An office of AI agents
that work under your rules.
Before writing a single line, the agents show you a plan. You approve it, you set the budget, and they stick to it. Floor42 is an open-source office, in pixel art on the top floor of a Manhattan tower, where Claude Code agents work as a governed team.
- Threat model
- Decision records (ADRs)
- How v1.0.0 was tested
- SECURITY.md
- Signed build provenance and SBOMs
Why I built it
IT has been my passion for as long as I can remember, and I have always had a project of my own on the go. When AI agents started writing real code, the question that hooked me was not what they can do, but how to let them work without handing them my keys. Floor42 is my answer: the plan, the budget and the permissions are enforced by code instead of asked of the model, and I built it alone, directing AI agents with the method it enforces.
How it works
Governance written in code, not in a prompt: who may do what, on whose behalf, and who decides.
01PLAN FIRST
A mission in one sentence becomes a graph of tickets, each with its criteria, its test and its risk. Nothing runs before you approve it: all of it, a selection of tickets, or after an edit.
02BUDGET FIRST
A mission starts with a cost cap (5 USD by default) unless you remove it yourself, and every session has its own. In graph mode a ticket gets one rework, then you decide. Every figure says whether it is measured or estimated.
03DEBATE AND REVIEW
Architecture choices go to a committee: specialists analyse alone, then debate; the chair writes a decision record you adopt or reject, and a critical objection is never outvoted. Another agent reviews every delivery; at acceptance you can raise objections and send the producer back to work in the same mission.
04ISOLATION
Each agent works in its own git worktree and its shell runs in a sandbox. Your checkout and branches are not touched, except to commit the files you give a mission yourself.
05RISK WATCH
A risk level follows each real session; a rise is journaled with its reasons, and you can quarantine the mission. Detection only: nothing happens before your click.
06EVERYTHING JOURNALED
An append-only journal, every event marked real or simulated. The office you see is rebuilt from it.
07PERMISSIONS, TOOL BY TOOL
Every tool call of every agent (read, write, shell, network, sub-agents, skills) goes through Floor42's fail-closed hooks and a permission table: auto, ask once, ask every time or forbidden. Rules apply to a mission, a ticket, an agent or a single command.
When a rule says ask, the agent waits at your desk with the exact command and the rule that asked; your answer is journaled. Pushing, calling gh or touching Floor42 itself is refused whatever the table says. If Floor42 cannot decide, the answer is no.
08EACH AGENT HAS ITS OWN IDENTITY
In IAM mode (off by default), each agent is a client in a Keycloak realm. You sign in through Keycloak, and you authenticate again when you approve a plan: that mission gets its own delegation, revocable alone.
Each session's token names you as subject and the agent as actor (OAuth 2.0 Token Exchange, RFC 8693), and carries its launch, mission and ticket: acting on your behalf never means acting as you. Floor42 checks it on every hook and MCP call, refuses a token used from another process (WRONG_PROCESS), another mission or another ticket, and lets you revoke an agent or rotate its secret in one click.
A token broker lets an agent call an external API you declared and granted, without ever holding its credential. Measured on Keycloak 26.8.1. The picture shows simulated claims.
SAFE DEFAULTS
The daemon listens on 127.0.0.1 only and refuses foreign Hosts and Origins. Unsafe mode needs a reason and is journaled. IAM mode refuses to start without the sandbox.
SCRIPT TOKENS
Drive the API from your scripts with a token shown once, scoped read, missions:write or all, 30 days at most.
A real mission
Real Claude Code sessions on a small project, sped up.
- The director writes the mission and caps its cost.
- The plan arrives as a graph of tickets, approved in one click.
- Three agents work at once, each in its own worktree.
- Another agent reviews; the director reads the changes in the workshop.
- About 0.22 USD in all, as estimated by Claude Code.
Try it
Nothing to install: the online demo replays a simulated mission in your browser. Or run it yourself:
ADOCKER, SIMULATED DEMO
docker run -p 127.0.0.1:7420:7420 \
ghcr.io/padashtan/floor42:latestOpen http://127.0.0.1:7420 and ask to sign in: the single-use link is printed in that terminal. No AI is called.
BLINUX, REAL AGENTS
curl -fsSL https://raw.githubusercontent.com/padashtan/floor42/v1.0.0/install.sh | sh
floor42 doctor
floor42Needs Java 25 and your own Claude Code (2.1.295 or later), signed in. On Ubuntu 23.10 and later the sandbox needs one AppArmor profile: see the README.
CWINDOWS, REAL AGENTS
Unzip floor42-1.0.0.zip from the releases page and run bin\floor42.ps1. Needs Java 25, WSL 2 with Debian for the sandbox, and your own Claude Code (2.1.295 or later). Windows blocks downloaded scripts: run Unblock-File bin\floor42.ps1 once.
Get involved
Floor42 is one person's work, built in the open. What you try and what you ask shapes what comes next.
Found a security issue? Report it privately through GitHub's private vulnerability reporting, never in a public issue. Want to contribute? Read CONTRIBUTING.md.
