Routing · guardrails · receipts
AgentLane
Open source · MITWhat it does
Decides which tool is allowed to carry out an AI task, refuses the ones that have never actually worked, and keeps a record of what really ran.
Read the source on GitHubProof
Nine tools in. Four come out.
The registry passes four gates, in this order: not proven, high risk, no relevance, beyond the short list. Two tools are refused while working perfectly — because nobody ever completed a task through them.
Fix the failing test in the compiler
| Tool | Registry status | Verdict |
|---|---|---|
read_file | WORKING_END_TO_END | Selected |
run_tests | WORKING_END_TO_END | Selected |
write_file | WORKING_END_TO_END | Selected |
git_diff | WORKING_END_TO_END | Selected |
search_files | WORKING_END_TO_END | Beyond the top four |
deploy | WORKING_END_TO_END | High risk — needs a human |
browser_agent | DETECTED | Not proven end to end |
vector_store | CONFIGURED | Not proven end to end |
send_email | WORKING_END_TO_END | No match for this task |
Reproduces the published order of selectTools. DETECTED means a binary was found, not that work ever ran through it.
Case study
- 1,425 lines of source, 635 of tests
- 65 tests, strict typecheck clean
- Zero runtime dependencies
- Problem
- An agent that can reach several providers, several effort levels and several tools has to settle four questions before it acts: which lane runs this work, which tools are actually proven, is the loop still making progress, and what really ran.
- Approach
- Twelve modules, each a pure function over an explicit input. Nothing calls a model, writes a file or opens a socket — except one provider adapter, included precisely because its network behaviour is the part worth reading.
- Architecture
- A router — model policy and registry, tool selection, executor resolution, loop guard — and a core: a host-and-path allowlist per MCP connector, an injection guard, and run receipts.
- What went wrong
- The cycle detector was a statement-for-statement translation of an Apache-2.0 source. Found by comparing the upstream files before publication, rewritten with a different algorithm, and the whole story is recorded in the first commit message rather than quietly dropped.
- Result
- Two ideas held by the type system: detected is not available, and requested is not observed. A receipt keeps both values separately, so it proves what ran rather than what was asked for.
- Limits
- Not an agent: no loop, no planner, no execution engine. Not a framework. And nothing in it has been measured against an alternative.