A model that acts.
Only inside its frontier.

Shipped · runs today

• ShippedTransient model failure recoverySince 0.4.0: at most three identical model attempts before any stream output, with per-attempt metrics and no effect retries. Persistent provider overload reports Unavailable.
• ShippedSystem time queriesSince 0.4.0: task install builds the current checkout; system-query@1 reads the host clock, verifies its observation and completes without a workspace or confinement.
• ShippedCustom protocol sourcesSince 0.4.0: shared catalogs, local snapshots and pinned Git installation. Offline verified loading. Unreleased: b10x-loom run --action-bindings binds an installed protocol's actions to operator-declared commands (argv, no shell, arguments as JSON on stdin, report as JSON on stdout); otherwise executable bindings remain host supplied.
• ShippedBounded working contextSince 0.4.0: opt-in CLI policy with typed working state, retrievable history, bounded requests and payload-free measurements. Legacy remains default pending matched live quality and cost evaluation.
• ShippedStored result referencesSince 0.3.0: bounded result previews and exact reference-based edit composition, resolved before admission. Run-local storage; live quality and token-cost savings remain unmeasured.
• Shippedb10x-loom runRoutes an intent to a protocol, opens a governed case and runs it until it is blocked, printing each step and the stop reason. Exit 0 for a verified completed query or at the human merge gate; 3 for another stopped run. Completed a live run against a hosted model on 2026-10-05.
• Shippedb10x-loom plugin run slack-handlerUnreleased: the slack-handler plugin (b10x-loom-plugin-slack) walks the Slack channels the bot is a member of through the Connectors command line, read only, and hands the plugin host the messages nobody answered, mentions first: aged min_age_minutes, no thread reply but the poster's, no bot message, no system message, no reaction by the bot. A question gets a proposed reply read from the configured data sources, a task a proposed case; nothing is sent. --once runs one cycle; plugin report prints one line per proposal. Tested on recorded responses and a fake connectors only; no live run yet.
• Shippedb10x-loom agent serveUnreleased: b10x-loom agent serve --spec FILE --state DIR [--once] hosts the agent a loom.agent/1 spec declares: it polls only channel.allow, answers each item in a governed turn on the inner loop's protocol under the state whose when names the intent, with exactly policy.capabilities as its authority, and sends the recorded proposal to the item's channel through the Connectors command line at most writes.max_per_hour an hour. In writes.mode approval a send is held until b10x-loom approve <COMMISSION> reply.send grants it; the host performs it at its next poll, or agent resume now. writes.mode none sends nothing; auto is served by agent run only. SIGTERM ends the host after the item. Unreleased: with LOOM_HTTP_CA_FILE naming a PEM file, an http binding read trusts its certificates (a cluster CA) beside the webpki roots; a file that cannot be read, is over 1048576 bytes, holds no certificate or holds any block a TLS client does not take as a root (all or nothing) stops the host before anything runs.
• Shippedb10x-loom agent runUnreleased: b10x-loom agent run --spec FILE --state DIR --input FILE runs one turn of a loom.agent/1 spec on the input's text and exits, as a scheduled job does: governed and recorded in the state directory as agent serve records an item, needing neither channel nor expose.a2a. A spec whose channel binding declares a write sends to the first channel of channel.allow under writes (auto included), at most writes.max_per_hour an hour; any other ends on its proposal. Exit 0 answered, 4 no answer, 3 spec or send refused (RateLimited recorded first), 1 input absent, unreadable or blank, before any model call.
• Shippedb10x-loom agent checkUnreleased: b10x-loom agent check --spec FILE says whether a loom.agent/1 spec can be served before anything runs, against the plugin catalog (inbound-answer@1, operator-reply@1). It refuses the first of: a malformed document, a credential literal (never repeated), an unknown protocol, a state naming an action the protocol lacks, a source no binding declares, an HTTP binding whose method is not GET, reply.send without a writes mode, an empty channel allow list. Exit 0 checked, 3 refused, 1 unreadable.
• ShippedCredential boundary relaysUnreleased: b10x-loom agent boundary (crate b10x-loom-boundary) serves a credential-free agent pod's relays on 127.0.0.1 only: the model on 8401, the Connectors wire on 8402 for declared operations, git smart-HTTP on 8403 for declared repositories. Each relayed request carries the pod's projected service-account token, read from its file again, and never the agent's credential headers; an undeclared request is refused before it reaches the upstream. Plain http:// upstreams only.
