LACP: The Secret Weapon for Bulletproof AI Agent Execution

What if your AI agents could never accidentally delete production data, leak secrets, or burn through your API budget without permission? What if every single command they ran left behind a cryptographically verifiable audit trail?

Here's the uncomfortable truth most developers ignore: Claude, Codex, and Hermes are incredibly powerful—and incredibly dangerous when left unsupervised. One rogue rm -rf, one accidental chmod 777, one secrets leak in a generated config file, and your infrastructure turns into a resume-generating event.

The AI coding assistants everyone is racing to adopt? They operate on blind trust. You type a prompt, they execute. No gates. No verification. No memory of what went wrong last time.

That's where LACP changes everything.

LACP—the Local Agent Control Plane—is a harness-first execution framework built by 0xNyk that wraps your favorite AI agents in policy-gated, auditable, memory-rich armor. It's not another chat wrapper. It's control-plane-grade infrastructure for developers who refuse to let autonomous code run without adult supervision.

And the best part? It's local-first, zero external dependencies, and ready to harden your agent workflow in under five minutes.

What is LACP? The Agent Harness Developers Are Secretly Adopting

LACP stands for Local Agent Control Plane. Created by 0xNyk and currently at alpha v0.9.0, this open-source project is rapidly becoming the underground standard for teams who need measurable, policy-gated, reproducible AI agent operations.

But calling LACP a "tool" undersells it. LACP is an agent harness with control-plane governance—a deliberate architectural choice that separates it from every other AI assistant wrapper on the market.

The harness layer handles tasks, verification contracts, evidence manifests, and replayable run loops. Think of it as the execution engine that actually does the work. The control-plane layer sits above it, enforcing risk tiers, budget gates, context contracts, approvals, and provenance tracking. This is what decides whether work should happen at all.

This dual-layer design reflects a hard-won insight: generating output is cheap; producing auditable, policy-compliant outcomes is valuable.

LACP emerged from the real-world pain of running multiple AI agents across complex codebases. When you're spinning up Claude for architecture decisions, Codex for implementation, and Hermes for specialized tasks, chaos multiplies fast. Different contexts bleed together. Secrets slip into generated code. Expensive API calls pile up unchecked. And when something breaks, you have zero record of why.

The project's GitHub repository has been gaining serious traction among infrastructure-conscious developers precisely because it solves these problems without adding cloud complexity or vendor lock-in. Everything runs locally. Everything is auditable. And everything is gated by policies you control.

Key Features: The Technical Arsenal That Sets LACP Apart

LACP isn't a thin veneer over existing tools. It's a deeply engineered system with eight core capability areas that work together to create something genuinely new in the agent tooling space.

Policy Gates: Your First Line of Defense

Every agent invocation routes through risk tiers—safe, review, and critical—with budget ceilings per tier and context contracts that validate host, working directory, git branch, and remote targets before execution. This isn't optional logging; it's blocking enforcement. Try to run a critical-tier command without approval? Blocked. Exceed your daily API budget? Blocked. Operating outside your approved context contract? Blocked.

5-Layer Memory Stack: Agents That Actually Learn

LACP implements a biologically-inspired memory system with five distinct layers: session memory for per-project scaffolding, an Obsidian knowledge graph with MCP wiring, an ingestion pipeline that converts text/audio/video/URLs into structured notes, GitNexus AST-level code intelligence, and agent identity with SHA-256 hash-chained provenance. Your agents don't just remember—they remember cryptographically verifiably.

Hook Pipeline: Python^{↗ Bright Coding Blog} Guards for Claude Code

Four critical hooks intercept every Claude Code session: session_start.py for git context injection, pretool_guard.py for blocking dangerous operations (publish commands, chmod 777, fork bombs, secrets exposure), write_validate.py for YAML frontmatter schema validation, and stop_quality_gate.py for three-tier evaluation using heuristics, test verification, and local LLM rationalization detection.

