Research
Architecture surveys, code-verified gap analyses, sandbox engineering, human-in-the-loop design, and a compiled language built toward agent engineering. The common thread is the execution substrate: the layer that decides what an agent may actually do.
Five programs of internal analysis, not published papers, each feeding a product. Status as of September 25, 2026.
Security-first gap analysis
39 prioritized improvements
Jul 2026 · adversarially verified
At a glance
Counts read on September 25, 2026 from the internal documents, the models catalog and runtime list, and the AEL status record of September 19, 2026. The sandbox line count is the report’s own approximation; every other figure is exact.
39
Prioritized improvements in the security-first gap analysis: 2 P0, 17 P1, 20 P2
Source: gap analysis, Jul 2026
6
Analyst findings downgraded by adversarial verification before the list was fixed
Source: gap analysis, Jul 2026
4
Cooperating sandbox layers, kernel-enforced at two boundaries today
Source: sandbox report, Jun 2026
~10,000
Lines of sandbox code read by the multi-agent analysis behind that report
Source: sandbox report, Jun 2026
4
Model runtimes that work out of the box; seven more, from vLLM to Transformers, run once their toolchain is installed
Source: engine source, runtimes.json
28
On-device open-weight models in the catalog, 1B to 70B parameters, each with stated minimum hardware
Source: models catalog
1,503
AEL compiler tests passing, none failing, across 19 test binaries
Source: AEL status record of September 19, 2026, commit 6f9c44a
22 of 48
AEL 0.1 acceptance boxes closed; one qualified platform and no release yet
Source: AEL status record of September 19, 2026
Programs
Each program is a body of internal analysis with a product on the other end of it. We state what is live, what is a draft, and what is only designed.
The AI engine is a supervisor loop around a language model that never executes anything itself. The model emits typed intents; every side effect passes through one governed gateway with a fail-closed policy floor that a configuration can add to but never remove. Agents propose; the substrate disposes.
feeds the OpenEng AI engine
Downloadable open-weight models run on the user’s own machine, not through a hosted inference API. The engine addresses each model by registry, format, and runtime: four runtimes work out of the box, and seven more, including vLLM, run once their toolchain is installed. The models are open-weight; the platform itself is not open source.
feeds the OpenEng AI engine
Four cooperating layers, each confining a different execution path. The OS kernel enforces two of them today: the sandbox around each raw shell command, on by default wherever bubblewrap or Seatbelt works, and the enclosure around the per-user daemon. Per-worker OS isolation is mocked today and is a stated future phase.
feeds the OpenEng AI engine
A run that needs a person’s approval will suspend durably at the call boundary, checkpoint its context, and resume from exactly that boundary once approved: if hop 7 of a 10-hop run needs sign-off, hops 1 through 6 will not run again. Suspend exists in the gateway today. The cloud-coordinated approval flow is a draft design, planned for the Pro and Enterprise plans that will launch in Q4 2026.
designed for the OpenEng AI engine
AEL is a native language whose compiler is first-party Rust: source to binary AEL IR to a native executable, with no LLVM and no generated C. Version 0.1 is in development and qualifies linux-x86_64 alone. Its design keeps each source file under a hard size limit and scopes packages to the folder that declares them. Token budgets, a reference map of exactly what a build reaches, and the agent runtime are planned; agent, node, edge, and hook are reserved keywords that refuse to compile today.
feeds AEL 0.1 · figures as of September 19, 2026
From research to product
How the agentic-systems research moved from a reading of the field to a dated status line on this site.
Distill the 2025–2026 field (workflow patterns, MCP and A2A, tiered memory, durable execution, evaluation) into one reference.
leaves behindan architecture reference
Benchmark the as-built engine against that reference, one dimension at a time, with a verifier whose job is to refute each finding.
leaves behinda ranked list of 39
Land each improvement behind the governed gateway so it inherits the policy floor. Durable execution and Missions ship default-off.
leaves behinda default-off change
Check each claim against the code, not the design, and separate what the kernel enforces from what is still a mock.
leaves behinda verified report
Publish the result with a dated status: live, beta, or planned as of September 25, 2026, with a short qualifier where one helps.
leaves behinda dated status line
How we work
They are why this page can say “mocked today” next to “kernel-enforced” without contradiction.
Current-state claims come from reading the as-built source, not a design document, and every analyst’s findings go to a verifier whose job is to refute them.
