A production-safe execution harness for Spring Boot. Every proposed tool call enters the same execution gateway, where schema, policy, approval, idempotency, recovery and audit controls are applied according to the risk of the action. Full source. Runs entirely inside your infrastructure.
None of them is a model problem. All of them are what happens when a program that acts on its own meets a real system.
A timeout never means “try again”. SafeExec follows the tool's declared retry contract: replay with the same external idempotency key, reconcile before retrying, or hold for a human when no safe retry exists. When it reconciles, the answer is explicit: applied, confirmed not applied, or indeterminate — and only the second one permits a resend.
An approval binds to an immutable intent. Parameters, policy facts and evidence values are hashed; a change is a new intent that needs a new approval.
DISPATCHING is committed before the external call. After a restart, a scanner reclaims the stale attempt and reconciles instead of guessing.
Shadow mode: real decisions on real data, zero side effects, and a measured agreement rate per tool before any permission is released.
An append-only audit event stream, enforced by a database trigger, replayable by trace: policy version, rule hit, approval, attempt, external key.
Each one is proved by a fault-injection test against a real PostgreSQL, not described in a document. Network timeout doesn't mean "try again."
Real output from two of the five scenario scripts, run against a live instance and a supplier we broke on purpose. Nothing here is a mockup.
Scroll the terminal sideways to read it.
First: the supplier processed the purchase and the response was lost. SafeExec records UNKNOWN, asks the supplier, gets applied, and never resends — one purchase, not two. Then: an approval given against a $26 quote is refused once the quote becomes $40, before anything reaches the supplier.
If a test and a document disagree, the test wins.
UNKNOWN ≠ FAILED
NOT_FOUND ≠ CONFIRMED_NOT_EXECUTED
APPROVED ≠ STILL_SAFE_TO_EXECUTE
The agent proposes. SafeExec decides whether, when and how the proposal becomes an action. Your business tools stay exactly as they are.
The SafeExec runtime never sends production data, API keys, or agent actions to us — there is no telemetry to opt out of. Buying is separate: Creem, as merchant of record, handles your email and payment details.
Java 21 · Spring Boot 3.5 · PostgreSQL 16 · Spring AI 1.1 adapter only (core has no model dependency)
| Module | What it guarantees | Lite (MIT) | Pro |
|---|---|---|---|
| Tool Gateway | Strict schema conversion, Bean Validation, one path for every call, sealed results | runnable | ✓ |
| Policy Engine | Facts not JSON, structured rules, single-action limits, kill switch, fail closed | — | ✓ |
| Intent · Attempt · Recovery | Database-enforced intent isolation and single live attempt, stable external idempotency keys, explicit three-state recovery, bounded retries, crash scanner | — | ✓ |
| Approval · Evidence | Eight-step execution-start transaction, re-approval on stale evidence, hash mismatch or tightened policy | — | ✓ |
| Audit | Per-stage events committed independently, append-only by trigger, redaction, replay | in-memory | ✓ |
| Shadow | Decide without acting, record the human's decision, release per group on a number | — | ✓ |
| Fault-injection suite | 83 tests on a real PostgreSQL 16 via Testcontainers, five runnable scenario scripts | — | ✓ |
| Design notes | Six pages: what breaks, mechanism, invariants, the tests that prove them | ✓ | ✓ |
Try Lite now (MIT, free)
git clone https://github.com/error0702/safeexec-lite.git cd safeexec-lite mvn -q -DskipTests install mvn -q -pl safeexec-lite-gateway exec:java -Dexec.mainClass=fun.autorun.safeexec.lite.Demo
Three calls in ten seconds: one succeeds, one is rejected because the model invented a field, one times out and is recorded as UNKNOWN because a side effect may exist. Lite stops there. Pro is what happens next.
Pro, after the September 21 delivery
unzip safeexec-pro-0.1.0.zip && cd safeexec-pro-0.1.0 ./mvnw -pl safeexec-example-purchase -am spring-boot:run -Dspring-boot.run.profiles=demo ./scripts/scenario-1-timeout-no-double-purchase.sh # through scenario-5
The demo agent is rule-based, so nothing needs an API key. Add a Spring AI model starter and a model proposes instead; the gateway treats its output exactly the same way. PostgreSQL 16 is started for you from the bundled compose file.
One-time payment. Source code. Use it in any number of your own projects.
$79 after delivery. Payments are processed by Creem as merchant of record; we never see your card. By ordering you accept the Terms of Service.
Who it is for
Java backend engineers who have to put an agent in front of orders, payments, refunds or customer messages, and teams delivering agent projects to clients who will ask "what happens when it times out?"
License in one paragraph
Use and modify the source in any number of projects you own or control, including client work you deliver as applications. Do not publish the source, resell it as a starter, or hand it to a third party as a source package. Full text.
Any. safeexec-core has no dependency on any model or on Spring AI. The optional adapter uses Spring AI 1.1's ChatClient, so anything Spring AI supports works; a rule-based planner is included and needs no key at all.
No, no, and no. There is no telemetry code path and no runtime license check; the license file in the zip is informational. Your database, your network, your data.
Because the guarantees are enforced by the database: a compare-and-set for at-most-once, a partial unique index for one live attempt, triggers for immutable intents and append-only audit, FOR UPDATE SKIP LOCKED for the recovery scanner. In-memory databases would prove nothing.
No. It does not plan, orchestrate or manage prompts. It sits between whatever plans and whatever has side effects. Keep your framework.
Daily spend quotas across actions (they need reservations, so they are planned rather than half-built) and a LangChain4j adapter (after the first sale). Everything listed in the table above is written and tested today.
Email support@autorun.fun with your order number. Full refund before delivery, and after delivery if the product cannot run as documented and we cannot fix it within 7 days. Details in the Terms of Service.
Email security@autorun.fun. Please do not open a public issue. See SECURITY.md in the repository for the threat model.
One inbox, read by the person who wrote the code.
Customer support: support@autorun.fun
Security reports: security@autorun.fun
We aim to answer within 2 business days. Include your order number for license or refund questions.