Mycelium Network Memory: Fungal Intelligence for Knowledge

Yes, really. LACP models memory consolidation on mycelium networks—the underground fungal systems that connect forest ecosystems. Adaptive path reinforcement strengthens frequently-used knowledge connections. Self-healing reconnects orphaned nodes when pruning occurs. Exploratory tendrils protect frontier knowledge from premature decay. Betweenness centrality identifies critical knowledge hubs. And temporal decay follows the FSRS dual-strength model with actual forgetting curves.

Multi-Agent Orchestration Without the Chaos

dmux/tmux session management, git worktree isolation, swarm workflows with JSON manifests, and Claude's native worktree backend keep parallel agent runs reproducibly separated. No more agents stomping on each other's file changes.

Execution Tiers: Choose Your Sandboxing Level

trusted_local for known-safe operations, local_sandbox for standard isolation, and remote_sandbox (Daytona/E2B) for maximum containment—all with policy-driven routing and provider override capabilities.

Evidence Pipelines: Machine-Verifiable Proof

Browser e2e, API e2e, and smart-contract e2e harnesses generate manifest evidence with auth checks and PR preflight gates. Your CI doesn't just pass—it proves it passed.

Local-First Security: Zero Trust by Default

Zero external CI by default. No secrets in config—environment-driven credentials only. TTL approval tokens for any remote execution. This is security architecture, not security theater.

Use Cases: Where LACP Transforms Your Workflow

1. Harden Local Agent Usage in Under 5 Minutes

The fastest win: bootstrap complete policy governance before your first agent command. Teams running claude or codex directly in their terminal are flying blind. LACP's starter profile gives you deterministic gates immediately.

lacp bootstrap-system --profile starter --with-verify
lacp adopt-local --json | jq
lacp posture --strict

This three-command sequence installs dependencies, scaffolds directories, wires your Obsidian vault, produces verification artifacts, and makes all future agent invocations route through LACP policy gates. The --strict posture locks down to maximum paranoia mode.

2. Run Risky Commands with Explicit Policy Controls

Dependency updates are classic foot-guns. You're pulling unknown code, running arbitrary post-install scripts, hoping tests pass. LACP wraps this in explicit contract validation:

lacp run \
  --task "dependency update with tests" \
  --repo-trust trusted \
  --context-profile default \
  -- pnpm up && pnpm test

The --repo-trust trusted flag declares your confidence level. The --context-profile default validates you're in an approved working environment. And if this command classifies as review or critical tier based on your policy, LACP blocks execution until explicit approval—no more accidental npm update disasters.

3. Generate PR-Ready Evidence Before Opening a PR

Modern code review demands proof. LACP's evidence pipelines generate machine-verifiable artifacts that attach to your PR as first-class citizens:

lacp e2e smoke --workdir . --init-template --command "npx playwright test --grep @smoke"
lacp api-e2e smoke --workdir . --init-template --command "npx schemathesis run --checks all"
lacp pr-preflight --changed-files ./changed-files.txt --checks-json ./checks.json

Browser tests, API contract tests, and custom checks all produce manifest evidence with structured pass/fail status. Your reviewers don't trust your word—they verify your artifacts.

4. Run Parallel Agents Safely on Isolated Worktrees

Multi-agent workflows are where most tools fall apart. LACP uses git worktree isolation and dmux session management to keep parallel agents in strictly separated sandboxes:

lacp worktree create --repo-root . --name feature-a --base HEAD
lacp up --session feature-a --instances 3 --command "claude"
lacp swarm launch --manifest ./swarm.json

Three Claude instances, same repository, zero file system conflicts. The worktree feature-a operates on its own branch checkout. The swarm manifest orchestrates batch execution across your agent fleet. And every instance's output is separately logged and auditable.

Step-by-Step Installation & Setup Guide

LACP supports multiple installation paths depending on your security requirements and update preferences.

Prerequisites

Required	Recommended
`bash`, `python3`, `jq`, `rg` (ripgrep)	`shellcheck`, `tmux`, `gh`

The installer auto-detects missing dependencies on macOS via Homebrew.

