An agentic kernel you self-host.

An independent SRE review graded loomcycle 6.5/10 for startup use and 4/10 for regulated enterprise. The answer: file tools that open each volume as an os.Root with an identity check per path component, Bash killed by process group, credential header values redacted, open mode refused on a public listener, peppered token hashes with loomcycle tokens rewrap. A re-audit ran proof tests against the pre-fix commits and corrected two ticks in our own table: 8/10 and 6/10. v1.121 closed its residuals. writeup →

Rules of {effect, actions, resources, when} over every primitive, documents by path included. An explicit deny beats any allow and order never matters. Groups nest and map to identity-provider groups; bindings attach a list to a user, group, token or tenant with an expiry. LOOMCYCLE_ACL goes compat → shadow → enforce, so tomorrow's refusals show up in the audit before anyone gets one. Inside a run the caller's rules narrow tools, volumes and memory, through a pause, a restart and a night-time schedule. A simulator in Settings → Access. writeup →

The browser no longer holds the API token. Server-side sessions with an opaque HttpOnly cookie, a CSRF header, a sign-out that ends the session on the server, and a strict mode. Three gates: password (Argon2id, NIST SP 800-63B-4 policy, TOTP and recovery codes), OIDC (Google, Entra, Okta, Keycloak, Cognito, Identity Center, Auth0) and OAuth (GitHub, GitLab, Gitea, organisation required on a public instance). A provider says which groups a person is in; it never rewrites an operator's rules. writeup →

A file a tool returns lands in the run's inbox, and the model sees one stub line: name, type, size, SHA-256, source. Never the bytes. The File tool keeps, downloads, uploads (Microsoft Graph ranged upload included), extracts and imports; v1.125 puts it on HTTP. The Git tool runs on go-git: no process, no system git config, the push credential held by the runtime, commits signable with a Crypto-tool key. writeup →

Pure-Go extraction of DOCX, XLSX, PPTX, HTML and PDF into Markdown, imported as a Document tagged untrusted, pictures as image chunks by page and slide. Pages with no text layer go through OCR by a vision model, with page caps and a dry-run cost estimate. v1.125 adds speech-to-text (File op=transcribe) through any whisper server and a usage report by purpose. Search filters by path, type, status, tag and as_of act inside every retrieval leg, not after it. writeup →

Persistent state per agent, per user, per tenant. Four facets: key-value (atomic incr, TTL, cross-run continuity), vector (semantic search via sqlite-vec / pgvector with provider-agnostic embedders, now with per-piece derived search units), SQL (per-scope SQL database the runtime hosts; sqlite + postgres tiers, default-deny sql_scopes gate, explicit + nested transactions, vector columns), and the bi-temporal entity graph (facts carry observed_at / valid_at / invalid_at, a correction never destroys the record, an as_of predicate reads the timeline at any past instant). A subject IS its own Document in the Path tree. The optional recall_attach_traces runtime grant reattaches source turns to a facts recall: LoCoMo final retrieval 0.74.

// recall at a past instant with the trace grant on
{"tool":"memory",
 "input":{"op":"recall",
         "scope":"user",
         "query":"what medicine was I on in April",
         "as_of":"2026-04-15"}}

Persistent inter-agent message bus. One agent publishes; another subscribes; no orchestrator handoff. Cursor-based delivery.

// publish to a channel
{"tool":"channel",
 "input":{"op":"publish",
         "name":"jobs.scored",
         "payload":{...}}}

Content-addressed, forkable, lineage-tracked. The substrate for self-evolution - and loomcycle import claude-code lifts .claude/agents/*.md + .claude/skills/*/SKILL.md directly into the substrate without rewriting.

// fork a new definition
{"tool":"agentdef",
 "input":{"op":"fork",
         "from":"matcher.v4",
         "prompt":"…"}}

Rate runs against versioned definitions. Selection stays policy - never auto-promote. Humans (or downstream agents) choose.

// score a run
{"tool":"evaluation",
 "input":{"op":"score",
         "run":"r_82a1",
         "rubric":"match.v2"}}

The introspection primitive. Ten ops covering self · tools · agents · history · help · time. The closing loop that makes the substrate learnable - an agent that can read itself can rewrite itself.

// what tools do I have?
{"tool":"context",
 "input":{"op":"tools"}}    // → list with shapes, costs, allowed-hosts

Cron-driven autonomous runs. on_complete hook → channel publish. max_fires self-retire. RFC S adds Channel.await fan-in and Context op=time so the substrate finally has a clock for cycle bucketing and deadline math.

// declare a cron schedule
{"tool":"scheduledef",
 "input":{"op":"create",
         "cron":"0 3 * * *",
         "agent":"nightly-scan",
         "max_fires":30}}

Signed-by-default external trigger. HMAC-SHA256 over the raw body - Stripe, GitHub, Linear, n8n envelopes all auto-detected. Two-layer idempotency (in-memory + durable). Never silently degrades.

// declare a webhook endpoint
{"tool":"webhookdef",
 "input":{"op":"create",
         "path":"github-pr",
         "delivery":"spawn",
         "agent":"pr-reviewer"}}

Per-agent ro/rw filesystem roots. {name, path, mode}. Ephemeral per-run by default: a volume auto-purges when the top-level run completes (clone a repo, work, vanish: nothing persists across runs). Durable mounts are opt-in via the operator's volumes: config. Static volumes from YAML plus a runtime-mutable VolumeDef substrate (tenant-scoped, runtime-derived path, never caller-supplied). Spawn-narrow: a sub-agent's volume set ⊆ its parent's. The Bashbox tool honors ro volumes via an in-RAM write overlay. VolumeDef.create mount_at: registers a volume_mount dirent in the Path tree.

