional. If you need Linear writes from an unattended webhook, the current connection denies them. That is a product constraint in the doc, not a footnote.

Availability and how to try it

The Vercel deploy flow on the template sets up the GitHub connector, Linear connector, Vercel Blob store, and prompts for FACTORY_REPO and FACTORY_LABEL. Docs live at ask-foreman.dev/docs. Related pages the runtime map points at are the pipeline, stations reference, trust model, and glossary. eve documentation is at eve.dev/docs/introduction.

Three things persist across runs, all in Vercel Blob under reserved prefixes: the factory brain (one document per target repository), user preferences (one per person), and handoff artifacts (written once, never overwritten, but only the run that minted the id knows it). Conversation history does not persist. Each webhook dispatch is a fresh session. The red-CI fix loop counts its own earlier comments on the pull request thread to enforce a two-attempt cap, because the thread is the only durable record those runs share.

What to watch next

Watch whether Linear write denial on unattended runs stays in place, whether the 12 gated GitHub tools grow, and whether the trust-model page adds caller classes. The stations inherit-nothing rule is the one to re-read if a future change lets a station see root skills.

If you brief this to an agent-platform group, lead with the three boundaries and the deploy-time FACTORY_REPO requirement. Do not brief it as a generally available Vercel product SKU — the public pages describe a Labs template and a docs site. That distinction is in the source, and it is the one this briefing will not blur.