caliban-ai

caliban-ai is a small constellation of Rust projects for running AI agents on your own terms:

• caliban — the agent harness: provider-agnostic, local-first, driven from a TUI or headless.
• prospero — the control plane that launches, manages, and observes fleets of caliban agents across repositories.
• gonzalo — the shareable persistence layer: versioned records over pluggable stores, plus vector search and a code graph.
• ariel — the chat bridge that brings the fleet into Discord, with Slack and Teams to follow.
• caliban-operator — the Kubernetes operator that runs agents as sandboxed pods.

How they fit together

Discord / Slack / Teams
        │
      ariel ──── HTTP + SSE ───▶ prospero ── NDJSON ──▶ caliband ─▶ caliban agents
        │                           │                        ▲
        │                           │ CalibanTask CRs         │ sandboxed pods
        │                           ▼                        │
        │                    caliban-operator ───────────────┘
        │                           │
        └──────── records ───────▶ gonzalo ◀──── memory, sessions

Each project couples to its neighbours only through a public wire format or API, never through another project's crates, so each can be run and released on its own.

Running the suite

• Kubernetes: the helm-charts repo packages the operator, prospero, gonzalo, and ariel.
• Docker Compose: the docker-compose repo is a self-host stack for a single machine.

See Development Updates for board-review progress reports.

caliban

A from-scratch Rust agent harness that puts the operator in control of model routing, memory, skills, and prompt context.

• Site: https://caliban-ai.github.io/caliban/
• Repo: https://github.com/caliban-ai/caliban
• Issues: https://github.com/caliban-ai/caliban/issues
• Board: https://github.com/orgs/caliban-ai/projects/1

caliban is daily-usable on main. The binary speaks to Anthropic, OpenAI, and Google Gemini through one internal representation. Bedrock, Vertex, and Azure adapters are available through the library. You can drive it from a ratatui TUI, headless --print mode, or as an ACP, HTTP, or MCP server. Sessions, checkpoints and forking, auto-memory, sub-agents, a background agent fleet, hooks, skills, permissions, and an OS sandbox all ship today. Recent releases gave the agent loop model-adaptive turn, time, and cost budgets, and folded configuration into one layered settings system with provenance, so router config and CALIBAN_* environment overrides no longer sit outside it. Its per-repo supervisor daemon, caliband, is what prospero orchestrates.

The full user guide, architecture decisions, and API reference live on the project site.

prospero

The agent orchestration control plane for caliban: launch, manage, and observe fleets of agents across repositories.

• Site: https://caliban-ai.github.io/prospero/
• Repo: https://github.com/caliban-ai/prospero
• Issues: https://github.com/caliban-ai/prospero/issues
• Board: https://github.com/orgs/caliban-ai/projects/1

prospero sits above many per-repo caliband daemons. The prosperod daemon serves a REST + SSE API and a dashboard, secured by scoped API tokens. Every route but the probes is guarded by named API tokens carrying a read, operate, or admin scope, and the dashboard signs in with one. Through it you spawn agents (in isolated git worktrees by default), kill, respawn, and remove them, and follow their normalized event streams live. Those events are also persisted, so history outlives the agent. On Kubernetes it reports each agent's lifecycle back to caliban-operator by writing a condition on the CalibanTask. prospero couples to caliban only through caliban's NDJSON wire format, and its public HTTP API is what ariel builds on.

The full guide, architecture decisions, and API reference live on the project site.

gonzalo

A robust, shareable persistence layer for caliban.

• Site: https://caliban-ai.github.io/gonzalo/
• Repo: https://github.com/caliban-ai/gonzalo
• Issues: https://github.com/caliban-ai/gonzalo/issues
• Board: https://github.com/orgs/caliban-ai/projects/1

gonzalo lifts caliban's local-first state (memory tiers, auto-memory topics, sessions, and checkpoints) into a layer many systems and contributors can share. A versioned, conflict-aware Record/Store core sits over pluggable substrates: filesystem, git, S3-compatible object storage, or a remote daemon. Capability layers add vector search that persists across the process that built it, a tree-sitter code graph with an MCP server, a knowledge store, and normalized ticket connectors for GitHub, Jira, Linear, GitLab, and Asana. The gonzalod daemon serves all of it over gRPC and HTTP/JSON. gonzalo also holds ariel's identity, channel configuration, and audit records.

The full guide, architecture decisions, and API reference live on the project site.

ariel

The chat bridge for the caliban fleet: notifications, commands, approvals, and conversation in Discord, Slack, and Teams.

• Site: https://caliban-ai.github.io/ariel/
• Repo: https://github.com/caliban-ai/ariel
• Issues: https://github.com/caliban-ai/ariel/issues
• Board: https://github.com/orgs/caliban-ai/projects/1

In The Tempest, Ariel is the spirit Prospero sends to carry messages. Here it carries them between people in chat and the fleet that prospero runs.

ariel is a standalone service, arield, that keeps chat-platform SDKs, OAuth, signature verification, and rate limiting behind one boundary. All fleet control and events flow through prospero's public HTTP + SSE API. Identity, role grants, channel configuration, and the audit trail are gonzalo records, so ariel stores nothing of its own. Chat platforms sit behind a single ChatProvider trait, and each backend is a feature-gated crate.