// ephemeral volume for an on-demand workspace
{"tool":"volumedef",
 "input":{"op":"create",
         "name":"lc-src",
         "mode":"rw",
         "ephemeral":true}}

Unix-like VFS over Memory, Volumes, and Documents. Tenant-rooted, scope-aware. Borrows the Linux inode/dirent split: resources keep permanent ids, a dirents row maps (parent_path, name) → resource. One tree spans three resource kinds; renames are cheap dirent updates that never touch the resource. Six ops (resolve / ls / stat / mkdir / mv / rm). Paths reject ..; segments [a-zA-Z0-9._-]+. Resources opt in to a name: Memory.set path:, VolumeDef.create mount_at:, Document.create_document path:. SQL Memory stays out of the tree. A dirent is a name, not an authority grant: the resource's own scope/tenant check still applies. On every transport.

// list a directory
{"tool":"path",
 "input":{"op":"ls",
         "path":"/docs/launches/",
         "scope":"user"}}

Chunked-graph documents. Each chunk is a first-class unit: UUID, hierarchy position, optional supertag-like type, structured fields, graph edges, Markdown body, optimistic revision. Per-piece derived search units (v1.100): a chunk with a heading, prose, a code block and a transclusion now generates one embedding per piece: a query matching the code block does not compete with the heading for the same vector; the index returns the whole chunk with the matching unit highlighted. 186 of 3,000 heading-only chunks on the reference store were invisible before. Documents retrieval final 0.966. Content/structure split (chunk content in Memory keyed by UUID, structure in SQL Memory); query by structured filter plus under_path Path-join plus a raw sql: escape hatch through the SQL Memory validator; atomic deletes; bidirectional edge cleanup; move_chunk cycle guard. A Document lists as a directory in Path and resolves as one resource.

// query the chunk graph under a path
{"tool":"document",
 "input":{"op":"query_chunks",
         "under_path":"/docs/launches/",
         "type":"publication",
         "status":"draft"}}

Encrypted per-tenant secret store. Envelope AES-256-GCM: a deployment KEK (LOOMCYCLE_SECRET_KEY) plus a per-tenant DEK derived via HKDF-SHA256. GCM AAD binds each ciphertext to its row identity (key_id | tenant | scope | scope_id | name), so a row copied to another tenant fails authentication at decrypt. Scope precedence agent > user > tenant. Consumers: $cred:<name> substitution in HTTP MCPServerDef headers resolves per-request; tenant + user provider-key override by env-var name (a CredentialDef named ANTHROPIC_API_KEY at tenant scope shadows the operator host key for every Anthropic call from that tenant). Backends: inline (default) plus stubs for Vault / AWS Secrets Manager / GCP Secret Manager / 1Password Connect. Snapshots exclude sealed rows by design; a restore requires the target deployment to hold equivalent CredentialDefs.

// store a per-tenant API key
{"tool":"credentialdef",
 "input":{"op":"create",
         "name":"ANTHROPIC_API_KEY",
         "scope":"tenant",
         "backend":"inline",
         "value":"sk-ant-..."}}

Per-scope token budgets with soft-warn + hard-cap tiers. A budget is {tenant, scope, scope_id, window, soft, hard}; scope is operator / tenant / user; window is a calendar-month UTC. Most-restrictive-of-the-three-scopes wins. At admission, limits.Check refuses over-hard runs (429 on HTTP, ResourceExhausted on gRPC). In-flight, the ledger emits an EventLimit event on newly-crossed thresholds, riding the same channel as text / tool-use / thinking events on HTTP SSE + gRPC + MCP + adapters + the Web UI's run terminal (amber banner soft, red hard, inline in the transcript). The in-memory tracker boot-seeds from the token_usage ledger, so a restart doesn't reset counters. The Web UI Limits page renders the live month-to-date used column with K/M/G shorthand in the editor.

// set a monthly cap for a user
{"tool":"tokenlimit",
 "input":{"op":"set",
         "scope":"user",
         "scope_id":"alice",
         "soft":"5M",
         "hard":"10M"}}

SkillDefs are not bundled into the system prompt at boot; agents fetch them on demand under a pattern allowlist. A Skill tool with two ops: list enumerates the agent-visible catalog (static bundles + inline defs + the caller's tenant SkillDefs) filtered by the allowlist + an optional /-glob pattern; invoke loads and runs a permitted skill. The agent's skills: field is a pattern allowlist. Empty means allow-all with the Skill tool auto-added; -* means deny.

// list writing-domain skills
{"tool":"skill",
 "input":{"op":"list",
         "pattern":"writing/*"}}

A multi-agent workflow as a state machine. A Team definition carries its own local agents, skills, channels, schedules, and webhooks as one file, plus declared variables a start sets. States interpolate prior answers (${steps.triage.answer}) and capture into named variables; routing nodes gate transitions on conditions or on Decision-tool probabilities. Schedules and webhooks can start a Team directly. TeamDef op=verify returns severity: refused | unrunnable | advisory with JSON paths at fault, before saving. Operator can watch the Team's own local channels (read-only).