Method 1: Homebrew (Recommended for Most Users)

# Add the tap and install stable release
brew tap 0xNyk/lacp
brew install lacp            # stable v0.3.0

# Or track bleeding-edge main branch
brew install --HEAD lacp

Homebrew handles dependency resolution, version management, and clean upgrades automatically.

Method 2: cURL Bootstrap (Fastest)

curl -fsSL https://raw.githubusercontent.com/0xNyk/lacp/main/install.sh | bash

This one-liner downloads and executes the latest installer directly. Ideal for CI environments and quick testing, though verify the script contents in security-sensitive contexts.

Method 3: Verified Release (Production Recommended)

VERSION="0.3.0"

# Download release archive and checksums
curl -fsSLO "https://github.com/0xNyk/lacp/releases/download/v${VERSION}/lacp-${VERSION}.tar.gz"
curl -fsSLO "https://github.com/0xNyk/lacp/releases/download/v${VERSION}/SHA256SUMS"

# Cryptographically verify integrity
grep "lacp-${VERSION}.tar.gz" SHA256SUMS | shasum -a 256 -c -

# Extract and install with verification
tar -xzf "lacp-${VERSION}.tar.gz" && cd "lacp-${VERSION}"
bin/lacp-install --profile starter --with-verify

This method provides supply-chain security through checksum verification—critical for production deployments.

Post-Installation Bootstrap

Regardless of install method, run the system bootstrap to complete setup:

lacp bootstrap-system --profile starter --with-verify
lacp doctor --json | jq '.ok,.summary'

The bootstrap creates your .env file, installs remaining dependencies, scaffolds directory structure, wires your Obsidian vault, and produces initial verification artifacts. The doctor command confirms everything is healthy.

First Gated Command

Test your installation with a simple routed command:

# Route through LACP policy gates
lacp run --task "hello world" --repo-trust trusted -- echo "LACP is working"

# Make claude/codex/hermes default to LACP routing (reversible)
lacp adopt-local --json | jq

The adopt-local command is reversible—it installs wrapper scripts that transparently route agent invocations through LACP without modifying your original installations.

REAL Code Examples: LACP in Action

Let's examine actual code patterns from the LACP repository, with detailed explanations of how each works in practice.

Example 1: Bootstrap and System Verification

# One-command system initialization with verification
lacp bootstrap-system --profile starter --with-verify

# Structured health check with JSON output for programmatic use
lacp doctor --json | jq '.ok,.summary'

Before: This is your entry point. The bootstrap-system command with --profile starter applies a pre-configured policy baseline designed for individual developers getting started. The --with-verify flag is crucial—it doesn't just install; it proves the installation worked by running verification artifacts.

After: The doctor --json command outputs structured diagnostics that you can pipe to jq for automated health monitoring. The .ok field gives a boolean go/no-go status. The .summary provides human-readable context. This pattern enables infrastructure-as-code health checks in your dotfiles or CI pipelines.

Example 2: Policy-Gated Single Command Execution

lacp run \
  --task "dependency update with tests" \
  --repo-trust trusted \
  --context-profile default \
  -- pnpm up && pnpm test

Before: The lacp run command is the workhorse of daily operation. Every parameter here serves a governance purpose. --task provides a semantic description used in audit logs. --repo-trust trusted declares your repository trust assessment, which policy maps to allowed risk tiers. --context-profile default loads a predefined context contract validating your host, working directory, and git state.

After: The -- separator is critical syntax—it distinguishes LACP's own flags from the command being governed. Everything after -- is the payload command that LACP will execute only after all policy gates pass. If pnpm up triggers a network fetch that your policy classifies as review tier, execution pauses for explicit approval. If your API budget ceiling is exceeded, it's blocked entirely. And the full execution, including any approval chain, is logged to your evidence manifest.

Example 3: 5-Layer Memory Stack Initialization

# Initialize all five memory layers with JSON status output
lacp brain-stack init --json | jq

# Ingest external content into structured knowledge
lacp brain-ingest --url "https://..." --apply --json | jq

# Run full memory expansion and consolidation loop
lacp brain-expand --apply --json | jq

Before: This three-command sequence demonstrates LACP's knowledge management capabilities. The brain-stack init command bootstraps all five memory layers: session scaffolding, Obsidian vault, ingestion pipeline, GitNexus code intelligence, and agent identity with provenance chain.