• Shippedb10x-loom-sdkOne crate that re-exports Commission's contracts and runtime, the executor, the session executor, the governor and intake. Its example runs a whole embedding on scripted fake models.
• ShippedSDK stabilityUnreleased: one page names the stable surface of b10x-loom-sdk, every port a host implements with its loom_sdk path and every loom_sdk path control-plane imports, stable within a release line with each break named in CHANGELOG.md; a compile witness implements every listed port through loom_sdk alone.
• ShippedAgent specUnreleased: an agent as data, a loom.agent/1 document (YAML or JSON) declared in ESS as loom.agent; loom_sdk::agent::parse decodes it into AgentSpec and refuses a member the domain does not declare. It checks the shape only. SessionExecutor::from_spec runs a spec's session under its tool policy: Claude Code is offered only the allowed tools less the denied ones, and the decision mode goes to metaharness.
• ShippedLoomAgent CRDUnreleased: the LoomAgent custom resource (loom.beyond10x.dev/v1alpha1) carries a loom.agent/1 document as spec.agent. Its CRD, deploy/crd/loomagents.loom.beyond10x.dev.yaml, is projected from the loom.resource and loom.agent domains and checked by task crd-drift; the operator example validates against it. b10x-loom-resource keeps the resource's lifecycle (Pending, Running, Refused, Degraded) by the generated behaviour, and the status carries what the controller last read of the Deployment and the conditions Checked and Available.
• ShippedLoomAgent controller and chartUnreleased: b10x-loom-operator reconciles each LoomAgent of one namespace into one agent pod with its ServiceAccount, ConfigMap, NetworkPolicy and, with expose.a2a, a Service. It checks the spec in-process before any child exists, so a credential literal or a disallowed Secret, namespace or egress host leaves the resource Refused with nothing created. render prints the children without a cluster. The Helm chart charts/loom-agents installs the CRD and the controller with a namespaced Role, versioned with Loom. Tested against a fake API server and helm template; not yet run on a cluster. Since 0.42.0: a resource with spec.command is the Command variant, whose pod runs the image's own program (a takt delivery) with spec.agent at /config/agent.yaml, an optional workspace volume and, on either variant, a second Secret as files the pod user owns (spec.secretFiles); status.variant names the variant. Unreleased: a Command resource runs once as a Job, and status.run reports the program's exit code and end time, read from the Job's own pod, beside the condition Completed. Either variant takes plain environment values in spec.env, walked for a credential like spec.command, as written and after the kubelet's $(VAR) expansion. A Command resource may leave spec.agent out and give its program's own configuration as spec.configFiles, each file written verbatim at /config/<name> and walked for a credential, never decoded for use. Unreleased: a resource may be credential-free (spec.boundary, on either variant): a native sidecar, boundary, run from the default image as user 10002, alone mounts a projected service-account token per declared upstream (model, connectors, git), and the agent container gets only loopback URLs (LOOM_BOUNDARY_MODEL_URL, LOOM_BOUNDARY_CONNECTORS_URL, LOOM_BOUNDARY_GIT_URL). Each upstream must be a plain http:// cluster service that an allowedBoundaryUpstreams entry (empty by default) lists for its kind with exactly its URL and audience; a boundary beside a Secret or any egress entry is refused, and its NetworkPolicy opens only DNS and each upstream namespace on one port (the entry's pod port, else the URL's). Tested through render only; not yet run on a cluster. Unreleased: every release publishes the images ghcr.io/beyond10x/loom-agent and ghcr.io/beyond10x/loom-operator (linux/amd64, user 10001) and the chart oci://ghcr.io/beyond10x/charts/loom-agents at its version, and the chart defaults to those images at its appVersion. Unreleased: a Command resource with spec.schedule (cron, timeZone, suspend, startingDeadlineSeconds) runs as a CronJob in the Job's place, one run at a time (concurrencyPolicy Forbid); it stays Running, and status.lastRun and the condition LastRunSucceeded report the newest finished run's phase, exit code and end time. spec.schedule.input, an inline text or a ConfigMap key, makes each run b10x-loom agent run over spec.agent with that task text. Tested against a fake API server and render only; not yet run on a cluster.
• ShippedSource releases at version tags0.55.2 is the current release (0.1.0 was the first): a bare-version tag the release workflow verifies against the workspace version and CHANGELOG.md, with a GitHub Release. Consumers pin tag = "0.55.2".
