An autonomous agent run

This walkthrough shows the end-to-end shape of ZTD: you initiate, the agent runs unattended in isolation, and the only thing that leaves the VM is a git branch you can review. Every step below is implemented today — ztd cattle composes the whole sequence into one command.

The scenario

You want an agent to attempt a change on myapp without babysitting approval prompts and without any risk to your host.

1. Launch the VM

cd myapp
./ztd up

The guest boots with its own Docker daemon and a per-VM ephemeral SSH key. Locally your working tree is live-mounted over virtiofs; on a remote backend, sync it up:

TARGET=proxmox ./ztd mount   # sshfs-syncs your tree (incl. .git) into the guest

The guest holds no forge credentials — it never talks to your forge.

2. Let the agent work

In Phase 1, cloud-init auto-launches the agent; today you start it yourself:

./ztd ssh
cd ~/myapp
claude --dangerously-skip-permissions   # the agent works, builds, tests — isolated
git commit -am "attempt 1"              # local commits only; no remote is contacted

The agent does its thing inside the VM — installing packages, running builds, committing — none of which can touch your host or reach your forge.

3. Pull the results back, then push from the host

The valuable output leaves the VM as git commits, pulled back to your host:

# local backend: same .git over virtiofs — the commits are already here.
TARGET=proxmox ./ztd fetch          # remote: pull the guest's commits back
git log --oneline ztd/attempt-1     # review
git push origin ztd/attempt-1       # host push, YOUR creds — the guest never had them

4. Destroy

./ztd down

What this demonstrates

  • The host was never at risk: no shared Docker socket, and no forge credentials in the guest — only an ephemeral SSH key that grants nothing on your forge.
  • The valuable output — reviewable commits — survived; the VM did not.
  • This is the cattle model and the zero-trust model working together.
Backward Examples Blog Forward