The bridge is built in four layers, each shippable on its own: notifications, ChatOps slash commands, approvals, and full conversational sessions. Commands are authorized on two keys, a person's role and a ceiling set on the channel, and the lower of the two wins.

Status: released and running. Every release is the multi-arch container image ghcr.io/caliban-ai/ariel.

Working today, on Discord:

• Notifications. One live message per agent, edited in place and paced against the platform's budget, in every channel that follows that agent's workspace.
• ChatOps. Eight /ariel commands: link, status, spawn, kill, respawn, channel, configure, and invite, so fleet control and channel administration both happen in chat.
• Authorization and audit. Every command is authorized on the person's role and the channel's ceiling, and audited in gonzalo. Nobody can invite above the role they act with.
• Operations. Channel configuration is picked up while the daemon runs, and arield speaks TLS, so it can reach a prosperod through an ingress.

Still to come: approvals with buttons, a chat thread as a full agent session, and the Slack and Teams backends.

The guide, architecture decisions, and API reference live on the project site.

caliban-operator

The Kubernetes operator for caliban agent workloads: a CalibanTask CRD composed with agent-sandbox.

• Site: https://caliban-ai.github.io/caliban-operator/
• Repo: https://github.com/caliban-ai/caliban-operator
• Issues: https://github.com/caliban-ai/caliban-operator/issues
• Board: https://github.com/orgs/caliban-ai/projects/1

Written in Rust on kube-rs, the operator composes the Kubernetes SIG agent-sandbox project and reconciles a Workspace + CalibanTask pair of custom resources into a sandboxed agent pod.

A namespaced Workspace holds the durable config: git sources and named model providers, each able to name a Secret. The operator is the sole reader of those Secret values, so prospero only ever handles a reference by name. A CalibanTask points at a Workspace, and the provider it resolves is pinned into its status at admission, so a running task's config cannot shift underneath it. The operator owns the sandbox pod lifecycle, RBAC, and NetworkPolicy; live agent streaming goes straight to caliband instead of through the operator.

The CRDs and their reconcile loops are implemented.

The full guide, architecture decisions, and API reference live on the project site.

Development Updates

Progress reports drafted at each Kanban board review. Each post summarizes what landed since the previous review, plus current backlog shape.

Reviews

• 2026-07-05 — Board review
• 2026-06-15 — Progress since the board was established

Newest posts also appear in the sidebar under Updates.

Board review — 2026-07-05

First review since the pipeline moved to archiving Done cards off the board. Counts below are distinct issues; the "landed" figure is a catch-up total since the 2026-06-15 review, so it reads as a milestone summary rather than a two-week diff. Per-repo detail now lives in each project's changelog (newly published to its site — see below).

Snapshot

• Open items tracked: 117
• Backlog: 115
• In progress: 2
• In review: 0

By project

Landed since last review (186 issues)

caliban shipped 0.5.0. The headline release turns caliban from a single-process CLI into the base of a distributed, self-hostable agent supervisor: caliband gains a networked control plane (gRPC/TLS transport, workspace-scoped multi-repo supervision), config/data relocate to XDG-first locations, caliban consumes gonzalo's code-graph over MCP, and a broad reliability + OAuth + security-hardening pass lands (compaction correctness, model-router circuit breakers, permission/sandbox fencing, atomic file writes). See the changelog for the full list and the upgrade notes.

Kubernetes deployment (epic caliban#274) came together end to end. Two new repos were stood up — caliban-operator (kube-rs operator + CalibanTask CRD, reconciling to agent-sandbox) and helm-charts (umbrella chart with a live k3s integration gate). Multi-arch, non-root container images now publish to GHCR for caliban, gonzalo, and prospero, all built on native arm64 runners (QEMU dropped).

gonzalo advanced the code-graph capability and its HA service. Language breadth landed across Python, JS/TS, Go, Java, C#, and C/C++ grammars behind a crash-isolated parser pool; a persistent SQLite GraphStore backs path-agnostic slices, impact queries, and graph diffing, exposed over gRPC/HTTP and the gonzalo-mcp server. The storage foundation (content-addressed slice store, manifest sync, mark-sweep GC, incremental git-diff sync) and the gonzalod service (health/readiness probes, fs|s3 substrate selection) shipped alongside its 0.1.0 container image.

prospero reached its first release. The control plane gained a FleetProvider seam with Local and K8sFleet backends (CRUD + watch over CalibanTask), workspace-scoped caliband discovery, and a network transport dialing caliband over TCP+TLS — plus a sweep of clustered-mode correctness fixes (failover, cross-replica registry propagation, per-stream sequencing, event de-duplication). Published as 0.1.0 with its own container image and Helm chart.

Docs pipeline: each project now publishes its CHANGELOG.md to its Pages site, and this board-review generator was reworked to source "what landed" from closed issues (archiving-proof) rather than the board's Done column.

