Status

agentplane is published on crates.io and pre-alpha. This page answers three questions an adopter has to answer before writing any code: what will move, what is deliberately absent, and how to check that either answer is still true. What exists is answered by concepts, the API reference and the test suite; what changed is in the changelog. Evaluating against a control catalogue → evaluator questions.

📌 What to pin, and what will move

Pre-alpha means every one of these can change. It does not mean they are all equally likely to, and an adopter deciding what to build against deserves the difference rather than one blanket warning.

Nothing here is a compatibility promise. It is a statement about where the remaining design pressure is, grouped by what the freeze will be a promise about.

🧊 Format freeze: the conditions, and where they stand

The single question that decides whether this can be recommended for anything regulated, asked directly enough to deserve a direct answer: the strongest control here — a tamper-evident, offline-verifiable audit trail — cannot be signed off as a long-term record while its format may break with no migration path. Every other gap an adopter finds is closable with integration work. This one is not.

There is no date. What there is instead is a condition list, each row naming what it demands and where the evidence is.

Every condition is met. The freeze itself is a deliberate act — the point at which hard cuts stop and a shape change becomes an upcaster plus a version bump — with no target release. It lands together with what holds a frozen vector, which is not yet in place: a check that every build still reads and hashes the vectors earlier builds wrote, a corpus that only gains vectors, and the operator vocabulary’s spellings pinned as the promise states them.

What the freeze is a promise about

Both surfaces exist and are published — a crate an embedder links, and a server an operator runs against a manifest with no Rust anywhere — and they carry the same guarantees. So the promise does not attach to either doorway. It attaches to what the guarantees are made of:

What an adopter depends on is the evidence, and both doorways produce the same evidence. Linking the crate gets the same promise about everything it stores and exports, and takes the ordinary pre-alpha risk on the signatures it compiles against — the half a cargo update reports and a rebuild settles, rather than the half that strands a history.

Until the freeze, the honest position for an adopter is: treat the export as the long-term artifact and the store as disposable. agentplane export produces framed JSON Lines with a checkpoint, agentplane verify recomputes it from its own bytes, and agentplane restore rebuilds a store from it — three verbs that already work, and the reason a store change is a rebuild rather than a loss — the procedure is on upgrading. That is a real answer, not a promise: an export taken today is verifiable today by a party who has never run this crate.

🚫 Deliberately not built

Two kinds, and conflating them is what makes a gap list useless. Refused will not arrive: something in the design forecloses it, and the entry says what. Deferred names what it is waiting on, so a reader can tell whether their own need would move it.

Refused

Deferred

Serving ACS as a Guardian — so agents this runtime does not execute can be governed by a plane that journals the decision. The mapping is close to complete: Cedar is the deterministic layer, the sink gate is allow/deny, an amendment is MODIFY, an approval task is ASK, a suspension is DEFER, and the audit chain is already SHA-256 over RFC 8785 canonical JSON — ACS’s own construction with the fields in the other order. Waiting on: the wire. Where such a session’s record goes is settled → observing an agent you do not run.

A measured containment claim. The runtime claims injection containment, not immunity, and no external measurement is attached to it. A static attack set would manufacture exactly the confidence this project refuses. Waiting on: one adaptive, defence-aware evaluation, over A2A, graded from the journal — the methodology exists in published form (2606.26479).

Two things will be published as part of that number rather than under it, because each moves it more than the attack set does: the policy bundle it ran under, since a deterministic gate has no attack-success rate and a deployment does, and how open the tasks were, since an adaptive attacker does far better against a task that leaves the agent latitude about what to do (2606.15057). A containment figure quoted without both is a figure about somebody’s configuration.

🔍 How to check any of this

Nothing on this page is a promise; all of it is checkable.

just anchors    # every mutation still anchors in the code it names
just features   # every optional feature compiles on its own
just audit      # no dependency in the tree has a known advisory
just ci         # lint, feature configurations, examples, docs, packaging
just ci-full    # the above, plus TLA+ specs and the full mutation sweep

just test-a2a-tck   # the protocol project's own conformance kit, on a live socket
just test-postgres  # the shared-store backend against a real server
just test-vault     # the key-ring contract against a real Vault
just test-live      # the model and embedding drivers against real APIs (costs money)

python3 tools/mutants.py <name> --verify   # one guarantee, end to end
MUTANTS_SHARD=2/10 just mutants          # one slice, for a machine that is not alone

The mutation sweep is the one that matters most: it breaks each guarantee on purpose and requires the test written for it to fail. That is why this page asserts no inventory of guarantees — an inventory is a claim a reader has to trust, and a sweep is one they can run. What the sweep reports, and why just anchors is not a substitute for running it, is on assurance.