After: brain-ingest converts arbitrary content—documentation, conference talks, research papers—into structured Obsidian notes with automatic linking. The --apply flag commits changes rather than dry-running. brain-expand triggers the mycelium-inspired consolidation process, strengthening knowledge connections and pruning obsolete information. The consistent --json | jq pattern enables pipeline integration with your existing automation.

Example 4: Multi-Agent Session Launch with Worktree Isolation

# Create isolated git worktree for feature development
lacp worktree create --repo-root . --name feature-a --base HEAD

# Launch 3 Claude instances in dmux-managed session
lacp up --session feature-a --instances 3 --command "claude"

# Execute batch workflow across agent swarm
lacp swarm launch --manifest ./swarm.json

Before: This pattern solves the parallel agent coordination problem. worktree create generates a completely separate working directory with its own git metadata, branched from HEAD. Unlike git clone, this shares the object database for efficiency while maintaining filesystem isolation.

After: lacp up launches multiple agent instances under a named session, managed through dmux/tmux for terminal multiplexing. The --instances 3 flag creates your agent fleet. Finally, swarm launch reads a JSON manifest defining task distribution across your fleet—enabling map-reduce style agent workflows with automatic result aggregation. Each instance's output is separately logged, and cross-instance contamination is structurally impossible.

Example 5: Evidence Pipeline for PR Preflight

# Generate browser E2E evidence with template initialization
lacp e2e smoke --workdir . --init-template --command "npx playwright test --grep @smoke"

# Generate API contract test evidence
lacp api-e2e smoke --workdir . --init-template --command "npx schemathesis run --checks all"

# Evaluate all evidence against PR policy gates
lacp pr-preflight --changed-files ./changed-files.txt --checks-json ./checks.json

Before: The e2e and api-e2e commands wrap your existing test infrastructure in evidence generation. The --init-template flag is particularly useful for first-time setup—it creates the configuration scaffolding your project needs.

After: Each command produces a manifest evidence file with structured pass/fail status, execution logs, and cryptographic checksums. The pr-preflight command ingests these manifests alongside your changed files list, evaluating whether all policy gates are satisfied for PR approval. This transforms "trust me, I tested it" into cryptographically verifiable proof that your CI can enforce automatically.

Advanced Usage & Best Practices

Profile Strategy: Start Balanced, Harden Gradually

LACP provides four hook profiles—minimal-stop, balanced, hardened-exec, and quality-gate-v2. Start with balanced for daily development. Apply hardened-exec for production-adjacent work. The quality-gate-v2 profile enables local LLM rationalization detection—catching when your agent is making up explanations for buggy code.

lacp claude-hooks apply-profile balanced        # Default development
lacp claude-hooks apply-profile hardened-exec   # Production work

Context Profile Templates for Team Consistency

Define reusable context contracts for different project types:

lacp context-profile create --name webapp --template node18 --budget-daily 10.00
lacp context-profile create --name smart-contract --template foundry --budget-daily 50.00 --risk-tier critical

This ensures every team member operates under identical constraints, eliminating "works on my machine" policy variations.

Memory Quality Automation

Schedule regular brain maintenance:

# Cron job for nightly memory consolidation
0 2 * * * lacp brain-expand --apply --json >> /var/log/lacp-brain.log 2>&1

# Weekly health check with alert on failure
0 9 * * 1 lacp brain-doctor --json | jq -e '.ok' || alert-pagerduty "LACP brain degraded"

Budget Gate Tuning

Set tier-specific ceilings to prevent surprise API bills:

# In your sandbox-policy.json
{
  "budgets": {
    "safe": { "daily_usd": 5.00, "monthly_usd": 50.00 },
    "review": { "daily_usd": 25.00, "monthly_usd": 200.00 },
    "critical": { "daily_usd": 100.00, "monthly_usd": 500.00, "require_approval": true }
  }
}

