Overview
OpenHands Agent Canvas coordinates local, remote, and Cloud backends, built-in and ACP agents, conversations, automation, and extensions through explicit handoffs. The series follows how backend identity scopes credentials, workspaces, caches, and events, then tests conversation readiness, unattended reach, and deployment trust. Its central lesson is that portability preserves user intent, not runtime authority, isolation, or verified outcomes.
Learning outcomes
- Canvas unifies selection and observation across runtimes but leaves execution authority, workspace access, and credentials with the active backend.
- A backend switch should preserve user intent while rebuilding authentication, workspace, query, route, and conversation state for the new namespace.
- Conversation creation is a runtime contract: agent, model, workspace, tools, context, credentials, readiness, and live events must align.
- Automation, ACP agents, and extensions expand reach, so deployment scope, process isolation, permissions, and outcome verification remain operator responsibilities.
Keywords
Preview every chapter · Unlock full text, audio, and video from chapter 4
PlansFAQ
What does OpenHands Agent Canvas actually control?
OpenHands Agent Canvas controls backend selection, request assembly, state, and observation; the active backend still executes agents, owns workspaces and credentials, and enforces runtime contracts.
What happens when you switch backends in OpenHands Agent Canvas?
Switching backends preserves the user’s task but rebuilds authority-dependent state, including authentication, workspace resolution, query identity, routes, and valid conversation scope.
How does OpenHands Agent Canvas support ACP agents and automation?
OpenHands Agent Canvas lets the Agent Server launch ACP processes and lets Automation dispatch conversations, while those runtimes retain provider-specific behavior and execution authority.
Is OpenHands Agent Canvas a security boundary?
OpenHands Agent Canvas is not, by itself, a complete security boundary; protection depends on backend deployment, workspace scope, credentials, network controls, browser origin, and extension trust.