oritera/Cairn

What it is

Cairn (oritera/Cairn) is an autonomous problem-solving engine whose validated domain is AI penetration testing. The summary covers the architecture and hackathon result; what it omits is the operational detail an engineer needs before running it — the two execution modes, their security posture, and setup.

How it works

Three components: Cairn Server (port 8000) maintains graph consistency only; the Dispatcher reads the graph, schedules tasks, spins up/tears down worker containers, and is the sole writer to the protocol; Worker Containers run one per project, each hosting multiple Agent Workers that receive a prompt and return structured output. Coordination is stigmergic — agents write Facts/Intents to the shared board, never communicating directly.

Preconditions / Affected

• macOS or Linux, Python ≥ 3.12
• Docker for container mode (not needed for local mode)
• Worker backends must be one of: Claude Code, Codex, or Pi
• In local mode, the CLIs must already be installed and logged in on the host

What to do

Both modes need the worker image:

docker pull --platform=linux/amd64 ghcr.io/oritera/cairn-worker-container:latest

Container mode:

cp dispatch.example.yaml dispatch.yaml
docker pull ghcr.io/astral-sh/uv:python3.13-trixie
docker compose up --build

Data persists to ./datas/cairn/. Local mode (no Docker, reuses host CLIs, no API keys in config):

cp dispatch.local.example.yaml dispatch.yaml
uv run --project cairn cairn serve
uv run --project cairn cairn dispatch --config dispatch.yaml

Startup checks only, and the no-Docker regression suite:

uv run --project cairn cairn dispatch --config dispatch.yaml --startup-healthcheck-only
uv run --project cairn --group dev pytest

Caveats

The decisive operational fact the summary hides is in local mode: the dispatcher must run directly on the host, not inside Docker, because the agents run with your user's permissions and no sandbox. Local mode is selected by runtime.execution: local; each project gets an isolated working directory under local.workspace_root (default: the dispatcher's cwd) — file isolation only, not process/privilege isolation. Container mode is the sandboxed option.

The project itself restricts use to environments where you have explicit authorization to operate, and states you are solely responsible for use. Note also the hackathon "AK" result came from an untested pipeline that first came online at 4 AM on race day — impressive, but not evidence of stability under sustained use.