// start a Team walk
{"tool":"teamdef",
 "input":{"op":"run",
         "name":"support-triage",
         "variables":{"ticket":"..."}}}

A model that answers with calibrated probabilities over a fixed set of options. It cannot emit something that is not an option. Three question types: choice (2–26 options), noul (yes/no with probability of yes), score (ordered levels with expected position). 1 to 64 questions per call. Available inside a run via Context grant, from outside via HTTP, gRPC, MCP, TS, Python. Powers the memory reranker (LoCoMo recall@5 lifted 0.588 → 0.740), the cascade verifier, and any classification / routing / triage agent that was fighting prose-model parsers. the category hub →

// classify sentiment with calibrated probabilities
{"tool":"decision",
 "input":{"question":"what sentiment?",
         "context":"the food was great but...",
         "type":"choice",
         "options":["neg","neu","pos"]}}

A deployment-shape snapshot, not a transcript archive. Carries users and budgets, schedules, webhooks, memory peers, document sources, volume mounts, the Path tree, and the consolidation queue. HMAC-signed secret references instead of literal secrets (the archive never carries literal credentials). Restore re-validates every definition against the current runtime version; a missing field, a removed op, or an unresolvable credential is flagged at a specific JSON path. Default is refuse; a degraded-mode flag quarantines flagged items. One loomcycle snapshot create + restore moves a working deployment to a new VM.

// create a whole-deployment snapshot
{"tool":"snapshot",
 "input":{"op":"create",
         "include_queue":true}}

Per-principal bearer tokens for multi-tenant auth. A token is {tenant, user, scopes, rate_limits, expires_at}; the server verifies on every request. Scopes bind to specific transports and specific tool classes. Two access modes for a tenant's own users: isolated (scope-locked to own data) and member (full tenant HTTP plane minus operator carve-outs). URL-free sign-in handoff via origin-checked postMessage + same-origin POST /ui/session keeps bearers out of every access log. Tokens survive snapshots as references, not values.

// mint a per-user token
{"tool":"operatortokendef",
 "input":{"op":"mint",
         "user":"alice",
         "mode":"member"}}

Pre and post hooks for tool calls, prompts, and run lifecycle events. A hook can observe, narrow, delay, or deny: never widen. Hook decisions are audited and reach the operator (the Web UI renders each decision as a readable line in the transcript). A failing hook never silently drops the tool's error classification. Hook callbacks pass through the SSRF guard so a tenant hook cannot reach private addresses. Shipped alongside the structured-error (errorCategory, isRetryable, retryAfterSeconds) surface that makes failures a model can respond to.

// register a hook that audits every memory write
{"tool":"hookdef",
 "input":{"op":"register",
         "event":"tool_call_pre",
         "match":{"tool":"memory"}}}

The ~80 MB loomcycle binary ships with the development tools agents need (Python, Go, Rust, Node, git, gh, curl, jq, sqlite3) and a headless Chromium in-process. An agent that needs to compile code, run tests, scrape a page, submit a form, or take a screenshot does not need an external sidecar, a separate toolbox image, or a Playwright install. Volumes default to ephemeral per-run: intermediate files are cleared when the run ends; durable mounts are opt-in via the operator's volumes: config. The deployment stays clean by default.

// fetch and render a page in the bundled browser
{"tool":"browser",
 "input":{"op":"fetch",
         "url":"https://example.com",
         "screenshot":true}}

One docker compose up brings up Grafana + Tempo + Prometheus + Loki + OTEL Collector with a ten-panel loomcycle-overview dashboard auto-provisioned. Run latency p50/p95/p99, provider RTT, tool call rate, MCP latency, error rate by provider - plus process and concurrency from /metrics. seed.sh drives synthetic traffic so the panels populate immediately. Self-hosted, no SaaS bill.

Set four env vars and you're sending OTLP to your Honeycomb dataset at a production-sensible 10% sampler. Ships eight canonical queries (run rate, latency, provider RTT, tool rate, MCP latency, error rate, token spend, slowest traces), three derived-column definitions, and a ten-minute board-authoring walkthrough against your team's dataset.

OTLP to your existing Datadog agent on :4318; agent forwards to the Datadog backend. Same eight canonical queries as Profile B in Datadog APM syntax, plus a DD_SITE knob for non-default regions and a fifteen-minute dashboard-authoring walkthrough against your org's service tags.

An agent names a key; the runtime encrypts, decrypts, signs, verifies, MACs, generates a TOTP or hashes. Only the result comes back. Keys live in loomcycle sealed under LOOMCYCLE_SECRET_KEY, or in Vault Transit, AWS KMS or Google Cloud KMS: in that case the key material never leaves the KMS. JWE and JWS, X25519 and RSA-OAEP/PSS, Argon2id passwords, data by reference so the model never reads it. The same ops are on the operator API (POST /v1/_crypto, gRPC, MCP, TS and Python). writeup →

An agent run that delivers what it says to its caller and stores none of it. The transcript, the tool calls, the model inputs, the sub-agent answers: all pass through the loop and never reach the store. Toggled by the AgentDef flag, authorised through the token restrictions, and fenced from leaking into a parent run. The sibling features in the release: restricted tokens with lifetime, agent list, override lock and run-rate; strict budget enforcement that stops a run in flight; metered llm:gateway; one-call run-tree delete: ship the same posture. writeup →

An agent can be given a repository the runtime fetched itself: an ephemeral read-only volume cloned from a git source. The forge token never enters a shell. The agent reads the repo by line range through the Read tool, bounded by diff size and inflated pack size. Works against GitHub, Gitea and GitLab, with sibling features in the release: forge webhooks that can start runs, signed hook deliveries, and the Microsoft Teams bridge that fronts an interactive agent. writeup →

A run that cannot start at once is queued, not refused: it gets its row, its id and its events before it waits, it is cancellable, and it survives a restart. A provider's max_concurrent now counts model calls in a lane per model kind, so a run holds no provider slot while it runs a tool or waits for a child. A run whose model call waits for a saturated local provider lends its run slot to a run bound elsewhere. Queue-aware routing lets a run skip a busy provider for an idle candidate of its tier. writeup →