How to use it
One mission, from the sentence you type to the change you keep.
1PICK THE PROJECT AND THE MISSION
Press D for your desk, then New mission. Write the objective in plain words and pick the project: a git repository already on your machine, or a new one Floor42 creates. Optionally add a checks command (mvn -q test, npm test) run in each agent's worktree, and a deliverables folder for the documents.
Choose how the team works: Loop (plan, build, review, rework until it passes) or Graph. Add an architecture committee first if the choice is not obvious. Workflows are yours: start from Code change, Light change or Decision, and add your own checks and tasks.
Steps 2 to 6 · approve the plan, follow the work, review, read the journal, know the cost
2APPROVE THE PLAN, DRAWN AS A GRAPH
The planner splits the objective into at most eight tickets. In graph mode each one has its done when criteria, a test command, a risk (low or high) and a tier. Arrows show what waits for what; independent tickets run in parallel.
Approve all, approve a selection, edit or drop a ticket, and set the mission's cost cap. Nothing runs before you click.
3FOLLOW THE WORK
Press B for the board: the graph comes alive as tickets move from to do to review to done. In the scene you see who works at which desk. When an agent needs a decision, it asks at your desk: allow, refuse, or answer its question.
Click the robot for your own terminal: your Claude Code, with your rights, next to the agents. Press C for the API console: every call the office makes, readable.
4REVIEW AND KEEP WHAT YOU WANT
Another agent reviews each delivery. Press W for the workshop: the agent's branch, its changes and the diff. Edit a file yourself, send the work back with a directive, or accept it as a commit on its branch.
The output stays yours: your checkout and branches are not touched, documents are copied to the deliverables folder, and a pull request leaves only when you click it.
5READ EVERYTHING THAT HAPPENED
Every request, permission, answer, cost and setting change goes into an append-only journal in one local SQLite file, shown live in the event log and marked real or simulated. The office is rebuilt from it at each start, and the journal backs itself up.
A mission can be exported as a replay file, cleaned by code before it leaves. Costs (U) show each figure as measured or estimated.
6KNOW WHAT IT COSTS
A mission has a cap you set before it starts (or remove, explicitly), and every session a cap of its own. A graph node gets one rework; after a second rejection the decision comes back to you instead of the meter running.
The costs panel (U) splits the spend per mission, per agent and per ticket, with tokens and sessions, by day, week and month. Each figure says what it is: estimated by Claude Code, provided by it, counted by Floor42, or a bound when a session reported nothing. Never a bill: Floor42 does not see yours.
The real mission above: 6 tickets, 13 sessions, about 0.22 USD as estimated by Claude Code, under a 5 USD cap.
THE SANDBOX
A real mission's shell commands run in a sandbox: a WSL 2 Debian distribution on Windows, the same script natively on Linux. Inside it, a user and mount namespace, no-new-privs, a resource limit and a seccomp filter. The agent sees its own worktree: the journal, the vault, your settings and the other agents' worktrees are not mounted. The network is cut unless you open it.
Without a working sandbox, a real session does not start, unless you switch unsafe mode on yourself, with a reason; every switch is journaled. The limit, said plainly: a kernel flaw would defeat it, and macOS has none.
Tips · shortcuts, a first mission without AI, default permissions
- D desk · B board · W workshop · M meeting room · C API console · U usage · Ctrl+K search · 1–5 rooms · Esc close.
- Start with a simulated mission or the guided first mission: no AI is called, nothing runs.
- Set permissions per tool: auto, ask once, ask every time or forbidden. By default the shell and writing ask once, and the network is forbidden.
- Keep the cap low on a first real mission: a small one costs cents.
- Run
floor42 doctorto see what a machine lacks, with the command to copy.
Workflows that fit your team
How your agents work is not hard-wired: it is a workflow you edit, version and share.
What you can change · steps, your own checks and tasks, a library, loop or graph, versions
- Edit on a timeline. Add, remove and reorder steps on a timeline; problems show under the rows before you save.
- Your own checks. Define a check (what the reviewer verifies, why, whether it blocks) and it runs at its place in every mission.
- Your own tasks. Insert a task of your own between steps, done by an agent: the Research template, for example, adds a research note before the work.
- A library. Start from a template (Code change, Light change, Decision, Research, Review only), derive versions, restore one, export it to a file, import a colleague's.
- Loop or graph. Per mission: the loop (build, review, rework until it passes) or the graph (parallel tickets, one rework each, then you decide).
- Pinned and versioned. A mission keeps the workflow it started with. Workflows are stored in a versioned schema read one release before it is written, so a rollback still runs your missions.
Built the way it governs
Designed and built by one person, directing AI agents with the method Floor42 enforces.
64DECISIONS
Architecture decision records: the context, the decision, what it costs.
2,500+TESTS
Server, web and browser tests, a gate that must pass on Windows and Linux.
1THREAT MODEL
What is enforced, by which code, and what is not.