• ShippedCommission's runtime looprun_until_blocked drives a commission over its ports until the run stops: approval gate (a step performed under an authority grant passes it), nothing performable (Unreleased: NoPerformableAction names the actions the frontier listed that no effect performs, in frontier order, and the frontier's open claims, which the frontier relates to no one action), authority needed, an effect refusal the port marks final, the idle bound, step budget, or 64 steps without a budget (Unreleased: Waiting, naming the request, when a budget stops the run while an effect's answer is pending).
• ShippedRevalidation before every effectEach proposal becomes an action request bound to the frontier's revision and is rechecked against the current frontier, case revision and authority provider; the provider sees the request, and the case revision is read again after an allow and before a resumed request is invoked.
• ShippedCommission makes the effect callAdmitted requests go to the embedder's EffectPort once; the case moves only after a Performed effect (Atlas ADR 0082). Unreleased: a port that answers Pending gets the same request again at the next iteration, revalidated first, each invocation a step and a trial on the run budget.
• ShippedConcurrent reads in one stepUnreleased: an executor proposes up to 16 reads at once (ExecutorOutcome::ProposedReads). The runtime admits them only when the effect port reads every one and the frontier lists each admissible with no authority, else invokes nothing; each read is revalidated, the admitted ones run concurrently, each once through its binding, and are recorded in the order proposed. A fan-out is one step. Writes, and actions that need authority, stay one per iteration; no model executor proposes a fan-out yet.
• ShippedSuspend on an approval, resume after a restartUnreleased: given a suspension port the host implements, run_with_suspension suspends a Run whose request needs authority the provider withholds and stores the commission's Suspension; resume_after_grant takes it, performs the request once, in a new process if need be, after the grant, and releases it, and refuses when the case revision moved. The take and the release name the request the resume revalidated: of two resumes racing over one Suspension one performs the request and the other is refused, and a resume that read a Suspension since resumed and replaced for another request is refused, naming both, and performs nothing. A resume that stopped after the take leaves the request in doubt: every later resume is refused and performs nothing, and settling it is the host's. A commission holding a Suspension starts no new Run with a port. run_until_blocked, with no port, is unchanged. loom_governor::FileSuspensionStore keeps the Suspension in a directory, beside the case store and under its lock. b10x-loom run --state <DIR> keeps the case, the Suspension and the commission's resume context in that directory and runs the commission through run_with_suspension, so a run stopped for an approval leaves a Pending Suspension. b10x-loom approve writes a grant for the request that Suspension holds and performs nothing; b10x-loom resume performs it once through resume_after_grant, a granted repository.merge as a merge hand-off record that moves no Git ref, once per HEAD of a commission and only at the HEAD the case holds, and runs on; a merge the agent proposes again at a HEAD the commission already handed off holds no Suspension, since the host answers its hold settled; a commit made after the Suspension is refused CaseMoved, a run that stops at its gate holding nothing says so and exits 4, and each refusal of a resume has its own exit status.
• ShippedHost-chosen run stopsUnreleased: a host's LoopContext::stop_policy turns the approval gate off (an ungranted approval-required action is still never performed) and sets the idle bound; RunBudget adds max_tokens and an RFC 3339 deadline, checked before and after each executor call and again on a resume; on_breach KeepStep performs the step that passed a spending limit or the deadline, and StopPolicy.breach_by_limit keeps or discards it per limit; an effect's Pending answer with ends_run ends the run Waiting for Time; LoopContext::host_stop, asked right after the deadline where a step would follow the authority checks and on a resume, suspends the Run for HostStop with the host's own name and detail, so a frontier only a grant moves still ends NeedsAuthority and a granted effect is never invoked past it.
• ShippedConnector effect portUnreleased: b10x-loom-connectors fills Commission's ConnectorInvoker over a Connectors v0.35.0 service. It invokes the bound operation once on the host's endpoint for its instance and answers Performed with the attempt Connectors recorded for a write or the audit record it completed for a read, Refused only when Connectors reports the attempt refused or not attempted, and an error otherwise. Whether a released Connectors provider offers file-edit and test-run operations is not known yet.
• ShippedGoverned write through the Connectors command lineUnreleased: ConnectorsCli::invoke_write performs one write the runtime admitted through the operator's connectors command line, passing the path of the person's approval proof and an idempotency key derived from the admitted request id; a write Connectors classifies unknown is returned as unknown and never retried. The host evidence adapter records an applied write as the protocol's evidence for its step (routing_record for ticket.route in support-triage@1). Tested on a fake connectors only; no live run yet.