The Microsoft Teams bridge that shipped in v1.113 refactored onto @loomcycle/bridge-core, a shared core that handles identity, idempotency, token minting, Markdown defusing and the operator $cred: envelope. Three siblings followed: @loomcycle/bridge-telegram, @loomcycle/bridge-slack (every message inert by construction, no live mentions, every link's real target shown), and @loomcycle/bridge-discord over HTTP interactions. One operator token, one deployment, four chat surfaces. writeup →

A TeamDef now carries its own local agents, skills, channels, schedules and webhooks, plus declared variables a start sets. Template-and-capture between states (${steps.triage.answer}, capture: {as: priority}). TeamDef op=verify returns severity: refused | unrunnable | advisory with JSON paths at fault. Operator view into team-local channels. writeup →

Typed probability outputs for any agent. v1.104 shipped memory.reranker.kind: decision (LoCoMo recall@5 0.588 → 0.740). v1.107 made the primitive general: Decision.ask over HTTP, gRPC, MCP, TS, Python. Three question types (choice, noul, score), 1–64 questions per call. Model aliases now carry kind: chat | decision | embedder. category hub →  ·  writeup →

States as nodes, transitions as edges. Live run visualization (states highlight as a walk progresses; click a running state and the sub-agent's conversation opens streaming live; abort control stops a walk mid-flight). Drag-to-inject channel and variable nodes. Input node starts a walk from a form; End node shows the output chunk. Tri-view (Canvas / JSON / Split) with cursor sync; New / Save / Import / Download; Check button calls TeamDef op=verify. writeup →

Agent op=spawn with mode: "poll" returns immediately; parent collects with Agent op=poll. Children survive pause, restart, replica move. idempotency_key for safe retries. max_wall_seconds for lifetime caps on detached runs. result: "object" for structured child outcomes. Scheduled runs no longer capped at 10 minutes. writeup →

Users, budgets, schedules, webhooks, memory peers, document sources, volume mounts, the Path tree, and the consolidation queue: in one archive. HMAC-signed secret references, never literal secrets. Restore re-validates every definition against the current runtime version. Also folded in: a security review that closed cross-tenant and isolated-member gaps in webhooks, triggers, remote peers, the SSRF guard, and volume paths. writeup →

A fact used to be stored twice: a key/value row semantic recall searched plus a separate entity-graph chunk that graph walks reached. The two halves could silently land in different scopes. Collapsed into one representation: the subject IS its own Document in the Path tree at /entities/<type>/<name>. Placement is one decision. Both halves land together or neither does. graph_recall seeding rebuilt (30 ms vs 928 ms on a 2,942-row scope). architecture →

A runtime-supplied grant that reattaches source turns to a facts recall. Lifted LoCoMo paired-benchmark accuracy to the final 0.74. A cascade routes threshold-clear questions past the expensive gate; a Decision-model verifier reads the retrieved material on ambiguous cases and catches unanswerables at high recall. Two other shapes for delivering the same grant (tool-parameter, imperative-prompt) failed measurably: only the runtime-supplied shape works. writeup →

Each chunk now derives multiple search units: heading path, prose, code block, transclusion each get their own embedding. A query for the code block does not compete with the heading for the same vector. The index returns the whole chunk with the matching unit highlighted. 186 of 3,000 heading-only chunks on the reference store were invisible before. Documents retrieval final 0.966. writeup →

159 per-operation help articles under tools/<Tool>/<op>.md. Every failed tool-call error now carries the operation's schema plus one worked example inlined into the error body. The stateful memo keeps the failing call and the help response together in the next turn's context. On a four-model benchmark against v1.100, both stateful models (cloud deepseek-v4-flash and local ornith-1.5:35b) hit 10 of 10 tasks. writeup →

append (baseline), recap L1 (reasoning kept, log evicted), stateful L2 (Σ carried forward, everything else evicted). Tier-routed context.mode: auto picks by resolved provider. An opt-in Recall tool queries any span the distillation dropped; an opt-in harvest_to_memory bridges those spans into durable memory. Working range: about one-fifth of baseline tokens on a task-shaped run. writeup →

Three subdomains, three jobs. loomcycle.cloud is the landing plus a browser-local token vault (AES-GCM under a passphrase) that hands the bearer to the runtime through an origin-checked postMessage. app.loomcycle.cloud is the runtime itself: Web UI, HTTP plane, operator console. board.loomcycle.cloud is the hosted loomboard SPA, reverse-proxying /v1 to the runtime on the same tailscale netns so the browser sees same-origin (loomcycle emits no CORS by design). Same Docker image self-hosters run. Nothing hosted-only. writeup →

Facts, notes, and documents in one per-scope memory. A background consolidator turns finished chat transcripts into distilled facts with provenance and bi-temporal validity (a fact true last month stays queryable at last month's date, even after the world moves on). Hybrid vector + full-text retrieval with Reciprocal Rank Fusion. Honest source selectors on the search API (Memory op=search sources=[facts]); a backend that drops the selector must say so. 31× faster narrowing to facts on a 3,000-chunk scope (30ms vs 928ms). Every write carries provenance: tenant, session, run, agent, model, compaction generation. writeup →

Users are a tenant's own object. Tenants create them, mint their tokens, set the access mode, revoke on the way out. Two access modes: isolated (scope-locked to own data; discovery tier-reads from token scopes) and member (full tenant HTTP plane; RFC CB opens the shared Library, Documents, and Memory to non-isolated tokens). Tenant is server-derived from the bearer, so POST /v1/_users carries no tenant field. A URL-free sign-in handoff (synchronous window.open in the click gesture, then origin-checked postMessage, then same-origin POST /ui/session for an HttpOnly cookie) keeps bearers out of every URL, browser history, and access log.

