Inside Hash Agents Orchestrator: How We Turn a Kanban Card into a Pull Request

We have creative minds, innovative ideas, and a hunger to ship our latest solutions to the world. However, that ambition comes with constraints: time and speed.

At Hash, we have one software engineer (the one writing this blog). We are a small team, but a team of creative nerds.

To close the gaps in time and speed, we’ve been exploring multiple AI agent frameworks since day one. This has allowed us to build quickly and reliably, what used to take days now takes hours.

Our flow was, and still is, human-in-the-loop oriented. We don’t believe in pure 'vibe coding', a concept that might look fascinating to those outside of software engineering, but isn't enough for production.

Instead, we’ve honed our internal skills, automations, workflows, context management, and agent orchestration. To close the loop, our observability system gives us complete visibility into exactly what these agentic systems are thinking and doing while fulfilling a task.

Because we are security-focused at our core, our agent orchestration is secure at its core, and that’s what the solution engineering we will discuss in this blog is built upon

Want to see it in action? Watch the demo below

you want to discover how we can help you integrate AI agents securely into your company?, contact us at info@hash-sec.com or via our website's contact form. We would be happy to build your secure AI orchestrator.

The Architect

Let’s deep dive into the architecture of this solution:

The Agent Runner Sandbox

Each agent running a given task will run in a hardened Docker container with a gVisor runtime.

gVisor is an open-source Linux-compatible sandbox that runs anywhere existing container tooling does. It enables cloud-native container security and portability. gVisor leverages years of experience isolating production workloads at Google.

This agent runner will be preconfigured with all the needed credentials, dev tooling, the AI agent harness (Claude Code or Codex CLI), a telemetry forwarding tool, a quality gates tool, a self-review tool, a security gate hook, a handoff tool to ship the final work, and MCP configuration for a custom ask operator tool. This allows the agent runner to use Slack to ask the operator questions, just like a colleague messaging you over Slack.

The Orchestrator

The agent orchestrator is the component responsible for receiving a given task from the Kanban board and fanning out an ephemeral agent runner container in a secure way, featuring a read-only root, dropped capabilities, per-kind credential isolation, and all egress forced through a mitmproxy sidecar.

It assembles the initial prompt for the agent runner, prepares the GitHub repo, provisions toolchains via mise, drives the agent harness (currently Claude/Codex), and streams every message, tool call, and usage event back to the backend via authenticated telemetry. On success, it commits, pushes, and opens a PR before the container is reaped (immediately on success, or retained for 72 hours on failure for forensics).

mise prepares your development environment before each command runs. It keeps project tools, environment variables, and tasks in one mise.toml file so new shells, checkouts, and CI jobs all start from the same setup.

Agent Telemetry Viewer in our Dashboard (This was a testing task)

The Kanban Boards

We wanted to give our agent orchestrator the native software engineering planning method which can be understood and familiar by both human an ai agents. So we added a Kanban to our Hash 3C dashboard, which allow us to plan the project in multiple tickets, tracking project progress via tickets status, spawning up an agent runner to work on a given task which will be orchestrated by our agents orchestrator.

A screenshot of an example Kanban dashboard from our Hash 3C dashboard

The GitHub App and Webhook

The orchestrator signs an RS256 App JWT (9-min expiry), exchanges it for an installation access token, and hands that to the agent runner.

There are two paths:

• a ~45-min cached token for backend reads (listing repos, checking protection), This is used to load our github projects and setting them up in our solution, like settings, the default ai agents, the needed dev tools, the needed integration test softwares, other solutions binaries (mongodb, mysql, postgress, redis …),
• and a mintInstallationToken JIT path that forces a fresh token which will be used by the agent runner to clone the repo and submit the work pr. So the App is never a long-lived PAT, every credential is minted on demand and expires fast.

GitHub Repo Settings Page on our Hash 3C Dashboard.

We have webhook configure on github which used to update the kanban ticket from in review to done once the agent PR have been merged, this help the orchestrator keeping the kanban dashboard up-to-date.

The Ask Operator MCP Tool

The agent orchestrator is the component responsible for receiving a given task from the Kanban board and fanning out an ephemeral agent runner container in a secure way, featuring a read-only root, dropped capabilities, per-kind credential isolation, and all egress forced through a mitmproxy sidecar.

It assembles the initial prompt for the agent runner, prepares the GitHub repo, provisions toolchains via mise, drives the agent harness (currently Claude/Codex), and streams every message, tool call, and usage event back to the backend via authenticated telemetry.

On success, it commits, pushes, and opens a PR before the container is reaped (immediately on success, or retained for 72 hours on failure for forensics).

A sneak peek of the agent leaving :eyes: on my messages ;)

Outro

This was a brief engineering blog about Hash's agent orchestrator solution. If you want to see a demo and learn more about the solution, make sure to check out the video below. If you want to discover how we can help you integrate AI agents securely into your company, contact us at info@hash-sec.com or via our website's contact form. We would be happy to build your secure AI orchestrator.

Screenshots