• ShippedMandate authority providerUnreleased, opt-in: b10x-loom-mandate answers Commission's authority port with Mandate v0.9.0's check, over Mandate ports the host builds it with. The subject is the Mandate verified context the host puts in the commission's authority context, the capability is the action and the case the resource. An allow is a grant, an approval requirement suspends the run as the approval gate does, a refusal is a denial, and a Mandate outage or an authority context that is no Mandate context grants nothing. b10x-loom approve and resume use it behind --mandate; run does not.
• ShippedMandate approval on resumeUnreleased, opt-in: b10x-loom approve --mandate <FILE> records a Mandate approval of the held request in the state directory's approval log, and resume --mandate <FILE> performs the request only when Mandate v0.9.0's check_with_approval clears and consumes it, keeping the consumption before anything is performed. A second resume with the same approval, an expired approval and a grant naming none are refused and perform nothing, and resume without --mandate refuses a grant naming an approval. FILE is host-trusted; Loom configures Mandate from it over Mandate's in-memory ports until Mandate ships a policy adapter. Tested on local fixtures only; no live run.
• ShippedPlugin hostUnreleased: b10x-loom-plugin hosts a plugin in a loop: poll, classify, project, a governed read-only turn on inbound-answer@1 over Connectors data sources, and one record line per handled item. A reply is a proposal in the record and is never sent. b10x-loom plugin run hosts the one registered plugin, slack-handler.
• ShippedCommission's contracts stay independentb10x-loom-commission depends on no Loom executor, no Canon and no model-provider crate; task commission:deps-guard fails the gate if it does.
• ShippedLoom implements Commission's AgentExecutorA step projects the frontier, selects over that catalogue, asks Commission's admission check, generates arguments and ends at a ProposedAction. Loom invokes nothing and never suspends for authority.
• ShippedLoom revalidates its selection before proposingWith Loom::with_governor, a step reads the case's current frontier from the governor once after the selection and proposes nothing for a selection made at another case revision or of an action that frontier's catalogue does not list. A selection made at a revision the case has left is reported to Commission as CaseMoved, and run_until_blocked judges the run on the case's current frontier. Opt-in: b10x-loom run does not enable it yet.
• ShippedWorkflow definitionsUnreleased: WorkflowExecutor runs a loom.workflow definition over a catalog protocol. Deterministic steps propose their action and literal arguments with no model call; a judgement step asks the model only among its own actions. A step the frontier does not list ends NeedsHumanJudgment, a step advances only once performed, and Commission revalidates every proposal. A step declares typed outputs from its performed report, and a later step's arguments name them: the runtime fills them in with no model call, and an absent or mistyped output proposes nothing and ends NeedsHumanJudgment. A judgement step lists the earlier outputs it is given: their values reach its instructions as a typed data block, never as instructions, and a listed output the run did not produce asks the model nothing. Given a run store (the governor's FileWorkflowRunStore, or the host's own), the run's record is written after every performed step, and resume(run_id) continues the run in another process, after an approval or a crash, with every output bound and its usage report covering every segment.
• ShippedPer-run model usage reportRunMeter, MeteredModel and MeteredExecutor count every turn of an llm Model of a Commission run, failed turns included, and report the calls, the provider's tokens and the cost at a declared rate card per executor call and in total (loom.metering.RunUsageReport). A cost no card priced is absent, never zero. Unreleased: an executor that is not a model loop reports what each call spent (AgentExecutor::run_with_usage, ExecutorStep); the runtime charges it to the run's charges and budget, a breach suspending the Run with RunBudget, and MeteredExecutor shows it as that step's usage, counted once. Unreleased: the meter wraps an llm Model, its rate card is loom_sdk::RateCard, and the reasoning-model selector is the executor's ModelSelector over an llm Model.
• ShippedSelections outside the catalogue are refusedThe catalogue lists only actions Commission admission does not refuse. An action id it does not list is refused whatever its confidence, and no arguments are generated.
• ShippedModel-backed selector and argument generatorThe slice's ModelSelector and ModelArguments use forced tool calls through llm, told the intent, its references and a bounded transcript. Since 0.3.0, argument generation can retrieve stored results before returning an action.
• ShippedArguments for the selected action onlyA generator is handed the selected catalogue entry only, and the request for arguments is recorded against its selection.