Chunk bodies embed on write. Prose verbatim, Mermaid extracts labels across 10 dialects, images use captions plus persisted vision descriptions (model call only for the description, not on every re-embed). Inline [[name]] becomes a graph edge; ![[target]] transcludes at export. backlinks / related / unlinked_mentions answer discovery in one call each. Per-chunk history / get_version / diff. Tags and per-document type / status as first-class query axes. JSON Canvas import/export round-trip (Obsidian-compatible).

The chunk viewer renders GFM tables and Mermaid diagrams inline; per-document color schemes tint chunk tiles by status and Path-tree rows by type; cross-reference edges get a badge, a clickable list, and a collapsible whole-document relationship graph. Images and Mermaid become first-class chunk types: paste a screenshot into the viewer to create an image chunk; the chunk editor shows a live Mermaid preview. Per-chunk buttons for insert-after, reorder, and delete. writeup →

Three interlocking arcs. Sandbox hardening: durable per-principal workspaces so build caches survive container reap; attested run tagging via X-Loom-Root-Run; sandbox_touch + sandbox_close_run; static-MCP re-probe at run start so a sidecar coming up second recovers on the next run. Agent cloning: a Library Clone action derives a new agent whose tool list can widen (only over the operator bearer); POST /v1/sessions/{id}/replay copies a transcript into a new session bound to a different agent. Resident sub-agents: Agent open/send/close keeps a child alive across turns with a warm sandbox container. writeup →

A config-driven, cluster-gated sweeper ages out data across three families: retired def versions (leaf-first so lineage drains without orphans), aged chat sessions (pruned by session not by run, pinned sessions exempt), and fully-retired-agent memory (across three stores under two tenant-keying schemes). Every family defaults off. Export-then-delete: a JSON archive is written to LOOMCYCLE_RETENTION_EXPORT_DIR before the row leaves the database, so a failed export never deletes anything. writeup →

The tenant ontology gains classes and subclasses: a child chunk is a subclass, and retrieval expands subtypes at query time (event finds incident and outage). A subclass inherits its parent's fields; a redeclaration wins. An agent may propose a type via propose_entity, never decide one: proposals land in place with an inert proposed status the reader ignores; only an operator can accept them. A bundled memory/ontologist agent (code-js, no LLM in the merge step) surveys facts and files suggestions with counts and example titles.

Two opt-in answers to the distroless-runtime-can't-run-code problem. Answer 1: the loomcycle-toolbox image is the SAME loomcycle binary on a Debian base preloaded with Python / Go / Rust / C++ / Node (+ git, gh, curl, jq, rsync, wget, unzip, sqlite3) at the same uid + mount paths. Drop-in image swap for single-tenant / trusted deployments. Answer 2: an isolated builder sidecar spawns each session in a dedicated ephemeral container with --network none, --read-only rootfs, tmpfs /work, --cap-drop=ALL, no-new-privileges, non-root, cpu/mem/pids capped, pluggable --runtime (runc → runsc → kata). loomcycle stays distroless and drives the sidecar over HTTP-MCP; loomcycle never runs a container engine itself. Six tools (sandbox_open / exec / write / read / close / list). One long-lived container per session for a compile → test → fix loop. Constant-time bearer auth. Principal-owned sessions. TTL GC + boot orphan-sweep via a loomcycle.managed=1 label. writeup →

An Esc key that does the right thing. Before v1.22.0 the only stop primitive was cancel-the-run, which threw the session away. POST /v1/runs/{run_id}/cancel {reason?} now stops the current turn (the in-flight model generation + the tool calls it started) and parks the run at awaiting_input with the session, transcript, and context intact. The loop synthesizes cancelled by operator tool_results for any in-flight tool_use so history stays valid. Double-guard on ctx.Err() plus the ErrTurnCancelled cause. New turn_cancelled SSE frame. Interruption decline (a Question can be resolved with disposition: "declined"). Cross-replica routing by runs.replica_id. Every transport picked it up: gRPC CancelTurn + ResolveInterrupt, TS cancelTurn() / cancelInterrupt(), Python cancel_turn / resolve_interrupt. RFC BG P1 model_pattern also landed: model_pattern: "claude-haiku-*" auto-tracks a model family against the provider's live catalog. writeup →

Adding an LLM provider used to be a code change. Providers are now a top-level providers: YAML block backed by a driver registry. Each entry declares a compiled-in driver (anthropic / openai / gemini / deepseek / ollama / mock / code-js), a base_url, an api_key_env (env-var name, resolved server-side, tenant-overridable via CredentialDef, never ${VAR}-interpolated), a max_concurrent, an options map, and a capabilities override. Add a self-hosted vLLM / llama.cpp / groq / together / second-Ollama with a few lines; driver: openai covers any OpenAI-compatible endpoint. Existing configs keep working byte-for-byte via an embedded default-providers layer. Per-provider max_concurrent caps in-flight runs (the local-GPU story); sub-agents gate on their resolved provider with a deadlock carve-out. writeup →

Past chats become a first-class primitive. A "chat" is a session (session → runs → events); the History tool adds the human and organizational layer on top: title, description, tags, pinned, archived, summary. Ten ops on one tool: list (pinned-first, paginated, per-chat token/cost/run-count aggregates), get (metadata + full transcript, format:markdown renders it), search (case-insensitive title match), rename / annotate / pin / archive, recap (idempotent LLM summary stored on the session row, live-and-parked-chat-safe), resume (continuation handle), related (semantic similar-chats via the configured embedder, cosine ranking in Go, no pgvector). Owner scopes self / user / tenant / global, resolved server-side from run identity, never the wire; cross-scope reads fold to an opaque not-found; global is admin-only + fails closed. Migration 0057 (session metadata) + 0058 (session_embeddings). Supersedes and removes Context op=history. writeup →

