Multi-Agent Workflow Lab v0.1.0

Multi-Agent Workflow Lab v0.1.0

Initial public release candidate — 2026-08-12.

Highlights

Inspect and test how agents delegate, not only what the final model returns.

Run the complete demo and deterministic suite without an API key.

Capture parent/child tasks, context boundaries, permission decisions, tool/MCP/sandbox activity, budgets, and result integration.

Evaluate delegation across eight normalized diagnostic dimensions with deterministic rules and optional model judgment.

Reconstruct, compare, visualize, and safely replay recorded workflows.

Core capabilities

Typed agent actions and bounded task scheduling.

Explicit delegation with target/capability checks, least-privilege reduction, and recursion controls.

Tool registry/executor with validation, policy, approvals, redaction, limits, and audit.

Official MCP stdio and Streamable HTTP client adapters plus an in-memory test connector.

Local development authentication, runtime-issued identities, permission and contextual policy engines.

Restricted local-process sandbox and optional Docker provider interface.

Versioned, hash-protected prompts with provenance-aware trusted/untrusted layers.

Append-only events, memory/SQLite/JSONL storage, trace trees, Mermaid graphs, metrics, budgets, and monitors.

Assertions, YAML workflow tests, scripted scenarios, seeded faults, regression comparison, and red-team inputs.

Example workflows

The release includes basic delegation, parallel research, a four-stage review chain, permission denial, untrusted MCP output, delegation-loop prevention, human approval, budget exhaustion, and bad-vs-good orchestrator evaluation.

Positive workflows complete with mock providers. Permission-denied, loop, and budget examples intentionally fail with a non-zero exit after the applicable guard records the decision.

Security model

Authority is independent from model output. Permissions and contextual policies deny unmatched requests. Child context, permission, and budget are reduced from the parent. MCP and model/tool/child output remain untrusted. Tool calls pass validation, authorization, policy, optional approval, limits, redaction, and audit. External-side-effect replay requires an exact explicit permission.

The local process sandbox is a development boundary, not hardened VM or kernel isolation. Prompt-injection detection is heuristic. See the threat model and security policy.

Known limitations

No distributed execution, queue, or atomic shared budget store.

SQLite is intended for local single-process-oriented use.

Local sandbox network enforcement is best-effort.

OAuth/OIDC, hardened sandboxing, remote telemetry, and human approval UI are extension interfaces, not bundled infrastructure.

Model-based evaluation is non-authoritative and provider-dependent.

The CLI does not auto-load real model credentials.

Getting started

pnpm install --frozen-lockfile
pnpm build
pnpm test
pnpm demo

The validated demo completes an orchestrator → researcher → analyst → reviewer → evaluator chain and prints a delegation score with trace metadata.

Upgrade notes

This is the initial public release; there is no previous public version to upgrade from. APIs and storage formats should be treated as experimental during the v0.1.x series.