Run Anvil code changes in Cloudflare Containers by default.

Decisions For The Spike

These are the decisions the spike should validate, not leave as open-ended architecture questions.

Repo Loading And Snapshot Plan

The long-term fast path is Artifacts. The spike should still work before Artifacts access by cloning GitHub and archiving state to R2.

First-Pass Enablement Gate

The cleanest launch control is thread ownership, not a magic phrase. Use the thread parent author as the default opt-in signal because it is structured, auditable, and hard to trigger accidentally. Keep !!! as an optional allowlisted escape hatch for testing, but do not require normal users to learn it.

type RunnerPolicy = {
  runner: 'cloudflare' | 'superset';
  reason:
    | 'global-disabled'
    | 'thread-starter-allowlist'
    | 'explicit-prefix'
    | 'not-allowlisted';
  promptText: string;
};

export function resolveAnvilRunnerPolicy(input: {
  enabled: boolean;
  threadParentUserId: string | null;
  requesterUserId: string;
  mentionText: string;
  allowedThreadStarterIds: Set<string>;
  allowedRequesterIds: Set<string>;
  optInPrefix?: string;
}): RunnerPolicy {
  if (!input.enabled) {
    return { runner: 'superset', reason: 'global-disabled', promptText: input.mentionText };
  }

  if (
    input.threadParentUserId &&
    input.allowedThreadStarterIds.has(input.threadParentUserId)
  ) {
    return { runner: 'cloudflare', reason: 'thread-starter-allowlist', promptText: input.mentionText };
  }

  const prefix = input.optInPrefix ?? '!!!';
  const explicit = input.mentionText.trimStart().startsWith(prefix);
  if (explicit && input.allowedRequesterIds.has(input.requesterUserId)) {
    return {
      runner: 'cloudflare',
      reason: 'explicit-prefix',
      promptText: input.mentionText.trimStart().slice(prefix.length).trimStart(),
    };
  }

  return { runner: 'superset', reason: 'not-allowlisted', promptText: input.mentionText };
}

Browser Testing And Screenshot Capture

Browser validation belongs in the spike because it is one of the main ways the Cloudflare runner can match or exceed the current Superset developer-machine workflow.

No-Context Agent Handoff

A new agent can use this section as the starting brief. The rest of the page explains the architecture; this section says exactly what to implement first and what counts as done.

You are implementing the first pass of the Anvil Cloudflare code runner.

Read the plan at https://anvil-cloudflare-container-plan.pages.dev.

Goal:
- Keep Superset as default.
- Expose the CF container code-session tool only when:
  1. ANVIL_CF_CONTAINER_RUNNER_ENABLED is true, and
  2. the Slack thread parent user is in ANVIL_CF_CONTAINER_ALLOWED_THREAD_STARTER_IDS
     initially U0A5KQ7U3N3,
  3. or the mention starts with !!! and the requester is in ANVIL_CF_CONTAINER_ALLOWED_REQUESTER_IDS.

Implement in this order:
1. Find the Anvil Slack mention route, Think harness tool registry, and Superset handoff tool.
2. Add a pure resolveAnvilRunnerPolicy() helper with unit tests.
3. Fetch/normalize full Slack thread context before planning.
4. Register tool catalogs by policy: Superset-only vs CF+browser tools+Superset fallback.
5. Add AnvilCodeSession Durable Object keyed by slack:{team}:{channel}:{thread_ts}.
6. Add start_cf_code_session no-op run: create/wake DO, start container, stream logs, emit artifact manifest.
7. Post Slack status with selected runner policy and verification artifact link.

Definition of done:
- Non-allowlisted thread never exposes CF tools.
- U0A5KQ7U3N3-started thread exposes CF tools.
- Optional !!! prefix works only for allowlisted requester and is stripped from the agent prompt.
- Slack retries are idempotent by {channel}:{mention_ts}.
- No-op CF run posts terminal Slack result and artifact/log link.
- Tests cover gate, thread normalization, tool catalog selection, idempotency, and DO resume.
- Superset fallback remains available and unchanged.

Actual Implementation Work Plan

The Anvil Slack ingress/gateway is not checked into this Forge workspace. The implementation should add a small Anvil-owned gateway layer, then reuse the existing Forge worker runtime contracts where they already solve container lifecycle, callback auth, R2 mounts, event journals, and Worker-mediated tools.

Implementation Spike

The spike is complete when Anvil can take a Slack thread request, produce a verified code diff in Cloudflare, and post evidence back to the same thread without creating a Superset workspace.

Source Notes

• Cloudflare Containers: build and push container images, call containers from Workers, and use Durable Object-backed lifecycle control. Docs
• Cloudflare Artifacts: Git-compatible, versioned file trees with Workers, REST, and Git client access; repo-scoped tokens make it a strong fit for per-task agent worktrees. Docs
• Cloudflare Browser Run: headless browser automation, screenshots, PDFs, and Playwright control from Workers. Docs
• Cloudflare GitHub Actions and Git integration: use post-deploy automation to refresh the canonical Forge base after dev deploys succeed. Docs
• Forge local facts checked in this workspace: root and Forge package engines require Node 22.x, root package manager is pnpm 10.28.1, and the current agent-runtime Dockerfile uses a DB-free runtime image with Worker-owned persistence and callbacks.
• Runtime implementation references checked in this workspace: containers/worker/src/runtime-thread-agent.ts, containers/worker/src/agent-runtime/runtime-process-controller.ts, containers/worker/src/routes/runtime-thread-agents.ts, containers/worker/src/agent-runtime/README.md, and packages/common/src/thread-agent-auth.ts. The existing runtime stack supports thread-scoped agents, AgentRuntimeSandbox Durable Objects, R2/session mounts, callback JWTs, and Worker-owned tool proxying, but the Anvil Slack ingress/gateway itself is not checked into this Forge workspace.
• First-pass rollout recommendation: choose thread-parent user allowlisting as the primary gate because Slack provides that as structured metadata. Keep the !!! prefix as an optional allowlisted override for targeted tests, not as the normal rollout control.