Agent Relay Claude Code module

[github-actions[bot]]

A discussion dedicated to the Agent Relay Claude Code module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	10 / 25	20 / 20	12 / 20	10 / 10	70 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README shows worked examples for install_cli true/false, cli_binary, additional_args, release_idle_session_min, health_port, each with sensible defaults and rationale. Covers the module's major configuration surfaces well.
Visual preview	5	0	No image, GIF, or video anywhere in the README.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	agent_relay_credential parameter uses styling = { mask_input = true } and ephemeral = true; README never inlines a literal credential, and the create-form field is disabled/masked.
Non-hardcoded auth path	4	4	README documents that Agent Relay stamps agent_relay_credential onto the build (ephemeral, single-use JWT) rather than the template pasting a raw key; this is the documented non-hardcoded path.

Restricted-Environment Readiness — 12 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The CLI is fetched from the hardcoded https://claude.ai/install.sh in install.sh.tftpl. No variable overrides this URL — cli_binary only selects a path/command name, not a download source.
Bring-your-own binary	10	10	install_cli = false fully skips the download when the CLI is baked into the image; README explicitly recommends this path ("Bake the CLI into the image and set this to false for faster workspaces") and cli_binary lets the path be overridden.
Egress transparency	3	0	No dedicated network/egress/air-gapped section in the README; the install URL only appears inside script comments, not in README prose.
Runs without sudo	2	2	install.sh.tftpl and start.sh.tftpl never invoke sudo; all operations run under the agent user's $HOME. Verified from script contents.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Every variable has a clear description and sensible default; several carry validation blocks (cli_binary regex, exit_if_unused_min, release_idle_session_min range, health_port range, additional_args reserved-flag and newline checks).
Test coverage	4	4	main.tftest.hcl has extensive .tftest.hcl runs covering parameter contract, script rendering, and validation logic; main.test.ts runs real container-based end-to-end tests of install/start scripts, lifecycle states, and metadata scripts.

Agent Integration — 10 / 25

Criterion	Max	Score	Notes
AI governance	10	0	No mention of Coder AI Gateway or Agent Firewall anywhere in the README; the module's "governance" is Agent Relay's own dispatch/parameter contract, not the rubric's named features.
Dashboard entry point	5	0	No coder_app resource or documented dashboard entry; this is a headless runner with no UI surface.
Session continuity	5	5	README's "Idle session release" section explicitly documents that an idle session is parked server-side and "resumes the session on a fresh runner" on the user's next message — native session continuity.
Managed configuration	5	5	base_dir variable documents a configured/managed workdir the runner checks sessions out under; additional_args allows passing through runner configuration flags.

Overall — 70 / 100

Raw 64 / 92 → round(64 / 92 × 100) = 70

---

Scored against SCORECARD.md on 2026-10-27 with solstice-1.