# AI use cases for Esf (mitkox/esf)

Repo: [mitkox/esf](https://github.com/mitkox/esf) | Use cases: 4 | Page: https://dedupedai.com/use-cases/mitkox-esf/

ESF is a self-hosted, open source software factory that runs coding agents in isolated CubeSandbox microVMs, verifies their changes, and preserves the patch and execution evidence.

This file holds every use case of this repo. Each one starts with a "## " heading and ends with its URL.

- Turn a coding task into a verified patch: https://dedupedai.com/use-cases/mitkox-esf/run-coding-agent-task-to-reviewable-patch/
- Pause agent runs for human approval: https://dedupedai.com/use-cases/mitkox-esf/hold-agent-changes-for-human-review/
- Submit a reviewed run from a manifest: https://dedupedai.com/use-cases/mitkox-esf/submit-reviewed-run-manifest/
- Audit what an agent run actually did: https://dedupedai.com/use-cases/mitkox-esf/audit-agent-run-evidence/

## How to turn a coding task into a verified patch with Esf

Repo: [mitkox/esf](https://github.com/mitkox/esf) | Difficulty: Advanced | Time: 3 hours 30 minutes | Basis: From the README

Run a coding agent in an isolated microVM and get a patch plus gate results.

**Who it is for:** A developer or engineering lead with a repo and a clear change to make, who wants an agent to do the work without touching their workstation.

**The problem:** Letting a coding agent edit a working tree directly risks unverified changes, leaked credentials, and no record of what happened.

**The outcome:** A durable patch, logs, and manifest for one task, with the agent output checked by the configured verification gates.

### Steps

1. Run `git clone https://github.com/mitkox/esf.git` and `cd esf`, then `mkdir -p bin` and `make build`.
2. Run `./bin/factory init`, then edit factory.toml with your Cube API endpoint, template, proxy address, agent harness, and verification profile. Keep factory.toml and .env out of Git.
3. For local Temporal, copy `deployments/dev/temporal/.env.example` to `deployments/dev/temporal/.env`, set a random database password, then run `make temporal-up`.
4. Run `./bin/factory config validate` and `./bin/factory doctor`, then start the worker with `./bin/factory worker` in one terminal.
5. In another terminal run `./bin/factory run --repo https://github.com/your-org/your-repo --rev FULL_COMMIT_SHA --task "Describe the change and acceptance criteria" --agent opencode2 --verification default`, then check it with `./bin/factory status RUN_ID` and `./bin/factory logs RUN_ID`. (inferred, check the README)

### Prompt to paste into your agent

```text
In the ESF repo at <esf_path>, submit a run against <repo_url> at commit <full_sha> with the task in <task_file>, then poll `./bin/factory status <RUN_ID>` until it finishes. Report the patch location and gate results, and confirm the verification gates passed before calling the run successful.
```

### Caveat

ESF produces changes for review and does not decide what ships, and the default verification profile expects repository-owned build.sh and test.sh scripts.

Risk, credentials: Agent and Cube credentials must be narrowly scoped and stored locally, since factory.toml and .env are not meant for Git.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/mitkox-esf/run-coding-agent-task-to-reviewable-patch/

## How to pause agent runs for human approval with Esf

Repo: [mitkox/esf](https://github.com/mitkox/esf) | Difficulty: Advanced | Time: 3 hours 30 minutes | Basis: From the README

Stop each run after gates report, then approve, reject, or rework it.

**Who it is for:** A reviewer or maintainer who must sign off on agent-written code before it moves forward.

**The problem:** Agent success alone does not show a change is correct, so each result needs a deliberate decision before it advances.

**The outcome:** Each run waits at a review step, and a rejected change can be reworked as a child run with a note explaining the fix.

