Repository navigation
AI Framework Plan
Source audit: October 13, 2026, base revision c9748fc; provider expansion in PR #46 and account-flow update in PR #47 (247a040). This is an implementation gap assessment and proposed sequence, not a claim that planned capabilities ship in the current binary. Runtime deployment and release status remain separate.
Kiln's direction is a native Swift agent runtime integrated with application operations. The same identity, tool policy, task records and evidence should serve the SSH interface and future clients. Models choose among registered operations; Swift controllers own business logic and enforcement.
| Capability | Verified source boundary | Work needed |
|---|---|---|
| Streaming chat | Native SSE/NDJSON, activity updates and terminal controls | Replayable structured events, reconnect continuity, richer task/artifact navigation |
| Providers | Erebine, Ollama, OpenAI, Claude, Grok and DeepSeek native adapters; named profiles; isolated Grok CLI worker on macOS or Linux with required isolation dependencies | Remaining live acceptance, usage normalization and capability discovery; #28. See [[AI providers |
| Subscription access | ChatGPT OSS OAuth/PKCE and Grok CLI device-account flows implemented in PR #47; encrypted, owner-bound credentials | User consent and authenticated inference acceptance pending; do not infer eligibility from implemented login code |
| Conversation persistence | In-memory sessions; bounded context resets | Durable named sessions, search, compaction, export and deletion |
| Background investigations | Persisted task records; 1–48 configured concurrent read-only jobs | Resumable multi-step work, dependency graph, task ownership and partial-result checkpoints |
| Agent teams | No recursive delegation or shared plans | Parent/child runs, specialist profiles, budgets, messaging, artifact handoff and cancellation |
| Approved recovery | Identity-owned durable restart investigations and verified replacement evidence | Extend the pattern to additional explicitly scoped operations |
| Ordinary operation proposals | Session-owned start/stop/restart/rollback proposals | Consistent durable approval model across all workflows |
| Tool policy | Fixed Swift tools and authorization checks | Versioned schemas/effect contracts, budgets and administrator-installed adapters |
| Reusable procedures | One versioned operator knowledge pack | On-demand procedure library with versioning and review; no permission grants from documents |
| Memory | No searchable cross-session memory | Scoped preferences, runbooks and observations with provenance, expiry and deletion |
| Scheduling | No general recurring agent scheduler | Cron, event triggers, deduplication, missed-run and overlapping-run policies |
| Tool interoperability | No generic third-party tool-server client | Optional MCP gateway with approved tools, authentication, revocation and schema-change controls |
| Coding | AI cannot read/edit repositories or execute builds | Isolated workspaces, typed file/Git/build tools, diff review, test artifacts; #14 and #6 |
| Sandboxing | Process separation and Linux resource budgets for trusted workers | A separate malicious-code isolation boundary before arbitrary coding tools |
| Research | No AI web search/fetch/browser tools | Optional brokered search and retrieval with citations; browser workers need isolation and network policy |
| Cluster control | Typed remote administration exists; AI only reads cluster inventory | Approved peer-operation tools; scheduling/failover require ownership and fencing first; #8 |
| Cloud services | Planned provider modules | Account-scoped DNS/tunnel/email tools backed by Vault references; #12 and #13 |
| External interfaces | SSH/TUI and commands | Versioned authenticated API and event stream before native apps/channel adapters; #20 |
| Messaging and media | No general messaging gateway, voice or multimodal attachments | Optional channel and media modules after identity/session contracts |
| Evaluation | Policy, transport, UI and recovery tests | Repeatable end-to-end agent evaluations, durable run telemetry and usage budgets; #5 |
Source references: assistant and tool registry, tasks, recovery, provider configuration, knowledge, runtime boundaries.
The concurrency limit of 48 is a scheduler bound, not evidence of 48 coordinated agents, provider entitlement or measured throughput. A persisted task result is not a resumable conversation. A workspace directory is not a security sandbox. A procedure document is not executable authority.
SSH/TUI now API / native clients / channels later
+-------------------------------------+
|
Identity + scoped conversation
|
Durable run and event controller
/ | \
Context/memory Provider routing Task graph
| |
Model requests Bounded delegates
+------+-------+
|
Typed tool broker
schema / policy / budget / audit
|
+-------------------------+-------------------+
| | |
Runtime operations Isolated workspace Optional adapters
health / releases files / Git / tests web / MCP / DNS
| | |
+---------- approval when required -----------+
|
receipt + evidence + verification
|
persisted result / live UI
Memory and model output never authorize an action. Credentials are resolved by the broker for a specific operation; secret values should not enter model context. Child agents receive no more authority than their parent. A generated procedure may be proposed for review but cannot install a tool or edit the control plane.
- Durable conversations and structured event replay, with explicit retention and permission checks. Unify task and approval navigation around stable IDs.
- Versioned profiles/tool contracts and a reviewed procedure library. Add scoped memory with provenance. Complete provider/account acceptance and usage reporting through #28 without silently transferring context to a fallback provider.
- Durable workflows, bounded delegation and schedules. Start with one-node read-only investigations, then extend approved operations using receipts and reconciliation.
- Isolated coding workspaces: source -> reviewed patch -> build/test -> immutable artifact -> approved deployment -> verified health. Reuse #14 and #6 rather than build a second release path.
- Optional research, service and messaging adapters. Extend #20 into an authenticated event API; native Apple clients follow the server contracts. Voice and broad personal-assistant surfaces remain later modules.
Evaluation and authorization tests accompany every step. Distributed placement, database replication and automatic failover are independent work, not consequences of adding agents.
An operator requests an application investigation. Kiln records the conversation and structured task events. The operator disconnects and reconnects to the same conversation, sees the evidence and pending proposal, approves once, and sees a controller-verified result. Restarting the runtime must not lose the record or replay an uncertain mutation. This establishes the common foundation for delegation, automation and future clients.
- Persist AI conversations and replay structured run events
- Add versioned agent profiles and policy-controlled tool extensions
- Add scoped AI memory with evidence provenance and deletion
- Build durable AI workflows with bounded delegation and scheduling
- Provide isolated coding workspaces and reviewed build-to-deploy workflows
- Evaluate agent workflows and report model usage and operational outcomes
The account flows and Linux headless worker ship in 26.10.13.3; final server, package and clean-install checks passed. Native Erebine and local Ollama passed real read-only tool rounds, streamed final answers and cancellation after actual incoming content. Other API-provider credentials were unavailable; ChatGPT/Grok account consent remains outstanding. AI providers distinguishes these results from fixture coverage and package publication. This work does not complete #28 or the coordinator/worker milestones.
P.Industries · Apache 2.0 · Versioned documentation