• ShippedA confidence fallback is recorded as two linked selectionsUnreleased: when the hybrid selector falls back, Loom records the fast selection as Overruled, naming the stronger selector's selection that replaced it, and that selection; each carries its own selector's strategy, and only the replacement reaches argument generation and revalidation.
• ShippedSelection telemetry for trialsUnreleased: every selection gets one SelectionRecord (strategy, candidate count, chosen action, confidence, latency, tokens the selector reported, and on an overruled fast selection the strategy it fell back to), read with Loom::selection_records; a selection refused at the execution boundary adds no record. It is never evidence.
• ShippedCanon governorCanonGovernor evaluates a case's engineering protocol with Canon on every frontier and completion; no clock, network or model call, and no invented authority. A host reads the canon-decision/1 document behind a frontier it was issued by that frontier's id (decision_document).
• ShippedCompletion on the first declared outcomeUnreleased, opt-in: CanonGovernor::with_completion_rule(CompletionRule::FirstDeclared) completes a case on the first legitimate outcome in the protocol's declaration order, never a blocked one; ExactlyOne stays the default and evaluate keeps it.
• ShippedHosted governor contractsSince 0.2.0: host-admitted Canon protocols, trusted freshness callback and fallible case storage. No database backend or automatic protocol adoption.
• ShippedCase inputs from the hostUnreleased: a software-change@1 case opens with risk, change_kind and affects_security_boundary, given by the host (b10x-loom run --risk, --change-kind, --affects-security-boundary) and never by a model; an undeclared input, an unlisted value or a missing one is refused before anything is stored, and an obligation the inputs do not select is not open.
• ShippedEvidence that order and age rules decideUnreleased: the slice submits an implementation_change for every committed edit and, on a bugfix, a regression_test_result beside each test result after its first tests.write that committed; every record carries the host clock's observed_at and the trusted producer, so a bugfix that runs its regression test red before its edit discharges red_first.required, and b10x-loom's governor evaluates at the host instant, so an observation past its max_age no longer applies.
• ShippedA regression result runs the written testUnreleased: a bugfix's regression_test_result comes only from b10x-loom run --regression-test-command <CMD>, run once per test path the run's tests.write committed with {path} filled, never from the suite; without it no run is a regression result. The governor takes a record's observed_at only as the instant of the observation it cites and received, and refuses the record otherwise.
• ShippedStateless evaluationloom_governor::evaluate and b10x-loom evaluate decide a catalog protocol over a caller's canon-case/1 snapshot and canon-evidence/1 records, with an optional trusted time, and return Canon's decision as JSON; no Commission type, no case store, no clock. An unusable input is refused naming it.
• ShippedIntent referencesTracker keys, chat permalinks, merge and pull requests and URLs, extracted in order without a model.
• ShippedProtocol routerA model picks from the shared catalog of engineering, Loom and explicitly installed custom definitions; a pick outside it or below the threshold is refused.
• ShippedLocal slice for software-change@1Edits, inspects and tests a git work tree; evidence only from the test command's exit status; never merges, pushes or deploys. Tests use Substrate by default since 0.2.0.
• ShippedCatalog route modelsb10x-loom run --catalog <PATH> reads an llm catalog; --model and --classifier-model then name its route aliases, built through llm's catalog-to-Model port, so a self-hosted endpoint can drive a run. An unknown alias or an unreadable catalog stops before any model call.
• ShippedRun event streamb10x-loom run --output jsonl writes one JSON record per line, each with schema_version 1: the route, model turns, tool calls, reported usage, approvals, and one terminal record last whose exit_status is the process exit status. Human output stays the default. Unreleased: a Session record per agent session a host runs through the session executor (EventStream::sessions), naming the session record's trace-ir/1 digest and holding metaharness's trace-ir-summary/1 of it; b10x-loom run itself runs no session executor.
• ShippedRun model generated from ESSActionCatalogue, Selection, SelectionRecord and ArgumentRequest are synthesized from ess/ and re-exported; Commission's model likewise from ess/commission/.
• ShippedESS hard gatetask check fails unless loom and commission validate strictly, compile, synthesize with no refusals and carry no open question; intake's system validates.
• ShippedCommission's ESS conformance suiteb10x-loom-commission passes the suite synthesized from ess/commission/.
• ShippedLoom's ESS conformance suiteb10x-loom-executor passes the suite synthesized from ess/, run by task conform; the target answers RevalidateSelection's external not-in-frontier branch, and an executor test holds the membership rule. Unreleased: b10x-loom-session-executor answers loom.session.ProposeSessionChange over a scripted Claude Code session.