A first-class state-machine primitive for multi-agent workflows. A TeamDef is a graph over your agents: states, transitions (success / pushback:<reason> / conditional:<expr>, bounded by max_iterations), handlers (agent / parallel+consolidator / consolidator / terminal). Content-addressed, tenant-scoped, versioned. Two drivers: a deterministic op=run walk engine (pure Go, right for scheduled + headless) and the bundled LLM team/orchestrator agent (reads the graph as its map, drives transitions, keeps a human in the loop via the Interruption tool). Web UI teams board: two-pane editor with graph JSON + live Mermaid diagram + dry-run render on unsaved edits. v1.19.0 filled the deferrals: parallel fan-out + consolidator execution (3 wait modes), durable Document-backed boards (board_chunk_id, resumable), interrupt-on-cap (cap overflow raises a human decision), gRPC + TS + Python parity, per-tenant Bash creds. writeup →

Tool-execution direction inverted. A client (browser, IDE, mobile app) opens a WebSocket to the runtime and registers its own tools; when the agent calls one, the runtime routes the invoke over the socket to the connected client, which runs the tool locally and returns the result. Four layers: a transport-agnostic registry (invoke↔result correlation, per-principal connection map, per-key connection cap, delegate-and-block Invoke), a bearer-authed GET /v1/client-tools WebSocket endpoint (bearer rides Sec-WebSocket-Protocol because browsers can't set Authorization on a WS handshake), client__-prefixed advertised tools with tools: allowlist globs, and a TypeScript connectClientTools helper that auto-reconnects. LoomBoard's Chrome side-panel extension is the first customer. v1.16.1 fixes the wire-safe name (client: → client__) because Anthropic, OpenAI, and Ollama all reject colons in tool names. writeup →

WebSearch becomes a multi-provider fallback circuit. A new internal/search connector package with a Provider interface and five pure-HTTP drivers: Brave (own index), Serper (Google SERP scraper, cheapest at scale), Exa (own neural index, 20K/mo free), Tavily (RAG-purpose-built), SearXNG (self-hosted, aggregates 70+ engines, no API key). Two new config fields: search_providers: map with per-provider settings, search_priority: global fallback order. Per-AgentDef.search_providers overlay narrows an agent's cascade + participates in content_sha256. The fallback circuit walks the resolver's cascade, resolves each provider's key via ResolveKeyOrOperator (RFC AR + AX honored), and on error / empty / un-keyable falls over silently. Routing view (GET /v1/_routing) gains a search block. v1.15.1 adds an opt-in provenance footer via LOOMCYCLE_WEBSEARCH_PROVENANCE=1. writeup →

A substrate:tenant bearer authenticates in v1.0 but the Web UI showed empty pages or forms that 403'd. Five patch releases close every surface: Library + def-plane reads tenant-scoped, per-surface nav visibility, schedules + Path/Documents + audit log tenant-scoped, sub-agent sessions inherit parent's tenant, Context op=self reports full principal + server URL. Load-bearing shape: admin sees all + optional ?tenant= focus filter; a tenant operator is confined by construction; cross-tenant reads return empty (never 403). writeup →

Image input across all providers (Anthropic native blocks, OpenAI content-array, Gemini inlineData, Ollama images) and every transport. v1.7.1 closes the fallback-target gate: the initial vision check ran once at the resolved provider; a fallback swap to a text-only provider mid-run leaked the image_url and DeepSeek 400'd. Re-checks capability on the swap target now. v1.8.0 wires the effort hint to Ollama's think flag for local reasoning models. v1.8.2 is a two-line fix: the loop's event switch had no case for EventThinking, so every provider's reasoning trace was silently dropped at the loop for months. writeup →

A proper security review closed 17 findings across five categories. Tenant isolation: gRPC read + channel RPCs flow through grpcTenantScope (cross-tenant reads return NotFound, not PermissionDenied); A2A moves onto the operator-token substrate; mem9 blocks SSRF + API-key exfil via model-authored base_url; run cancel + interrupt-resolve tenant-gate on every transport. Secret-exposure at write-time for the tool-call transcript, audit-log Authorization headers, Context op=self pepper, and OpenAI Bearer at INFO on retry. Six driver fixes: Anthropic thinking-block replay on tool-use continuations, OpenAI max_completion_tokens, Ollama in-stream error frames, DeepSeek -chat downgrade, grep TOCTOU close, runstate send-on-closed race. And the MCP thin client transparently re-handshakes on 404 / -32001 on HTTP + stdio. writeup →

Encrypted per-tenant secret store. Envelope AES-256-GCM under a per-tenant DEK derived via HKDF-SHA256 from a deployment KEK. GCM AAD binds ciphertext to (key_id, tenant, scope, scope_id, name). Consumers: $cred: substitution in HTTP MCP headers (per-request, scope precedence agent > user > tenant) and tenant + user provider-key override by env-var name (a CredentialDef named ANTHROPIC_API_KEY at tenant scope shadows the operator host key). Backends: inline default + Vault / AWS SM / GCP SM / 1Password stubs. writeup →

