A governed agent lifecycle, plus a sandboxed runner to execute it.
Agents declare their model lane, their tools, and their blast radius up front. A lifecycle state machine refuses to advance a run that failed verify. And when it's time to actually spawn an agent, the runner builds its child environment from scratch, never a spread of your process env, so a credential you never intended to hand over cannot leak into the sandbox.
name: db-migrator capability: code_write model: sonnet # a lane, not a default # to the top tier tools: [read, edit, run-tests] side_effects: false # cannot push, deploy, # or read a secret gate: human-approval # data-migration tag → # operator re-entry
A governed kernel, not a wrapper.
@caisson/agent-kernel is one of the pieces the Agentic-Dev bundle composes together as peers, alongside local memory and the tool-exec gate, all built on the same open @caisson/kernel base every bundle shares. It carries a typed agent/skill/rule schema with a reference-integrity validator (a ghost cross-ref throws before anything runs), the 7-act lifecycle FSM (SPEC → PLAN → EXECUTE → VERIFY → SWEEP → EVAL → SHIP, with a failed VERIFY reopening PLAN and SHIP as the only terminal state), governance guards, and the hooks dispatcher that fires lifecycle events without handing a hook a credential the kernel didn't give it.
Five composed packages, not one kernel.
Each member is a real workspace dependency, and each one carries its own standalone price: the kernel, the runner, the trajectory log, local memory, and the tool-exec gate.
Typed agent/skill/rule schema plus the guarded 7-act lifecycle FSM and hooks dispatcher, one of the bundle's composed pieces, alongside local memory and the tool-exec gate.
Spawns a headless coding agent as a detached subprocess in an isolated worktree with a from-scratch scrubbed env, streaming an auditable transcript.
The governed run record: an append-only, replayable event log of every step, tool proposal, approval, and spend, sensitive bodies by digest, paused runs encrypted at rest, deterministic replay.
Per-tenant vec0 + FTS5 recall with reciprocal-rank fusion and an FTS-only offline floor; no memory item is ever a secret.
Default-deny allowlist over Zod-strict argv schemas and execFile arg-arrays, an agent never reaches a shell.
Four parts, each a declared seam.
No part is a black box. Each is a file you can read, diff, and gate in review before an agent ever runs.
Every agent, skill, and rule is a declared file, model lane, allowed tools, capability, side-effect flag. Validated against a schema at load, with a reference-integrity check: a ghost cross-ref throws before anything runs.
Work moves SPEC → PLAN → EXECUTE → VERIFY → SWEEP → EVAL → SHIP. Transitions are guarded: VERIFY fails, the machine reopens PLAN, SHIP is the only terminal state. The path is the policy.
Every transition guard and hook returns one of three decisions: allow, deny(reason), or mutate(context). A guard never runs an engine, it decides whether policy permits an already-legal move, fail-closed by default.
Lifecycle events fire typed hooks, session-start recall, per-act logging, pre-commit gates. The dispatcher is the one audited seam; a hook cannot reach a credential the kernel did not hand it.
A state machine, not a checklist.
VERIFY failing reopens PLAN. There is no shortcut to SHIP. The machine owns the path, the engineer does not override it inline.
dispatch({
agent: "db-migrator",
model: "sonnet", // escalate to opus only on uncertainty
isolation: "worktree", // parallel writers never share a tree
side_effects: false, // the kernel holds secrets, not the agent
});
// VERIFY fails → state machine reopens PLAN
// No edge to SHIP exists until VERIFY passesSpawns agents, not just scaffolds them.
@caisson/agent-runner spawns a headless coding-agent CLI as a detached subprocess in an isolated worktree, streams an auditable .jsonl transcript that survives the launcher exiting, and parses it into a structured run report (tool calls, files touched, final result). The child environment is built from scratch (never spread from process.env) with a fixed non-secret passthrough allowlist and only the target provider's key, so a secret sitting in your shell has no path into the sandbox. Provider-agnostic: name the binary, the env-var names for the endpoint and key, the model, and an argv template; a worked Claude Code CLI profile ships as the reference. It ships as its own package alongside the bundle, not wired into the kernel's lifecycle.
