Lifecycle infrastructure for the external effects of autonomous agents.
Agents can create branches, deployments, credentials, routes, databases, and other durable provider state. Stopping the agent does not stop those effects. Talos gives each managed effect a durable owner, lifecycle policy, cleanup plan, and verification evidence so an independent controller can reconcile it when the owning goal ends, fails, is stopped, or disappears.
When an agent dies, nothing it created should outlive its purpose by accident.
Status: early stage. Talos currently proves the lifecycle model end to end for two providers — GitHub branches and pull requests, Cloudflare Worker scripts and routes — by deliberate design: a narrow, correct implementation before breadth. Interfaces will change.
Watch the demo video — a Pi coding
agent creates a preview environment, its process is killed mid-task, and the
independent Talos daemon reconciles the goal's external footprint and
produces a durable receipt. Fully deterministic, rendered with
Remotion; source in apps/demo-video.
Talos attaches external effects to the goal that caused them. When that goal ends—or simply disappears—an independent controller decides what must remain, what can be safely removed, and what needs human review.
flowchart LR
Goal["Agent goal"] -->|creates through managed tools| Effects["External effects<br/>branch · pull request · Worker · route · capability"]
Goal -->|completes · crashes · is stopped| Terminal["Goal ends"]
Effects -->|ownership · lease · dependencies| Plan["Talos terminal plan"]
Terminal --> Plan
Plan --> Retain["Retain or transfer<br/>declared outputs"]
Plan --> Revoke["Revoke<br/>remaining authority"]
Plan --> Reconcile["Reconcile<br/>temporary resources"]
Plan --> Quarantine["Quarantine<br/>ambiguous or unsafe state"]
Retain --> Verify["Re-read provider state<br/>and verify postconditions"]
Revoke --> Verify
Reconcile --> Verify
Quarantine --> Review["Operator review"]
Review --> Plan
Verify --> Receipt["Durable receipt<br/>what remains and why"]
The agent creates effects while it is alive; it is not trusted to clean up or certify them after it dies. Talos persists intent before provider mutation, treats uncertain writes as ambiguous, and keeps reconciliation running in a separate project daemon. A timeout is discovered before retry, destructive work is fenced against stale workers, and cleanup is not complete until a fresh provider read proves the postconditions.
An agent deploys a preview. It creates a GitHub branch and a Cloudflare Worker, then its process is killed before it can report success.
Talos records the operation intents before those provider calls. Its controller later discovers the branch and Worker, attaches them to the goal, builds the terminal plan, deletes only the explicitly owned temporary resources, re-reads both providers, and records a closure receipt only after absence is verified. The pull request and any dependency it still requires are retained or transferred, while the temporary Worker is removed—retention and cleanup are separate lifecycle decisions, not one "delete everything" sweep.
Shared resources, capability revocation, cleanup, and verification are likewise separate decisions. An expired lease is never an instruction to delete immediately.
The daemon runs per project, stores its state under .talos/, and only acts
within the exact scopes you grant during setup.
bun install
# start (or reuse) the project daemon and print its status
bun run talos ensure --project /path/to/project
# grant provider scopes interactively: connections, repository,
# branch prefix, Cloudflare account, Worker prefix, optional zone routes
bun run talos:tui setup --project /path/to/project
# open the operator cockpit: ownership graph, terminal plans,
# approvals, live reconciliation, closure receipts
bun run talos:tui open --project /path/to/project
bun run talos status --project /path/to/project
bun run talos stop --project /path/to/projectProvider credentials are validated by Executor and stored only in the operating-system keychain; Talos never persists them in its own configuration or SQLite state. With the Pi extension installed, each Pi session binds to a leased goal automatically: heartbeats renew the lease while the agent works, and a killed session simply stops renewing — the daemon reconciles from there.
- A provider-neutral domain model: goals, resources, ownership, leases, capabilities, finalizers, plans, evidence, receipts.
- Deterministic lifecycle state machines and planning rules, tested adversarially: retries, fencing, ambiguous writes, controller interruption, provider drift.
- In-memory and SQLite registries with append-only aggregate events, atomic commits, restart recovery, and fenced outbox work.
- A controller that sweeps goals, schedules finalizers, resolves unknown outcomes, quarantines unsafe states, and closes goals only after verified postconditions.
- Reviewed lifecycle modules for Cloudflare Workers, Worker routes, GitHub branches, and retained pull requests, all backed by one bounded Code Mode engine, plus a programmable fake provider for deterministic failure testing.
- A runtime bridge and tool gateway that record intent at the mutating tool boundary, before any provider call is dispatched.
- An Executor SDK boundary that pins each managed effect to an exact lifecycle module, scope, and connection identity by hash; missing or changed bindings fail closed.
- A thin Pi extension mapping sessions to leased goals and exposing profiled Executor mutations as native, lifecycle-managed Pi tools.
- An OpenTUI cockpit for local or SSH operation.
bun install
bun test packages/core packages/registry packages/orchestrator \
packages/daemon packages/pi-extension apps/tui
bun run check-types
bun run checkRun the cockpit against demo rendering locally with bun run dev:tui:local,
or serve it over SSH with bun run dev:tui and ssh -p 2222 localhost.
packages/core/ domain contracts, invariants, planning, state machines
packages/registry/ in-memory and SQLite lifecycle persistence
packages/orchestrator/ controller, runtime bridge, tool gateway, testing fake
packages/daemon/ HTTP boundary, controller loop, lifecycle modules
packages/pi-extension/ Pi session, heartbeat, and managed-tool integration
apps/tui/ OpenTUI operator cockpit
Lifecycle cleanup is destructive by nature. Preserve the safety invariants: no blind deletion, no deletion while a live owner remains, no mutation without fresh provider observation, and no completed cleanup without independent verification. Read AGENTS.md before changing lifecycle behavior.
Licensed under the Apache License 2.0.