Lacp
NOTE
0xNyk

Lacp

Control-plane-grade agent harness for Claude, Codex & Hermes: policy gates, verification/evidence loops, memory, and auditable execution.

216 Stars
GitHub

LACP

Control-plane-grade agent harness for Claude, Codex & Hermes.

LACP is a harness-first execution framework with policy-gated operations, verification/evidence loops, 5-layer memory, and auditable agent workflows — all local-first, zero external dependencies.

GitHub stars GitHub forks License: MIT Alpha Last commit Open issues Shell

LACP Banner


Alpha Release — LACP v0.9.0 is under active development. The native REPL, multi-provider routing, hermes-style tool display, and memory system are functional but evolving fast. APIs and CLI interfaces may change between releases. Report issues.

Contents

What LACP is (by harness definition)

LACP is an agent harness with control-plane governance:

  • Harness layer: tasks, verification contracts, evidence manifests, replayable run loops
  • Control-plane layer: risk tiers, budget gates, context/session contracts, approvals, provenance

This keeps the core value clear: not just generating output, but producing auditable, policy-compliant outcomes.

Policy gatesRisk tiers (safe/review/critical), budget ceilings, context contracts, and session fingerprints — every agent invocation is gated and auditable.
5-layer memorySession memory, Obsidian knowledge graph, ingestion pipeline, code intelligence (GitNexus), and agent identity with hash-chained provenance.
Hook pipelineModular Python hooks for Claude Code — session context injection, pretool guards, write validation, and stop quality gates with local LLM eval.
Obsidian brainFirst-class vault management, mycelium-inspired memory consolidation, QMD indexing, and config-as-code with auto-optimization.
Multi-agent orchestrationdmux/tmux session management, git worktree isolation, swarm workflows, and Claude native worktree backend.
Local-first securityZero external CI by default, no secrets in config, environment-driven credentials, TTL approval tokens for remote execution.
Execution tierstrusted_local, local_sandbox, and remote_sandbox (Daytona/E2B) with policy-driven routing and provider override.
Evidence pipelinesBrowser e2e, API e2e, smart-contract e2e harnesses with manifest evidence, auth checks, and PR preflight gates.

Quick Start

Install

# Homebrew (recommended)
brew tap 0xNyk/lacp && brew install lacp

# or cURL bootstrap
curl -fsSL https://raw.githubusercontent.com/0xNyk/lacp/main/install.sh | bash

Bootstrap & Verify

lacp bootstrap-system --profile starter --with-verify
lacp doctor --json | jq '.ok,.summary'

After bootstrap: .env is created, dependencies installed, directories scaffolded, Obsidian vault wired, and verification artifacts produced.

For the full setup and daily operator flow, start with the Runbook and Local Dev Loop.

First Gated Command

# Route a task through LACP policy gates
lacp run --task "hello world" --repo-trust trusted -- echo "LACP is working"

# Make claude/codex/hermes default to LACP routing (reversible)
lacp adopt-local --json | jq

Why teams adopt LACP

  • Predictable execution: every run passes through deterministic policy and budget gates.
  • Auditability by default: artifacts, provenance, and verification logs are first-class outputs.
  • Local-first security posture: remote execution is opt-in and secrets stay environment-scoped.
  • Multi-agent without chaos: worktree/session isolation keeps parallel runs reproducible.

Use-case recipes

1) Harden local agent usage in under 5 minutes

lacp bootstrap-system --profile starter --with-verify
lacp adopt-local --json | jq
lacp posture --strict

2) Run one risky command with explicit policy controls

lacp run \
  --task "dependency update with tests" \
  --repo-trust trusted \
  --context-profile default \
  -- pnpm up && pnpm test

3) Generate PR-ready evidence before opening a PR

lacp e2e smoke --workdir . --init-template --command "npx playwright test --grep @smoke"
lacp api-e2e smoke --workdir . --init-template --command "npx schemathesis run --checks all"
lacp pr-preflight --changed-files ./changed-files.txt --checks-json ./checks.json

4) Run parallel agents safely on isolated worktrees

lacp worktree create --repo-root . --name feature-a --base HEAD
lacp up --session feature-a --instances 3 --command "claude"
lacp swarm launch --manifest ./swarm.json

Documentation

GuideWhat You'll Learn
RunbookDaily operator workflow, command map, troubleshooting entry points
Local Dev LoopFast build/test/verify loop for contributors
Framework ScopeWhat LACP is, what it is not, and design boundaries
Implementation PathStep-by-step rollout plan for full harness adoption
Memory Quality WorkflowHow memory ingestion, expansion, and validation are run safely
Incident ResponseTriage and recovery flow when policy gates fail
Release ChecklistPre-release, release, and post-release controls
TroubleshootingCommon errors, doctor diagnostics, fix hints