$ caisson-agent run --profile claude-code --task "fix flaky test" buildEngineEnv(): fixed allowlist + provider key only, never a process.env spread ✓ worktree: .agent-runs/8f2c1a · transcript: run-8f2c1a.jsonl tool_calls: 14 files_touched: 3 result: pass
Local memory, and a sandboxed exec gate.
@caisson/local-store gives the bundle hybrid vector + full-text recall (vec0 + FTS5 with reciprocal-rank fusion, an FTS-only offline floor when no embedder is wired) scoped per tenant at the file level. @caisson/tool-exec is the governed tool-execution gate composed alongside it: default-deny allowlist, Zod-strict argv schemas, execFile arg-arrays (never a shell) so an agent that wants to run a command only gets the ones you explicitly allowed. Neither piece makes an LLM call or imports a vendor SDK; the composed bundle holds no credential of its own.
Where your agent connects.
Most kits ship an MCP server now; the difference is what it lets an agent do. @caisson/mcp-server ships in the open Base substrate (every plan gets it, not just Agentic-Dev) and it treats the agent as a principal: four stages on every call, in order, the same server the buyer dashboard and any MCP-speaking agent client connect through.
A timing-safe Bearer compare against every issued buyer token, no early return, a match never leaks through response latency.
listTools returns only what the caller owns. A tool from a bundle you don't own is invisible, not just refused, the same 404 as a tool that doesn't exist.
The one write tool revalidates every requested module id and version against the SAME allowlisted registry index the CLI generator checks, then entitlement-expands your purchases before it ever calls the host.
A per-account rate limit gates every dispatch (fail-open only on a store fault, never on a real deny), and a retired tool answers 410 with a reason, never a bare 404 that leaves an integration guessing.
A governed kernel, not autonomous magic.
The kernel does not make agents smarter. It makes them accountable: every dispatch declares its lane and its boundary, the kernel holds the credentials, and the lifecycle owns the path to ship.
The kernel holds secrets. An agent that wants to deploy cannot, that capability lives on one audited side of the seam.
Model, tools, and isolation are declared at dispatch, not defaulted to the most powerful option. Escalate on uncertainty, not habit.
Every agent file is validated against a typed schema before it is allowed to run. An undeclared tool is a load-time error, not a runtime surprise.
A composition of the same base.
Agentic-Dev is a composition of the same open Caisson base every bundle shares, not a fork. Buy it outright, take a piece à la carte, or subscribe for credits and updates.
One-time
Buy the bundle outright for $329 and own the source, all four composed pieces, kernel through the agent runner.
Per-module
Take just the kernel ($199) or just the runner ($49) à la carte onto your Caisson base.
Developer plan
$499/yr adds credits, framework updates, and private-registry pulls across whatever you've bought. The Everything bundle ($2,259) covers the whole catalog and the base in one purchase.
Common questions.
What's actually running when an agent executes?
Can I buy just the kernel or just the runner?
Does the runner or the kernel ever hold a credential?
Prove fit in week one.
Don't take the fit on faith, scaffold the audited base and run it on your own stack before you commit.
The deadliest question in a build-vs-buy call is whether it fits the stack you already run. Answer it with code, not a sales call: scaffold the audited base in one command and deploy from the template the generator emits for your host. You own the source from the first line, so a week-one spike is a real evaluation on your own infrastructure — not a demo that disappears.
$ bunx @caisson-sh/cli@latest my-app $ cd my-app $ bun install # ready to run — deploy from the Railway, Fly, or Vercel template
Ship governed agents.
Buy the bundle outright and own the source, or take the kernel or the runner à la carte onto your existing Caisson base. Scaffold a project and put a governed agent to work.