Comparison with Alternatives

Capability	LACP	Raw Claude/Codex	Aider	Continue.dev
Policy-gated execution	✅ Native	❌ None	⚠️ Limited	❌ None
Risk tier classification	✅ 3-tier with budget gates	❌	❌	❌
Cryptographic provenance	✅ SHA-256 chain	❌	❌	❌
5-layer memory system	✅ Full implementation	❌ Session only	❌	❌
Multi-agent orchestration	✅ Worktree + swarm	❌	❌	❌
Evidence pipelines	✅ E2E/API/contract	❌	❌	❌
Local-first, zero cloud	✅ By design	⚠️ Requires API	✅	⚠️ Optional cloud
Claude Code hooks	✅ 4-hook pipeline	❌	❌	❌
Mycelium memory model	✅ Biologically inspired	❌	❌	❌
Open source (MIT)	✅	❌	✅	✅

Why LACP wins: No alternative combines governance, memory, orchestration, and evidence in a local-first package. Raw agents offer speed without safety. Aider and Continue.dev focus on code generation, not execution governance. LACP is the only option when you need auditable, policy-compliant agent operations.

FAQ: Your Burning Questions Answered

Is LACP stable enough for production use?

LACP is at alpha v0.9.0 with active development. Core features—native REPL, multi-provider routing, memory system, hook pipeline—are functional but evolving. The project follows semantic versioning with clear release checklists. For production, pin to verified releases and test thoroughly in your environment.

Does LACP replace Claude, Codex, or Hermes?

No—LACP wraps and governs them. The lacp adopt-local command installs reversible routing wrappers. Your existing agent installations remain untouched. LACP intercepts invocations, applies policy gates, then dispatches to the underlying agent. Remove LACP anytime with no agent reconfiguration needed.

How does LACP handle secrets and credentials?

Environment-driven only. No secrets in repository config. The .env file is gitignored by default. For remote execution, TTL approval tokens limit exposure window. Set LACP_NO_EXTERNAL_CI=true and LACP_ALLOW_EXTERNAL_REMOTE=false for maximum paranoia.

Can I use LACP without Obsidian?

Yes, though you'll lose the knowledge graph layer. The session memory, ingestion pipeline, and agent identity layers function independently. Obsidian integration is first-class but optional—configure in config/obsidian/ or skip entirely.

What operating systems does LACP support?

Currently macOS with full dependency auto-installation. Linux support is functional with manual dependency installation. Windows requires WSL2. The system-health command validates your workstation readiness.

How do I contribute or report issues?

See CONTRIBUTING.md for guidelines and SECURITY.md for vulnerability disclosure. Active discussion happens in GitHub issues.

Is there commercial support available?

The creator operates Builderz, which ships production AI systems and can provide enterprise LACP deployment support. The open-source project itself remains MIT-licensed and community-driven.

Conclusion: The Agent Infrastructure You Didn't Know You Needed

Here's my honest assessment: LACP is the most thoughtfully architected agent governance system I've encountered. It doesn't chase the hype of "10x developer productivity" with reckless automation. Instead, it asks a harder question: how do we make agent assistance actually trustworthy?

The answer—policy gates, cryptographic provenance, layered memory, evidence pipelines—reflects infrastructure thinking that most AI tooling lacks entirely. This is control-plane engineering applied to agent execution, and it's exactly what teams need as they scale from "experimenting with Claude" to "running agent fleets on production codebases."

Is it perfect? No. Alpha software never is. The APIs will shift. Some features are evolving fast. But the core architectural decisions—local-first, harness-separated-from-control-plane, auditable-by-default—are sound and increasingly necessary.

If you're running AI agents without governance, you're accumulating technical debt in the form of unmeasured risk. LACP is your path to measured, managed, auditable agent operations.

Get started now:

brew tap 0xNyk/lacp && brew install lacp
lacp bootstrap-system --profile starter --with-verify

Then dive into the full documentation, star the repository to follow development, and join the growing community of developers who refuse to let autonomous code run without adult supervision.

Your future self—debugging that 3 AM production incident—will thank you.