A library in your process
The .NET application runs the native runtime and MAF agents. There is no mandatory MCP service, backend process, or additional agent server to install.
For a business application, ProjectPath can identify an isolated bid, feedback, or knowledge-article case directory. It is storage for authorized inputs, evidence and session state, not a requirement that end users work in a source-code repository. See the RFP portal job example for the host boundary.
Your .NET process · One active owner per project
Configured IChatClient
Human approval and question UI
Explicit host functions
Lifecycle and cancellation
Coordinator and specialist MAF agents
Released skills and instructions
Bounded dispatch and gates
Deterministic Scribe
| Outside the process | Why it is needed |
|---|---|
| Model provider or local model endpoint | Your IChatClient must reach a compatible model. The runtime does not include weights, inference hosting, credentials, or a model subscription. |
| GitHub, Git, and APM dependencies | Needed during release acquisition. A complete preinstalled artifact tree can remove this network dependency during execution. |
| Writable project storage | Holds project inputs, allocated outputs, and versioned native state. Preserve it across process restarts. |
| Optional external capabilities | Only those your registered functions actually use, such as a search API or an authenticated cloud operation. |
The release's APM target is called copilot because it selects an artifact layout. It does not mean the native runtime calls Copilot CLI or needs its MCP service.
| Concern | Local CLI | Desktop app | Your web/service host |
|---|---|---|---|
| Executable | The repository sample or your console app. | Your .NET desktop process. | Your own API and worker application. Not shipped here. |
| Human interaction | Console approvals and questions. | Your confirmation dialogs and input UI. | Your authenticated, correlated approval/question flow. |
| Model ownership | Local host configures IChatClient. | App configures IChatClient. | Service configures provider identity, model selection, quotas, and tenant policy. |
| Project isolation | Dedicated writable checkout. | User/workspace isolation. | Server-chosen tenant/project mapping, storage isolation, and tool authorization. |
| State ownership | One running owner per project. | Serialize all workspace turns. | Route each project to one active worker. Own the queue and ownership protocol. |
| Storage | Local disk retained between runs. | Durable app/project storage. | Persistent volume with verified locking and backup behavior. Not an ephemeral instance filesystem. |
| Lifetime | Ctrl+C, await completion, dispose. | Cancel on user request and close gracefully. | Graceful drain, cancellation, recovery, idempotent tools, and operational monitoring. |
No turnkey service is included. There is no shipped web API, Docker image, Helm chart, managed Azure service, approval transport, or distributed job runner. Cloud hosting is possible by deploying your own consumer app, not by enabling a library flag.
If your users need browser access, the following is a design checklist for a service you build. A container platform, VM, or managed application host may fit, but none removes the native runtime's ownership and human-interaction constraints.
Map identity to allowed tenant/project IDs. Resolve filesystem paths server-side. Never pass an arbitrary browser-supplied path, tool allowlist, model credential, or approval assertion into the runtime.
Maintain one active native run per project. Different isolated projects can be handled by different workers. Do not scale horizontal replicas against the same state and assume the local file lock is a distributed coordination service.
Pre-acquire the pinned release into an approved image or artifact store when practical. Record provenance and validate the complete deployed tree. Keep the project-bound release available throughout its session lifetime.
Show the exact proposal, arguments, relevant evidence, and project identity to an authorized person. Bind the answer to that pending request, reject replay or stale answers, and honor cancellation. The native callback waits within the run's timeout; durable suspension and cross-restart resumption are not shipped.
Use least-privilege credentials for narrowly scoped tools. Implement idempotency and cancellation where possible. Extract evidence only from successful results. Deny by default if no authorized human responds.
Keep the run ID, scope, status, partial evidence, and exception diagnostics. A transport timeout is not proof that an external operation failed or rolled back. Reconcile actual effects before retrying.
Do not leave a user-facing HTTP request open for an entire long-running workflow by accident. Your job API and UI can observe host-owned job state, but that job layer is distinct from the native Scribe and must not rewrite it. A background worker with human callbacks is still Mode = "interactive"; it does not turn this preview into autonomous mode.
OpenTelemetry is optional. Your host owns exporters, access controls, redaction, retention, and provider pricing. Unknown model costs are not zero-cost runs.
This site is plain HTML, CSS, JavaScript, and SVG. GitHub Pages serves those files under the repository path. It does not execute .NET, hold model credentials, persist squad sessions, or expose an approval endpoint.
A maintainer must activate the repository's Pages publishing configuration. The existence of docs\ or a Pages workflow does not mean that GitHub settings have been enabled. See Pages activation and maintenance.