A production-safe execution harness for Spring Boot. Every tool call an agent proposes passes schema, policy, approval, idempotency and audit before it can touch your systems. Full source. Runs entirely inside your infrastructure.
None of them is a model problem. All of them are what happens when a program that acts on its own meets a real system.
One external idempotency key per business action, fixed for every attempt. After a timeout the answer is three-state: applied, confirmed not applied, or indeterminate. Only the second one may resend.
An approval binds to an immutable intent. Parameters, policy facts and evidence values are hashed; a change is a new intent that needs a new approval.
DISPATCHING is committed before the external call. After a restart, a scanner reclaims the stale attempt and reconciles instead of guessing.
Shadow mode: real decisions on real data, zero side effects, and a measured agreement rate per tool before any permission is released.
An append-only audit event stream, enforced by a database trigger, replayable by trace: policy version, rule hit, approval, attempt, external key.
Each one is proved by a fault-injection test against a real PostgreSQL, not described in a document. Network timeout doesn't mean "try again."
If a test and a document disagree, the test wins.
UNKNOWN ≠ FAILED
NOT_FOUND ≠ CONFIRMED_NOT_EXECUTED
APPROVED ≠ STILL_SAFE_TO_EXECUTE
The agent proposes. SafeExec decides whether, when and how the proposal becomes an action. Your business tools stay exactly as they are.
No production data, API keys, or agent actions are ever sent to us. There is nothing to opt out of.
Java 21 · Spring Boot 3.5 · PostgreSQL 16 · Spring AI 1.1 adapter only (core has no model dependency)
| Module | What it guarantees | Lite (MIT) | Pro |
|---|---|---|---|
| Tool Gateway | Strict schema conversion, Bean Validation, one path for every call, sealed results | core model | ✓ |
| Policy Engine | Facts not JSON, structured rules, single-action limits, kill switch, fail closed | — | ✓ |
| Intent · Attempt · Recovery | At-most-once by database constraint, three-state reconcile, bounded retries, crash scanner | — | ✓ |
| Approval · Evidence | Eight-step execution-start transaction, re-approval on stale evidence, hash mismatch or tightened policy | — | ✓ |
| Audit | Per-stage events committed independently, append-only by trigger, redaction, replay | core model | ✓ |
| Shadow | Decide without acting, record the human's decision, release per group on a number | — | ✓ |
| Fault-injection suite | 80+ tests on a real PostgreSQL via Testcontainers, five runnable scenario scripts | — | ✓ |
| Design notes | Six pages: what breaks, mechanism, invariants, the tests that prove them | ✓ | ✓ |
Quick start
git clone <repo> safeexec && cd safeexec ./mvnw -pl safeexec-example-purchase -am spring-boot:run -Dspring-boot.run.profiles=demo ./scripts/scenario-1-timeout-no-double-purchase.sh # …through scenario-5
The demo agent is rule-based, so nothing needs an API key. Add a Spring AI model starter and a model proposes instead; the gateway treats its output exactly the same way.
One-time payment. Source code. Use it in any number of your own projects.
$79 after delivery. Payments handled by Creem; we never see your card.
Who it is for
Java backend engineers who have to put an agent in front of orders, payments, refunds or customer messages, and teams delivering agent projects to clients who will ask "what happens when it times out?"
License in one paragraph
Use and modify the source in any number of projects you own or control, including client work you deliver as applications. Do not publish the source, resell it as a starter, or hand it to a third party as a source package. Full text.
Any. safeexec-core has no dependency on any model or on Spring AI. The optional adapter uses Spring AI 1.1's ChatClient, so anything Spring AI supports works; a rule-based planner is included and needs no key at all.
No, no, and no. There is no telemetry code path and no runtime license check; the license file in the zip is informational. Your database, your network, your data.
Because the guarantees are enforced by the database: a compare-and-set for at-most-once, a partial unique index for one live attempt, triggers for immutable intents and append-only audit, FOR UPDATE SKIP LOCKED for the recovery scanner. In-memory databases would prove nothing.
No. It does not plan, orchestrate or manage prompts. It sits between whatever plans and whatever has side effects. Keep your framework.
Daily quotas (they need reservations; planned), a runnable Lite gateway subset (planned), LangChain4j adapter (after the first sale).
Email security@autorun.fun. Please do not open a public issue. See SECURITY.md in the repository for the threat model.