Flow is a provider-neutral coding-agent harness. It executes deterministic workflow graphs, records durable evidence, and confines command execution through fail-closed sandboxes.
Alpha preview: Flow is under active development. Its contracts may change. Install the published npm prerelease from the
previewchannel, or verify and install its immutable GitHub release. Don't use Flow as a security boundary for hostile or multi-tenant workloads.
Flow is a standalone product. It does not depend on Claude Code or preserve compatibility with the earlier Flow plugin. Pi supplies the default model-facing agent loop. Flow owns scheduling, policy, containment, evidence, recovery, and completion.
A coding model is not a workflow engine, authorization boundary, evidence store, or recovery system. Flow separates those responsibilities.
- Models solve bounded tasks inside workflow nodes.
- A deterministic scheduler controls graph transitions.
- A policy broker controls model-requested operations.
- Native sandboxes confine command filesystem and network access.
- An append-only ledger records authoritative run state and evidence.
- A local supervisor owns detached discovery and control without owning graph transitions.
- Durable budgets stop new work at replayable boundaries.
- Private, provider-neutral model-session records preserve bounded completed context for safe fresh recovery without controlling workflow state.
- Mutation-free evaluation decides whether evidence accepts each criterion.
- Provider-specific behavior remains behind execution adapters.
The compiled graph decides what runs next. Model prose cannot override missing or rejected evidence.
Flow is a public alpha preview. The executable format is
flow.synapti.ai/v1alpha1. There is no compatibility or migration promise before the first stable
release.
Current capability groups include:
- Deterministic graphs, branches, joins, loops, child workflows, and bounded optimization.
- Typed results, durable evidence, exact replay, and proof-gated recovery.
- Command, agent-command, and evidence approvals.
- Run budgets and provider-neutral policy enforcement.
- An operator-maintained, revisioned goal workspace that can be frozen into attached, detached, resumed, and child runs without gaining workflow authority.
- Bounded read-only semantic code queries through an exact operator-selected language server.
- Attached and detached execution with local terminal, browser, and ACP control.
- Operator-selected prompt-only local ACP v1 execution and paired exact-agent qualification with fresh isolated processes, private result verification, and provider-neutral evidence.
- Optional exact Lean statement verification on a reproducible Linux x64 appliance. The profile requires human statement approval, SafeVerify replay, Nanoda checking, and confirmed cleanup.
- Inert skill, verifier, tool, workflow, policy, and presentation packages.
- Exact HTTPS and publisher-authenticated OCI bundle acquisition.
- Signed metadata and TUF repository review, activation, replacement, and bounded watching.
- Reproducible Flow, Pi, OMP, and Prime evaluation profiles with reviewed root, child-specialist, and supplemental-memory candidates, including bounded model-suggested memory and evidence-backed relationships.
- Exact phase-aware model routing with per-request durable evidence and held-out qualification before activation.
- A sealed one-call local delegation experiment with paired task classes, durable child evidence, exact resource accounting, and no activation path.
- A balanced three-mode experiment for complete history, verified artifact references, and bounded summaries. It cannot activate production compaction.
Linux and macOS support ordinary workflow execution. Agent exec, the container command profile,
and Prime Agent have narrower platform requirements.
Read Project status for the current feature and platform matrix. Read the Delivery roadmap for completed gates and planned work.
The 0.1.0-alpha.3 checkpoint provides the guided command. It creates a minimal Flow project and
completes one credential-free workflow through the production command sandbox.
- Node.js 26.7 or newer
- npm with global package support
- x64 Linux or macOS
Install the published preview and confirm that your shell can call Flow:
npm install --global --ignore-scripts @synapti/flow-harness@preview
flow --helpCreate a directory and complete the first run:
mkdir flow-preview-project
cd flow-preview-project
flow quickstart .The result contains the run status, the project-relative evidence path, and tokenized inspect and
web follow-up commands. Flow does not open a browser.
Read Getting started for provider selection, output details, and failure
recovery. Use the coding quick start when you are ready to prove
one real provider-backed read, hash-bound edit, and deterministic verification. Follow
Install the Flow preview for exact-version pinning, one-off npm
invocation, provenance verification, upgrades, removal, and PATH recovery.
Flow fails before command spawn when the selected sandbox cannot prove its required isolation. Command tasks receive an explicit environment, a private temporary directory, no task network, and bounded filesystem authority.
The host-side Pi runtime still runs with the invoking user's operating-system permissions. It
receives only the Flow-owned tools declared by the workflow. Agent exec requires verified Linux
PID-namespace descendant containment.
Detached supervisor controls coordinate trusted processes for one operating-system user. They are not a sandbox against that same user or root.
SRT and the container profile are not VM-grade hostile-workload boundaries. Use a reviewed container, microVM, or managed sandbox for hostile workloads.
Read SECURITY.md before unattended or high-impact use. Report suspected vulnerabilities through a private GitHub security advisory, not a public issue.
The documentation hub routes each reader task to one canonical document.
| Start with | When you need |
|---|---|
| Install the Flow preview | Published installation, invocation, exact pinning, provenance verification, removal, and release-specific limits |
| Getting started | Installed command verification and the first credential-free run |
| Complete the coding quick start | Provider setup, one bounded edit, cost interpretation, evidence, cancellation, cleanup, and recovery |
| Diagnose the Flow environment | Read-only host, project, workflow, provider, sandbox, and Prime preflight |
| Project status | Maturity, platform support, and planned boundaries |
| Run and control workflows | Work profiles, detached runs, presentation hosts, approvals, budgets, cancellation, and recovery entry points |
| Maintain a durable goal workspace | Revisioned long-horizon context, evidence references, compare-and-set updates, run selection, and recovery |
| Use read-only semantic code queries | Exact language-server selection, bounded queries, containment, evidence, and failure handling |
| Retain and inspect command artifacts | Exact oversized command output, bounded agent reads, inspection, retention, and pruning |
| Inspect and recover portable model sessions | Private context records, public integrity metadata, fresh recovery, limits, and failure handling |
| Evaluate reference-first context compaction | Held-out three-mode plans, protected constraints, metrics, verdicts, and recovery |
| Manage supplemental-memory relationships | Evidence-backed memory relationships, atomic rebinding, review, activation, rollback, limits, and recovery |
| Use capability packages | Skills, verifiers, tools, workflows, policies, presentations, bundles, and repositories |
| Prime runtime operations | Dedicated Linux x64 Prime and container-profile preparation |
| Workflow specification | Normative executable and persisted contracts |
| Architecture | System diagram, component ownership, trust boundaries, failure modes, and non-goals |
| Recovery and interruption safety | Exact restart, uncertainty, and remediation rules |
| Reproducible harness evaluation | Comparative plans, private verification, candidates, activation, and export |
| Qualify two local ACP agents | Paired production-agent identity, private result verification, accounting, verdicts, and recovery |
| Evaluate bounded one-shot delegation | Sealed candidate authority, paired task classes, child evidence, verdicts, recovery, and non-goals |
| Verify an exact Lean statement | Proof inputs, human statement approval, checker evidence, qualification, and non-goals |
| Lean proof runtime operations | Reproducible Linux x64 preparation, containment, identity, recovery, and replacement |
| Testing and evaluation | Contributor gates, test layers, runtime proofs, and live-provider policy |
- Read Contributing before preparing a change.
- Use Support for usage and development questions.
- Follow the Code of conduct.
- Use the Security policy for private vulnerability reporting.
Apache License 2.0. See LICENSE and third-party notices.