Where the code simulates a guarantee instead of enforcing it, the analysis says so and this site repeats it. Per-worker isolation is listed as mocked, not as a feature.
Each program has the OpenEng AI engine or AEL on the other end. Research with nothing on the other end is not on this page.
The documents live in private repositories, so nothing here links out. We go through the relevant findings in a scoping conversation.
Findings
Dated conclusions from our internal analyses, including the ones that are not flattering. We list the ones we act on.
Jun 2026
A multi-agent analysis of roughly 10,000 lines of sandbox code, with a reality-check section that says what the kernel enforces and what is still a mock. It is why this page calls per-worker isolation a future phase.
Jul 2026
We benchmarked the AI engine against the 2025–2026 state of the art in six dimensional analyses, each adversarially verified against the as-built architecture. Six analyst findings were downgraded during verification (four severity ratings lowered, two priorities dropped) before the list was fixed at 39.
Jul 2026
The same analysis puts the governance and execution substrate at or ahead of the state of the art, the part the literature treats as the wall between demo and production. It also names where we lagged, in context engineering and offline evaluation; both became numbered items on the list.
Aug 2026
A production-readiness audit on August 17, 2026, examined each of the five apps as the single-user, loopback companion it is and concluded that a hosted, multi-user deployment is not ready. This site describes the apps within that scope: free, in beta, and each running on your own machine.
Audit ledger
The status of each mechanism the analyses examined, as of September 25, 2026. On this page, beta means built and tested but shipped default-off.
| Item | Status | Note |
|---|---|---|
| Governed gateway with a fail-closed policy floorNo-bypass enforced by a build-time gate; every side effect crosses it | Live | No-bypass enforced by a build-time gate; every side effect crosses it |
| Kernel-enforced confinement at two boundariesEach raw shell command (on by default wherever bubblewrap or Seatbelt works, network off) and the per-user daemon | Live | Each raw shell command (on by default wherever bubblewrap or Seatbelt works, network off) and the per-user daemon |
| Open-weight execution, four runtimes out of the boxEmbedded GGUF, Ollama, ONNX Runtime, and a network endpoint; seven more once their toolchain is installed | Live | Embedded GGUF, Ollama, ONNX Runtime, and a network endpoint; seven more once their toolchain is installed |
| Human-in-the-loop suspend in the gatewayThe suspend point exists today; the approval flow around it is planned (below) | Live | The suspend point exists today; the approval flow around it is planned (below) |
| Durable execution and MissionsBuilt and tested; shipped default-off | Beta | Built and tested; shipped default-off |
| Cloud-coordinated approval flowExternal approval URL, unified callback, and resume on another node (PRD Draft v1); Pro and Enterprise, Q4 2026 | Planned | External approval URL, unified callback, and resume on another node (PRD Draft v1); Pro and Enterprise, Q4 2026 |
| Per-worker OS isolationMocked today; the sandbox report names it a future phase | Planned | Mocked today; the sandbox report names it a future phase |
| OpenTelemetry span exportWrites GenAI spans to a local file, only when an operator names one | Beta | Writes GenAI spans to a local file, only when an operator names one |
| Offline evaluation harnessListed as missing by the gap analysis, which calls it the biggest non-security gap | Planned | Listed as missing by the gap analysis, which calls it the biggest non-security gap |
| Governed A2A interconnectOn the 39-item list; the engine has no agent-to-agent path today | Planned | On the 39-item list; the engine has no agent-to-agent path today |
| AEL agent runtimeThe keywords agent, node, edge, and hook are reserved and refuse to compile today | Planned | The keywords agent, node, edge, and hook are reserved and refuse to compile today |
Internal documents
Every program and finding above traces to one of these internal documents. The repositories are private, so nothing here links out.
Agentic architecture survey 2025–2026
Architecture reference
Jul 2026
As-built agentic system description
Code-verified engine description
Jul 2026
Security-first gap analysis
39 prioritized improvements
Jul 2026
Open-weight program plan
Program plan
Jul 2026
Sandbox architecture report
Engineering report, as built
Jun 2026
Human-in-the-loop PRD (draft)
Draft v1, implementation-ready
Jun 2026
Core Engineering product stabilization plan
Production-readiness audit
Aug 2026
AEL agent ecosystem design
Design and implementation contract
Sep 2026
Grounded in
Architecture surveys, code-verified gap analyses, sandboxing, and human-in-the-loop design, scoped to your systems.