Bigwave

BigwaveThe open-source agent harness.

Self-hosted infrastructure that makes autonomous AI agents reliable, accountable, and productive in production. Tool orchestration, validation loops, deterministic guardrails, error recovery, audit-defensible accountability, binding deployment gate. Harness engineering, dual-licensed (MIT OR Apache-2.0).

🔧

Tool orchestration

Define available tools, scope permissions per workspace, govern how agents invoke them. OpenAI-compatible tool-calling API + MCP client roadmap. Agents talk to your tools, not to ours.

🛡️

Deterministic guardrails

Rules that prevent harmful actions before the model can take them. DSL provider with regex / deny / allow / rewrite / warn semantics. Block decisions short-circuit chat with OpenAI-shape `finish_reason="content_filter"`.

🔁

Validation loops

Eval-as-a-gate refuses regressed deploys at the activation layer. Trajectory-match, hallucination probes, jailbreak resistance. The harness binds — a regressed agent literally cannot ship.

🩹

Error recovery + self-healing

Fallback chain on pre-stream failure. Drain-and-swap rollback semantics on activation. The closed feedback path turns "agent shipped a bug" into "feedback → DPO → corrected model" automatically.

📋

Accountability built in

Workspace-scoped append-only audit log of every action. Every dataset, every training submit, every gate decision, every channel mutation — attributable, replayable, signed off. The accountability rail of the harness.

🏛️

Self-hosted + MIT OR Apache-2.0

Every byte stays in your VPC. Sandboxing is the next load-bearing piece (gap-to-close); everything else is shipped. License-check CI enforces the GPL/AGPL gate. Your security team signs off without lawyering the license.

The eight harness-engineering primitives

What separates "an LLM that can call tools" from "an agent that can ship work without supervision":

Primitive	Status	Where
Tool orchestration — defining tools, permissions, invocation rules	shipped (gateway dispatch); MCP client on roadmap	`packages/gateway/`
Deterministic guardrails — rules that prevent harmful actions	shipped (DSL provider)	`packages/guardrails/`
Validation loops — eval-as-a-gate, trajectory-match, hallucination probes	shipped (gate + scorer ABCs); trajectory + probe scorers on roadmap	`packages/eval/`
Error recovery — fallback chains, automatic retries, rollback	shipped (`chat_with_fallback`, drain-and-swap)	`packages/gateway/`, `packages/serving/`
Self-verification — gate refuses regressed deploys, the harness binds	shipped (`EvalGate` returns 422 on `GateBlock`)	`packages/eval/gate.py`
Accountability — every action logged, attributable, replayable	shipped (`AuditLogRepository`, append-only)	`packages/shared/audit.py`
Tenant isolation — agents can't read/write outside their workspace	shipped (workspace fence; cross-tenant returns 404)	every repository
Sandboxing — isolated execution for code-running agents	not shipped — gap to close	sandbox runtime + long-running agent state

Primitive

Status

Where

Tool orchestration — defining tools, permissions, invocation rules

shipped (gateway dispatch); MCP client on roadmap

packages/gateway/

Deterministic guardrails — rules that prevent harmful actions

shipped (DSL provider)

packages/guardrails/

Validation loops — eval-as-a-gate, trajectory-match, hallucination probes

shipped (gate + scorer ABCs); trajectory + probe scorers on roadmap

packages/eval/

Error recovery — fallback chains, automatic retries, rollback

shipped (chat_with_fallback, drain-and-swap)

packages/gateway/, packages/serving/

Self-verification — gate refuses regressed deploys, the harness binds

shipped (EvalGate returns 422 on GateBlock)

packages/eval/gate.py

Accountability — every action logged, attributable, replayable

shipped (AuditLogRepository, append-only)

packages/shared/audit.py

Tenant isolation — agents can't read/write outside their workspace

shipped (workspace fence; cross-tenant returns 404)

every repository

Sandboxing — isolated execution for code-running agents

not shipped — gap to close

sandbox runtime + long-running agent state

The first seven are production-ready today. Sandboxing is the load-bearing missing piece between "harness-adjacent" and "the agent harness." Closing it is the highest-leverage post-Day-60 product priority.

The substrate the harness rides on

Beyond the harness primitives, Bigwave includes the full LLMOps stack the agents need:

An OpenAI-compatible /v1/chat/completions API your existing client code talks to without changes.

A workspace-scoped append-only audit log recording every mutation — dataset upload, training submit, adapter activation, channel rotate, gate decision.

Eval-as-a-gate wired into adapter activation; a GateBlock decision returns 422 with the gate's reason and the old handle is preserved (rollback semantics).

Drain-and-swap adapter activation with no dropped streams.

Per-workspace token-bucket rate limiting.

DSL guardrails (regex / deny / allow / rewrite / warn) that short-circuit chat with OpenAI-shape finish_reason="content_filter".

Telegram + Slack channel adapters with reaction → feedback translation.

Phoenix observability when you want it; stdout NDJSON by default.

Postgres backend when you outgrow SQLite.

proxy_headers auth so oauth2-proxy / Authelia / Keycloak Gatekeeper can sit in front.

Where to start

If you want to…	Read
Try Bigwave end-to-end on a laptop	Getting started →
Fine-tune on production data without it leaving your VPC	Compliance use case →
Power an internal Cursor / Continue with Bigwave	Coding-assistant use case →
Catch agent regressions before they ship	Agent eval use case →
Tune your support model on your brand voice	Support tone use case →
Understand the architecture	Concepts → the loop
Plan a production deploy	Deploy guide →

If you want to…

Read

Try Bigwave end-to-end on a laptop

Getting started →

Fine-tune on production data without it leaving your VPC

Compliance use case →

Power an internal Cursor / Continue with Bigwave

Coding-assistant use case →

Catch agent regressions before they ship

Agent eval use case →

Tune your support model on your brand voice

Support tone use case →