Project health files


Architecture

lacp/
├── bin/                    # CLI commands (lacp <command>)
│   ├── lacp                # Top-level dispatcher
│   ├── lacp-bootstrap-system
│   ├── lacp-doctor         # Diagnostics (--json, --fix-hints)
│   ├── lacp-route          # Policy-driven tier/provider routing
│   ├── lacp-sandbox-run    # Gated execution with artifact logging
│   ├── lacp-brain-*        # Memory stack (ingest, expand, doctor, stack)
│   ├── lacp-obsidian       # Vault config management
│   ├── lacp-up             # Multi-instance agent sessions
│   ├── lacp-swarm          # Batch orchestration
│   └── lacp-claude-hooks   # Hook profile management
├── config/
│   ├── sandbox-policy.json     # Routing + cost ceilings
│   ├── risk-policy-contract.json
│   ├── obsidian/               # Vault manifest + optimization profiles
│   └── harness/                # Task schemas, sandbox profiles, verification policies
├── hooks/                  # Python hook pipeline for Claude Code
├── scripts/
│   ├── ci/                 # Test suites
│   └── runners/            # Daytona/E2B execution adapters
└── docs/                   # Guides and reference docs

Control Flow

Agent invocation
  → lacp route (risk tier + provider selection)
    → context contract validation
      → budget gate check
        → session fingerprint verification
          → sandbox-run (dispatch + artifact logging)

Features

Policy-Gated Execution

Every command routes through risk tiers (safereviewcritical), budget ceilings per tier, and context contracts that validate host, working directory, git branch, and remote targets before execution.

5-Layer Memory Stack

LayerPurpose
Session memoryPer-project scaffolding under ~/.claude/projects/
Knowledge graphObsidian vault with MCP wiring (smart-connections, QMD, ori-mnemos)
Ingestion pipelinebrain-ingest converts text/audio/video/URLs into structured notes
Code intelligenceGitNexus AST-level knowledge graph via MCP (optional)
Agent identityPersistent IDs per (hostname, project) + SHA-256 hash-chained provenance
lacp brain-stack init --json | jq          # Bootstrap all layers
lacp brain-ingest --url "https://..." --apply --json | jq
lacp brain-expand --apply --json | jq      # Full expansion loop

Hook Pipeline for Claude Code

Modular Python hooks enforcing quality at every session stage:

HookEventPurpose
session_start.pySessionStartGit context injection, test command caching
pretool_guard.pyPreToolUseBlock dangerous operations (publish, chmod 777, fork bombs, secrets)
write_validate.pyPostToolUseYAML frontmatter schema validation
stop_quality_gate.pyStop3-tier eval: heuristics, test verification, local LLM rationalization detection

Profiles: minimal-stop, balanced, hardened-exec, quality-gate-v2. Apply with lacp claude-hooks apply-profile <profile>.

Mycelium Network Memory

Biologically-inspired memory consolidation modeled on fungal networks:

MechanismDescription
Adaptive path reinforcementFrequently-traversed edges strengthen (like mycelium hyphae)
Self-healingPruned nodes trigger reconnection of orphaned neighbors
Exploratory tendrilsFrontier nodes in active categories shielded from pruning
Flow scoringBetweenness centrality identifies critical knowledge hubs
Temporal decayFSRS dual-strength model with forgetting curve

Multi-Agent Orchestration

# dmux-style multi-instance launch
lacp up --session dev --instances 3 --command "claude"

# Git worktree isolation
lacp worktree create --repo-root . --name "feature-a" --base HEAD

# Batch swarm execution
lacp swarm launch --manifest ./swarm.json

Evidence Pipelines

Generate machine-verifiable evidence for PR gates:

lacp e2e smoke --workdir . --init-template --command "npx playwright test --grep @smoke"
lacp api-e2e smoke --workdir . --init-template --command "npx schemathesis run --checks all"
lacp contract-e2e smoke --workdir . --init-template --command "forge test -vv"
lacp pr-preflight --changed-files ./changed-files.txt --checks-json ./checks.json

Prerequisites

RequiredRecommended
bash, python3, jq, rg (ripgrep)shellcheck, tmux, gh

The installer auto-detects and installs missing dependencies on macOS via Homebrew.

Install Options

All installation methods

Homebrew

brew tap 0xNyk/lacp
brew install lacp            # stable v0.3.0
brew install --HEAD lacp     # track main branch

cURL Bootstrap

curl -fsSL https://raw.githubusercontent.com/0xNyk/lacp/main/install.sh | bash

Verified Release (recommended for production)

VERSION="0.3.0"
curl -fsSLO "https://github.com/0xNyk/lacp/releases/download/v${VERSION}/lacp-${VERSION}.tar.gz"
curl -fsSLO "https://github.com/0xNyk/lacp/releases/download/v${VERSION}/SHA256SUMS"
grep "lacp-${VERSION}.tar.gz" SHA256SUMS | shasum -a 256 -c -
tar -xzf "lacp-${VERSION}.tar.gz" && cd "lacp-${VERSION}"
bin/lacp-install --profile starter --with-verify

Who It's For

LACP is for developers who want measurable, policy-gated, reproducible local agent operations with explicit pass/fail gates and artifact-backed records.