A per-call token_usage ledger records one row per LLM call with a credential_source label (operator / tenant / user), four token buckets, priced cost. Per-call granularity is exact across a mid-run provider fallback. GET /v1/_usage returns aggregated reports grouped by any combination of tenant / user / provider / model / source; the operator-vs-tenant split falls out of the group-by. A Web UI Usage page renders it with group-by chips, from/to window, admin tenant focus, and a summary strip (operator bill vs tenant-funded). Retention: rollup-and-prune sweeper into usage_archive + old-run archiver. gRPC + TS + Python adapter parity. writeup →

A budget is {tenant, scope, scope_id, window, soft, hard}. Scope is operator / tenant / user; window is calendar-month UTC. Most-restrictive wins. At admission, limits.Check refuses over-hard runs (429 on HTTP, ResourceExhausted on gRPC). In flight, recordCallUsage emits an EventLimit event on newly-crossed thresholds. It is a new event type carrying LimitInfo, riding the same channel as text / tool-use / thinking events on HTTP SSE + gRPC + MCP + TS + Python adapters + the Web UI's run terminal (amber banner soft, red hard, inline). K/M/G shorthand in the Limits editor. writeup →

The Web UI's components are now consumable by external hosts. @loomcycle/[email protected] is the reusable Agents/Skills/MCP Library React component with lineage + Claude Code import; the Web UI's own LibraryView is a thin wrapper (569 → 64 lines). @loomcycle/[email protected] is the reusable Path VFS + chunked-graph Document browser. Both peer @loomcycle/client; the Web UI dogfoods them; LoomBoard (loomcycle's chat app) embeds the Library in its left rail. External React hosts can now embed the same Library + Explorer surfaces without reimplementing.

SkillDefs are no longer bundled into the system prompt at boot. A new Skill tool with two ops: list enumerates the agent-visible catalog (bundles + inline defs + tenant SkillDefs) filtered by the allowlist + optional /-glob pattern; invoke loads and runs a permitted skill. The agent's skills: field becomes a pattern allowlist (globs like doc/*). Empty = allow-all with the Skill tool auto-added; -* = deny (no Skill tool wired). Breaking: skill_def_scopes removed; authoring is now gated by skills: itself. Bundled document-agent skills group under doc/* as of v1.14.1.

Unix-like VFS over Memory + Volumes + Documents, using Linux inode/dirent semantics: resources keep permanent ids, a dirents row maps (parent_path, name) → resource. Six ops on the new Path tool. Documents are chunked-graph: each chunk is a first-class unit with UUID + hierarchy + type + fields + edges + Markdown body + optimistic revision. Content in Memory, structure in SQL Memory (four tables). 13 ops on the Document tool. A Document at /docs/foo lists as a directory AND resolves as one resource (macOS bundle semantics). writeup →

Per-agent ro/rw filesystem roots as a substrate primitive. Static from yaml plus runtime-mutable VolumeDef (tenant-scoped, runtime-derived path; never caller-supplied). Sub-agent volume set ⊆ parent's; ephemeral=true auto-purges when the top-level run completes. v1.3.0 adds Bashbox (RFC AJ), an in-process shell tool backed by pure-Go gbash. No os/exec, no /bin/sh. Honors ro volumes via an in-RAM write overlay. Same input schema as Bash; opt-in via LOOMCYCLE_BASHBOX_ENABLED=1. Bashbox writeup →

Postgres LISTEN/NOTIFY backplane (no Redis dep in v1.0). Cross-replica cancel + cluster-wide pause/resume + bus fanout + advisory-locked singleton sweepers. SQLite refuses cluster mode at boot (clear error, not silent fail). The runtime grows from one replica on a cheap VPS to many machines without changing shape. writeup →

Two months of continuous production operation at JobEmber.ai under real user load with multi-replica HA on Postgres LISTEN/NOTIFY. Every replica can run the scheduler (DB-claimed slots so two replicas never fire the same job twice). Children of a parent agent survive pause, restart, and replica move. The substrate does not drift under sustained load; the deployment stays live across releases.

Seventh substrate primitive. Per-principal lct_… bearer tokens bound to an authoritative {tenant_id, subject, scopes} resolved from the token, never from the wire. Per-route + per-RPC scope enforcement (deny-by-default-to-admin on gRPC), tenant-scoped read boundary, role-aware Web UI with super-admin tenant-focus switcher. Adversarial-QA pass found and closed one CRITICAL gRPC bypass plus three HIGH cross-tenant isolation breaks before tag. writeup →

Distributed traces across loop + providers + tools + MCP. Three drop-in profiles ship in the repo: self-hosted Grafana / Tempo / Prometheus / Loki, Honeycomb, Datadog APM. Plus a bearer-authed /metrics Prometheus endpoint live-read from runtime counters. Pick your backend; no vendor SDK in the loop.

Runtime-wide quiesce + cross-version-portable JSON snapshot. Both phases shipped: cooperative pause parks in-flight sub-runs at iteration boundaries; cross-instance resume re-dispatches paused runs on a fresh box. A paused run can be wiped and restored on a fresh loomcycle instance and finish autonomously. This substrate work later expanded (v1.101) into whole-deployment snapshots that carry users, budgets, schedules, webhooks, peers, document sources, volumes, the Path tree and the consolidation queue: see the snapshots writeup.

loomcycle publishes an AgentCard at /.well-known/agent-card.json; three protocol bindings (REST, JSON-RPC, gRPC); signed cards over RFC 8785 JCS canonicalization; multi-tenant routing in three modes; INPUT_REQUIRED↔Interruption bridge. Reachable from Microsoft Agent Framework, Google ADK, LangGraph. Outbound: synthetic a2a__<peer>__<skill> tools. Built against a2a-go v2.3.1. writeup →