One honest limit. No real mission has run in IAM mode yet: the identity layer is covered by automated tests, browser journeys and measurements against Keycloak 26.8.1, and its process binding was measured on Windows with WSL only. That is next.
macOS is not verified. Costs are estimates by Claude Code. Agents can change files and run commands: read the security notes before a real mission.
Questions
Does Floor42 call a paid API?
No. Floor42 calls no model itself: it drives your own Claude Code, signed in with your own subscription or API key. What a mission costs is what Claude Code uses, and each mission starts with a cap you set.
What does a mission typically cost?
It depends on the mission. Three small real missions were measured at about 0.23, 0.25 and 0.32 USD, each as estimated by Claude Code. Floor42 does not see your bill. See how v1.0.0 was tested.
Is it safe to run on my code?
It is built to limit what an agent can do, not to remove the risk. Each agent works in its own git worktree, its shell runs in a sandbox with the network cut unless you open it, every tool call goes through the permission table, and push and gh are refused. The limits: a kernel flaw would defeat the sandbox, macOS has none, and agents can change files and run commands. Read SECURITY.md and the threat model before a real mission.
Can an agent break my repository?
Each agent works in its own git worktree; your checkout and branches are not touched. Its shell runs in a sandbox, push and gh are refused, and a pull request leaves only on your click. Read the security notes for what is enforced and what is not.
Where does my code go?
Floor42 runs on your machine, with no telemetry and no account: it sends nothing about you or your work to its author. What leaves your machine is what Claude Code itself sends to Anthropic under your account, a pull request you confirm, and the plugin installs you click.
How is it different from Claude Code alone?
Floor42 does not replace Claude Code: it runs your own Claude Code inside a governed frame. Around each session it adds a plan you approve, cost caps, a permission table enforced by hooks, a sandbox for the shell, a review by another agent and an append-only journal.
Can I use other models?
Not today: Floor42 drives Claude Code only. Other model providers are on the roadmap, under Later.
Do I need Keycloak?
No. IAM mode is optional and off by default. Plans, caps, permissions, the sandbox and the journal work without it.
Can I use it at work?
The licence allows it: Floor42 is Apache-2.0, provided as is, without warranty. The terms of your own Claude Code account still apply to what the agents send to Anthropic, so check your company's policy first.
Which systems?
Windows 11 with WSL 2, and Linux: measured on Debian 13 (WSL 2 kernel) and on Ubuntu 24.04 (which needs one AppArmor profile). Other distributions are not measured, macOS is not verified.
How do I uninstall?
Stop the daemon first. On Windows, delete the unzipped floor42-1.0.0 folder, then %USERPROFILE%\.floor42. On Linux, run install.sh with --uninstall: it removes the program and the floor42 launcher and keeps the data; delete ~/.floor42 by hand to remove that too. Deleting the data folder deletes your journal and the missions' worktrees. The exact commands are in the README.
What's next
Directions, not promises: the order follows what real missions and your feedback show.
- Run the identity layer on real missions, against Keycloak, and publish what it shows.
- Check the installers against the published release, on clean machines.
- Fine-grained authorization: Keycloak manages identities, OpenFGA decides who may touch what.
- Crash recovery: after a stop, reconcile the journal with what is really there; resume, retry or abandon, never repeat an uncertain side effect.
- Adversarial security lab: a reproducible suite that tries to bypass every control.
- Governed delivery: accepted change, pull request, CI evidence, release, each step on explicit authorization.
- Evidence package: a mission dossier in Markdown or JSON, redacted by default.
- Repository profiles and preflight, an agent and workflow benchmark, other model providers and an economical mode.
Also in the office
Everything below is in v1.0.0 and covered by the test suite, most of it by a browser journey.
16 more things · deliverables, reports, your team, the meeting room, the API, backups, the pets
- Deliverables viewer. A mission delivers into its folder; its files open in the viewer, listed with their origin.
- Proof step by step. A delivery is proven step by step, and a failure goes back to its producer.
- End-of-mission report. A report closes each mission, kept with it.
- Lessons and retro. A retrospective after each mission; lessons kept for the next ones.
- Your team. Hire agents with roles and models; each keeps a profile built from its real missions.
- Meeting room. Call your agents to the conference table and ask for their view, with a cap.
- Archive wall. The repository's commits and each agent's branch, in the scene.
- Workflow library. Templates on the bookcase: pick one and the new mission form fills in.
- Skills catalogue. Prepare a catalogued skill in your own console, never sent without Enter.
- Notes and archives. Your notes at the desk, turned into tickets when you want; past missions archived.
- HTTP API. The director's API, described by OpenAPI, with a console that shows each call.
- English and French. The whole interface and the journal, in both languages.
- Remote days. Agents drawn working from home show in a webcam strip.
- A robot, a cat, a dog. The robot opens your terminal. The pets just walk around, and sleep in their baskets.
- Backups. The journal backs itself up; a swapped or truncated journal is detected at start.
- Doctor.
floor42 doctorlists what a machine lacks, with the command to copy.
Your office. Any decade.
The same floor, the same team, in four styles. Pick yours in the settings.