### Steps

1. Set `[review] enabled = true` in factory.toml, then run `./bin/factory config validate`.
2. Submit a task with `./bin/factory run --repo https://github.com/your-org/your-repo --rev FULL_COMMIT_SHA --task "Describe the change and acceptance criteria" --agent opencode2 --verification default`. (inferred, check the README)
3. After the gates report, inspect the run with `./bin/factory describe run RUN_ID`.
4. Approve with `./bin/factory review RUN_ID --approve`, or reject with `./bin/factory review RUN_ID --reject --note "use the formal greeting"`.
5. For rework after a rejection, run `./bin/factory run --change CHANGE_ID --parent-run RUN_ID ...` with the same task and repo settings.

### Prompt to paste into your agent

```text
In the ESF repo at <esf_path>, check run <RUN_ID> with `./bin/factory describe run <RUN_ID>` and list its gate results and the patch it produced. Report whether the run is waiting for review and what the reviewer should check before approving, and do not approve it yourself.
```

### Caveat

The review pause only applies when [review] enabled is set to true, and the README does not describe who is authorized to approve.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/mitkox-esf/hold-agent-changes-for-human-review/

## How to submit a reviewed run from a manifest with Esf

Repo: [mitkox/esf](https://github.com/mitkox/esf) | Difficulty: Intermediate | Time: 3 hours 30 minutes | Basis: From the README

Apply a checked run.toml file so the same task runs the same way every time.

**Who it is for:** A platform engineer who wants agent runs defined as reviewed files in version control rather than typed by hand.

**The problem:** Long command lines with repo, revision, and task text are easy to get wrong and hard to audit later.

**The outcome:** A run submitted from a manifest file, with its spend and work items visible in the factory's change list.

### Steps

1. Write a run.toml file that names the repo, revision, task, agent harness, and verification profile, then commit it for review.
2. Run `./bin/factory config validate` to check the factory configuration the manifest depends on.
3. Submit it with `./bin/factory apply -f run.toml`.
4. Track the work item with `./bin/factory get changes`.
5. Inspect the finished run with `./bin/factory describe run RUN_ID`, which shows the manifest, conditions, inventory, and audit.

### Prompt to paste into your agent

```text
In the ESF repo at <esf_path>, read <manifest_path>, confirm it names an allowed repo, a full commit SHA, and a configured agent harness, then run `./bin/factory apply -f <manifest_path>`. Report the resulting run ID and one thing to verify in `./bin/factory describe run <RUN_ID>` before trusting the output.
```

### Caveat

The README does not give the full run.toml schema, so the manifest fields must be taken from the operator guide, not from this card.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/mitkox-esf/submit-reviewed-run-manifest/

## How to audit what an agent run actually did with Esf

Repo: [mitkox/esf](https://github.com/mitkox/esf) | Difficulty: Intermediate | Time: 3 hours 30 minutes | Basis: From the README

Check the patch, logs, and cleanup record for a finished run.

**Who it is for:** A security or compliance reviewer asked to confirm what an agent changed and that its sandbox was cleaned up.

**The problem:** A green result does not show which commands ran, what changed, or whether the execution environment was torn down.

**The outcome:** A written account of the run's patch, gate results, logs, and cleanup status, drawn from the factory's durable records.

### Steps

1. Run `./bin/factory describe run RUN_ID` to read the manifest, conditions, inventory, and audit trail.
2. Run `./bin/factory status RUN_ID --watch` to see the recorded condition transitions.
3. Run `./bin/factory logs RUN_ID` to read the execution logs. (inferred, check the README)
4. Run `./bin/factory get changes` to find the work item and its spend.
5. Compare the recorded patch and cleanup outcome against the task and note any gap in a written report.

### Prompt to paste into your agent

```text
In the ESF repo at <esf_path>, gather the output of `./bin/factory describe run <RUN_ID>` and `./bin/factory logs <RUN_ID>`. Report the patch, the gate results, and whether cleanup is recorded as verified, and verify that the patch matches the task before concluding.
```

### Caveat

The evidence shows what the factory recorded, so a reviewer still needs to read the patch itself before relying on it.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/mitkox-esf/audit-agent-run-evidence/