vs Cloudflare OS
Cloudflare OS is an open-source platform that gives every employee an agent workspace with an isolated code-execution runtime, a governance framework for internal data access, and a platform for personal, modifiable apps. Each app is a "file" that can be a full full-stack application — client code, server code, an API, and durable state — where the server runs as a Dynamic Worker (a V8 isolate created at runtime) instantiated as a Durable Object Facet with its own SQLite database. Agents and apps start with zero access; capabilities are granted per resource as typed bindings, credential-holding gatekeeper Workers enforce policy, and the platform tracks every resource an agent has observed. It deploys into your own Cloudflare account and runs on Cloudflare's edge.
Redgold shares the goal: agents that author and modify applications inside a platform whose security model makes that safe. The substrate differs. A Redgold application is a checked-in Rust serde schema encoded with CBOR, a pipeline manifest, an edge route, and executor-run transform code over engine storage, deployed through GitOps onto your own Kubernetes cluster. The agents are persistent coding-agent workspaces in isolated pods operating the same platform, and the data layer is a content-addressed Lance/Parquet and Postgres engine rather than per-app SQLite.
Criteria
| Criterion | Redgold | Cloudflare OS |
|---|---|---|
| Product unit | A pipeline application: schemas, dataflows, routes, transforms, datasets, and a signed release installed per workspace (pipeline apps) | A personal app "file": client + server + API + durable state, one Dynamic Worker instance per app |
| Instance model | One installation pins one immutable release per workspace; state lives in owner-scoped engine datasets, shared by grant | One isolate per app instance with its own SQLite (Durable Object Facet); sharing the app shares state, sharing a blueprint copies code with fresh state |
| Untrusted code isolation | Tiered: built-in operators and trusted native (cdylib) transforms in process, capability-limited WASM UDFs in the Wasmtime sandbox, and untrusted native/Python UDFs fail closed into Firecracker microVMs (infrastructure overview) | V8 isolates (Dynamic Workers) with outbound networking disabled, millisecond cold starts, defense-in-depth below V8 |
| Capability model | Release-pinned capability consent per installation, dataset grants for shared records, runtime write enforcement against the signed release | Zero default access; typed capability bindings in env, gatekeeper Workers holding credentials, observation tracking gating shares and writes |
| Agent-modifiable apps | Agents author the bounded artifact set (schema, pipeline, surface, UDF, release); validators reject unknown operations and undeclared capabilities before publication | The workspace agent edits the app's own code directly; every user runs their own copy, so modification needs no upstream fork |
| Data model | Content-addressed Rust serde rows encoded with CBOR over a Lance/Parquet cold tier and a Postgres hot tier, owner-scoped reads (data and pipelines) | Per-app SQLite in the facet; company data reached through gatekeepers and MCP portals |
| Deploy target | Your own Kubernetes cluster via CI builds and ArgoCD reconciliation (managed deployment) | Your own Cloudflare account, on Cloudflare's edge runtime |
| Model access | Model API with routing and rate limits next to the agent fleet (LLM API) | Any model through Cloudflare AI Gateway with per-person/team attribution and budgets |
| Maturity | Early, single-operator; app contracts and installation runtime are developer preview (pipeline apps) | Newly open-sourced after internal use; managed dashboard product on the roadmap |
Category boundary
Cloudflare OS centers on the end-user workspace: conversation-first, with documents, workflows, and personal apps materializing out of it, each app a cheap disposable isolate the user's agent can rewrite freely. Its data story is per-app state plus governed reach into existing company systems through gatekeepers. Redgold centers on the data platform underneath that loop: typed records as the ground truth, pipelines and transforms over shared engine datasets, signed releases installed into workspaces, and a coding-agent fleet that operates the cluster itself — build, deploy, review, and ingestion included. Cloudflare OS apps live on state the app owns; Redgold applications live on datasets the platform owns and grants.
The security models rhyme — both make agent-authored code safe by construction, with capability grants instead of ambient authority — but enforce at different layers. Cloudflare OS isolates each app instance in its own sandbox and controls who can reach the instance. Redgold pins what an installed release may do (signed artifacts, capability consent, runtime write enforcement) and scopes what any caller may read at the engine (owner-scoped datasets, explicit grants), with the sandbox tier reserved for untrusted transform code.
When Redgold fits
Redgold fits when the applications are data-and-pipeline shaped — ingestion, transforms, and queryable datasets on infrastructure you control — and when the agents should operate that infrastructure, from CI to deploy to the data layer, rather than live inside a workspace product. If the goal is giving every employee a safe personal-app workspace over existing SaaS systems on managed edge compute, Cloudflare OS is the more direct tool. If the per-instance sandbox model appeals but the workload is heavy data processing on your own cluster with typed schemas and GitOps, the Redgold shape is the trade being offered.