https://alwaldend.com/docs/infra/openhands/openspec/specs/infra-openhands/Recent content in Infra openhands on AlwaldendHugoenhttps://alwaldend.com/docs/infra/openhands/openspec/specs/infra-openhands/spec/Mon, 01 Jan 0001 00:00:00 +0000https://alwaldend.com/docs/infra/openhands/openspec/specs/infra-openhands/spec/<span id="openhands-infrastructure"></span><h2 id="purpose">Purpose<a class="td-heading-self-link" href="#purpose" aria-label="Heading self-link"></a></h2><p>Describe the checked-in OpenHands component deployment, host boundaries, ingress routing, and Vault secret references. These requirements describe desired configuration and do not establish live deployment or service health.</p> <h2 id="requirements">Requirements<a class="td-heading-self-link" href="#requirements" aria-label="Heading self-link"></a></h2><h3 id="requirement-separate-components-by-responsibility-and-trust-boundary">Requirement: Separate components by responsibility and trust boundary<a class="td-heading-self-link" href="#requirement-separate-components-by-responsibility-and-trust-boundary" aria-label="Heading self-link"></a></h3><p>The deployment SHALL run Agent Canvas, the agent server, and the automation server as distinct components, because each owns a different responsibility. The agent server SHALL run natively with its service account&rsquo;s host permissions. The deployment documentation SHALL identify those permissions as the execution boundary and the workspace as its working directory.</p>