External systems sign + POST events; loomcycle either spawns a run (delivery: spawn) or publishes to a channel to wake an agent already waiting (delivery: channel). HMAC-SHA256 over the raw body, three envelopes auto-detected (Stripe, GitHub, bare-hex Linear). Verify-before-parse trust boundary, two-layer idempotency (in-memory + durable runs.idempotency_key), never silently degrade. writeup →

Cron in yaml - per-user-tier templates that fork at signup, or operator-owned standalone schedules; sweeper fires real RunInputs; on_complete hooks deliver via channel / memory / MCP. Compound stress test pushed it to 100,000 fires, surfaced a double-fire race at 30,000, closed with a sync.Map in-flight tracker. writeup →

One agentic run, multiple per-user-authorized MCP servers, zero secrets visible to the agent. user_credentials map on the wire across all transports; ${run.credentials.<name>} substitution at the HTTP boundary inside Client.do(); values never reach transcripts, snapshots, or OTEL spans. writeup →

Three primitives that make ensemble-shaped pipelines first-class. Channel.await {channels, mode: any/all/at_least, n, wait_ms} is the missing fan-in combinator. Its symmetric twin Channel.broadcast publishes one payload to N channels in one call. Context op=time gives every agent a wall-clock. Schedule max_fires retires a def after N successful fires. These substrate primitives are the floor the TeamDef one-file state machine and the loomboard canvas compose on top of today.

Operator JavaScript via goja as a first-class agent - no host filesystem needed, no LLM call. Same loop, OTEL, scheduler / webhook / A2A reachability, sub-agent composition. Stateless replay execution: each Provider.Call builds a fresh runtime, fast-forwards through the transcript, stops at the first un-recorded tool call. Resumable across restart and replica for free. Bundled examples ship at internal/examples/code-agents/. writeup →

MemoryBackendDef binds AgentDefs to backends; the in-process sqlite-vec + Postgres backend is canonical, external backends plug in. MemoryLayer sits alongside the flat Backend for LLM-extract products (mem0, Mem9). Capability probe routes ops; unsupported call fails closed with typed ErrCapabilityUnsupported. Native ranker + search-time dedup. writeup →

A run-loop plugin chain that runs every iteration between the agent and the outbound LLM. First built-in is redact - scrubs secrets before the model sees them. The model never receives the literal token in the first place. Plugins live in the loop, not the agent - operator opts in, agents don't have to know. Context compressor plugin is next. writeup →

Steer agents mid-run, Claude-Code-style from the browser. Mid-run steering via POST /v1/runs/{run_id}/input + a per-run buffered registry, drained at iteration boundaries (never between tool_use and tool_results). Parked end_turn instead of terminating. Inline interruption answers. View-switch survival via context.WithoutCancel + persistent event tailing. writeup →

Long-running agentic sessions stay in context budget. Three coordinated triggers around one shared summarizer. Manual: a Compact button. Auto: per-iteration threshold (autocompact_at_pct). Self: an agent can call Context op=compact itself. Pinned task + summary + last-N form, with CompactionSplit snapping the cut to a clean user-turn boundary so a tool_use/tool_results pair is never split. A context-compressor plugin is the next built-in in the contextplugin chain - same logic, operator-customizable surface. writeup →

spawn_runs(mode: "join", spawns: […]) dispatches N agent runs concurrently from one MCP call and returns an index-aligned envelope when they settle. This substrate call is what the TeamDef one-file state machine compose on top of; a poll-mode sub-agent spawn extends the shape so a parent can keep working and pick up the answer later.

Lift .claude/agents/*.md + .claude/skills/*/SKILL.md into the loomcycle substrate without rewriting. AgentDef + SkillDef synthesized from YAML frontmatter + markdown bodies; tools mapped to allowed_tools; skills bundled into the system prompt at config-load. One command - and your existing Claude Code agents run on loomcycle. Pairs with the claude-code-plugin-loomcycle companion repo for the round-trip. writeup →

pip install loomcycle (Python adapter) + @loomcycle/client (TS adapter, v1.13.0). Same surface across HTTP / gRPC / MCP wire shapes. Since v1.13.1, two reusable React components ship as separate packages: @loomcycle/library (Agents / Skills / MCP CRUD + lineage + Claude Code import; RFC AY) and @loomcycle/explorer (Path VFS + chunked-graph Documents; RFC AZ). Both peer @loomcycle/client; the Web UI dogfoods them; LoomBoard embeds the Library in its left rail. External React hosts can now embed the same surfaces without reimplementing.

Dev workflow can run against your Claude MAX subscription instead of pay-per-token API. Three subcommands: loomcycle anthropic login / status / logout. Reverse-engineered integration with explicit no-warranty terms - full disclaimer on GitHub →

@loomcycle/n8n-nodes-loomcycle on npm - source at github.com/denn-gubsky/n8n-nodes-loomcycle. Two editions. The Slim edition (this one, 20 nodes, zero deps, langchain-free) passes n8n's community-node scanner and runs on n8n Cloud. The Full edition (@loomcycle/n8n-nodes-loomcycle-full, 24 nodes) adds langchain-based AI-Agent Tool sub-nodes, SSE-push triggers, and a Run "wait for completion" op for self-hosted n8n. 16 dedicated action nodes covering Run / Memory / Channel / AgentDef / SkillDef / MCPServer / Schedule / Hook / Webhook / A2A Agent / A2A Server Card / Interruption / LLM / Memory Backend / Operator Token / Snapshot. 3 triggers (Run Completed / Channel Message / Interrupt Pending). 1 AI-Agent Chat Model sub-node routing through loomcycle's gateway. Drop loomcycle in front of an n8n workflow without writing custom HTTP nodes. writeup →