Backlog by kind

• kind/bug: 1
• kind/cleanup: 11
• kind/design: 3
• kind/documentation: 8
• kind/epic: 16
• kind/feature: 54
• kind/flake: 1

Progress since the board was established

The caliban-ai Kanban board (Project #1) launched 2026-06-06. This inaugural development update summarizes completed work across caliban, prospero, and gonzalo. Auto-drafted from the board, then edited; counts below reflect distinct issues — each issue's implementing PRs are tracked separately on the board and omitted here to avoid double-counting.

Snapshot (issues)

• Issues tracked: 129
• Completed: 41
• Backlog: 88

By project (issues)

Completed work

caliban

• #8 /tui: fullscreen alternate-screen toggle (kind/feature)
• #13 Flip eligible slash commands to immediate:true (kind/cleanup)
• #26 Add --debug-file flag (kind/feature)
• #27 --verbose headless flag for full tool I/O (—)
• #41 Fix flaky hooks_shell.rs stdout-drain race (kind/bug)
• #55 Permission "always allow" at project/user/local scope does not apply to the live session (re-prompts until restart) (kind/bug)
• #56 Loaded skills are never proactively invoked — model improvises instead of using a matching skill (kind/feature)
• #58 Permission Ask modal (and always-allow sub-prompt) clip the action row when input/pattern are long — Deny option hidden (kind/bug)
• #60 Ollama: detect real context window from /api/ps (context_length) instead of a static 32K fallback (kind/feature)
• #65 Set up test coverage tracking (local + CI) with a minimum-coverage gate (kind/feature)
• #68 Raise test coverage to 85% and bump the COVERAGE_MIN gate (kind/cleanup)
• #69 Flaky: caliban-images strict_routing_* tests race on CALIBAN_STRICT_ROUTING env var (kind/bug)
• #71 caliband daemon Spawn registers agents but never launches a worker (agents stuck in Spawning) (kind/bug)
• #75 Background sub-agent workers run unguarded — apply tool_allowlist + permission policy (kind/feature)
• #76 Rm --force on a Running agent orphans the worker process (should SIGTERM) (kind/bug)
• #77 Per-agent socket file is left on disk after Kill/Rm/worker-exit (kind/cleanup)
• #78 Derive Serialize on TurnEvent for full-fidelity worker event stream (kind/feature)
• #79 Live attach protocol: history replay + live TurnEvent streaming + inbound messages + agents attach client (kind/feature)
• #81 Inbound user messages to a running sub-agent (idle/await-input) — needs agent-core support + ADR 0037 amendment (kind/feature)
• #84 Serialize parent hook config into SpawnSpec for inherit_hooks=true (full hook inheritance) (kind/feature)
• #88 Flaky test: caliban-images strict_routing_default_is_strict races on CALIBAN_STRICT_ROUTING env var (kind/flake)
• #93 Daemon-spawned workers can't select a provider (SpawnSpec has no provider; CALIBAN_PROVIDER ignored) (kind/feature)
• #97 docs: remove resolved ADR conformance audit + make ADR citations self-sustaining (kind/documentation)
• #100 feat(model-router): user-facing extended-thinking toggle independent of effort (kind/feature)
• #106 feat(tools): SessionStart context-injection hook surface (kind/feature)
• #107 fix(tools): warn instead of silently skipping skills whose name mismatches their directory (kind/bug)
• #109 design(labels): agree a shared label taxonomy across caliban/gonzalo/prospero (kind/design)
• #112 fix(slash-commands): /memory delete should not be immediate (silent, unconfirmed data loss) (kind/bug)
• #121 feat(hooks): execute config-defined [[hooks.*]] handlers at runtime (kind/feature)
• #125 docs(adr): adopt docs/adr/ convention to match prospero + gonzalo (kind/cleanup)

gonzalo

• #3 Structured-body merge (currently returns NeedsResolution) (kind/feature)
• #15 design: ticket-system capability layer over Record/Store core (kind/design)
• #16 design: knowledge-store capability over vector + domain layers (kind/design)
• #20 test(ticket): TicketSource conformance suite keyed on policy variants (kind/feature)
• #19 feat(ticket): provider connectors (GitHub, Jira, Linear, GitLab, Asana) (kind/feature)

prospero

• #12 Set up test coverage tracking (local + CI) with a minimum-coverage gate (kind/feature)
• #13 Raise test coverage to 85% and bump the coverage gate (kind/cleanup)
• #19 docs(adr): adopt ADR practice under docs/adr/####-topic.md (kind/documentation)
• #28 fix(api): SSE silently drops lagged events with no gap signal to the client (kind/bug)
• #27 feat(cli): expose --tool-allowlist on spawn (kind/feature)
• #30 docs(adr): convert ADRs from Nygard to MADR-lite for sibling parity (kind/cleanup)

Backlog by kind

• kind/bug: 8
• kind/cleanup: 9
• kind/epic: 10
• kind/feature: 42