LACP is not for users looking for a chat UI, managed cloud orchestration, or who don't want to maintain local scripts/config.

Testing

lacp test --quick       # Fast smoke tests
lacp test --isolated    # Full isolated suite
lacp doctor --json      # Structured diagnostics
lacp posture --strict   # Policy compliance check
Individual test suites
scripts/ci/test-route-policy.sh
scripts/ci/test-mode-and-gates.sh
scripts/ci/test-knowledge-doctor.sh
scripts/ci/test-ops-commands.sh
scripts/ci/test-install.sh
scripts/ci/test-system-health.sh
scripts/ci/test-obsidian-cli.sh
scripts/ci/test-brain-memory.sh
scripts/ci/smoke.sh
Command reference

Core

CommandPurpose
lacp bootstrap-systemOne-command install + onboard + verify
lacp doctorStructured diagnostics (--json, --fix-hints, --check-limits)
lacp statusCurrent operating state snapshot
lacp modeSwitch local-only / remote-enabled
lacp runSingle gated command execution
lacp loopIntent → execute → observe → adapt control loop
lacp testLocal test suite (--quick, --isolated)

Memory & Knowledge

CommandPurpose
lacp brain-stackInitialize/audit 5-layer memory stack
lacp brain-ingestIngest text/audio/video/URLs into Obsidian
lacp brain-expandFull brain expansion loop
lacp brain-doctorBrain ecosystem health checks
lacp obsidianVault config management (audit/apply/optimize)
lacp repo-research-syncMirror repo research into knowledge graph

Orchestration

CommandPurpose
lacp updmux-style multi-instance launch
lacp orchestratedmux/tmux/worktree orchestration adapter
lacp worktreeGit worktree lifecycle management
lacp swarmBatch swarm workflow (plan/launch/status)
lacp adopt-localInstall LACP routing wrappers for claude/codex

Security & Policy

CommandPurpose
lacp routeDeterministic tier/provider routing
lacp sandbox-runGated execution with artifact logging
lacp policy-packApply policy baselines (starter/strict/enterprise)
lacp claude-hooksAudit/repair/optimize hook profiles
lacp security-hygieneSecret/path/workflow/.env scan
lacp pr-preflightPR policy gate evaluation

Release & Evidence

CommandPurpose
lacp release-preparePre-live discipline (gate + canary + status)
lacp release-verifyRelease verification (checksum + archive + brew)
lacp e2eBrowser e2e evidence pipeline
lacp api-e2eAPI/backend e2e evidence pipeline
lacp contract-e2eSmart-contract e2e evidence pipeline
lacp canary7-day promotion gate over retrieval benchmarks

Utilities

CommandPurpose
lacp consoleInteractive slash-command shell
lacp timeProject/client session time tracking
lacp agent-idPersistent agent identity registry
lacp provenanceCryptographic session provenance chain
lacp context-profileReusable context contract templates
lacp vendor-watchMonitor Claude/Codex version drift
lacp system-healthmacOS/Apple Silicon workstation readiness
lacp mcp-healthProbe all configured MCP servers

Security

  • No secrets in repo config — environment-driven via .env
  • Zero external CI by default (LACP_NO_EXTERNAL_CI=true)
  • Remote execution disabled by default (LACP_ALLOW_EXTERNAL_REMOTE=false)
  • Risk-tier gating with TTL approval tokens
  • Structured input contracts for risky runs
  • Artifact logs for auditable execution history
  • See SECURITY.md for vulnerability reporting

Contributing

Contributions welcome. See CONTRIBUTING.md for guidelines.

Support

If you find this project useful, consider supporting the open-source work:

Buy Me A Coffee

Solana: BYLu8XD8hGDUtdRBWpGWu5HKoiPrWqCxYFSh4oxXuvPg


Need agent infrastructure, trading systems, or Solana applications built for your team?

Builderz ships production AI systems — 32+ products across 15 countries.

Get in touch | @nyk_builderz

License

MIT © 2026 0xNyk

Related

How to Install

  1. Download the template file from GitHub
  2. Move it anywhere in your vault
  3. Open it in Obsidian — done!

Stats

Stars

216

Forks

28

License

MIT

Last updated 5d ago

Tags

agent-harnessai-agentsclaude-codecodexcontrol-planehermeslocal-first