LACP

Local policy, evidence, and recovery controls for coding agents.

LACP wraps Claude, Codex, Hermes, and other CLI agents with deterministic routing, approval gates, execution records, memory controls, and rollback paths. It runs on your machine and keeps remote execution opt-in.

Development status: main and the GitHub release are v0.10.1. Homebrew's last bottled release may lag until the tap is updated; brew install --HEAD tracks main. Git worktrees isolate files, not ports — see Runtime isolation.

Contents

• Quick Start
• Why teams adopt LACP
• Use-case recipes
• Documentation
• Architecture
• Features
• Prerequisites
• Install Options
• Who It's For
• Testing
• Security
• Contributing

What LACP controls

LACP is a local execution wrapper and control plane. The coding-agent host still owns its model, tools, session, and interface. LACP owns the contract around a run: where it may execute, which risk tier applies, when approval is required, what evidence must be kept, and how a failed change is recovered.

Quick start

Install

# Homebrew (recommended)
brew tap 0xNyk/lacp && brew install lacp

# or inspect and run the bootstrap at a published tag
curl -fsSLo /tmp/lacp-install.sh \
  https://raw.githubusercontent.com/0xNyk/lacp/v0.10.1/install.sh
LACP_REF=v0.10.1 bash /tmp/lacp-install.sh

Bootstrap and verify

lacp bootstrap-system --profile starter --with-verify
lacp doctor --json | jq '.ok,.summary'

After bootstrap: .env is created, dependencies installed, directories scaffolded, Obsidian vault wired, and verification artifacts produced.

For the full setup and daily operator flow, start with the Runbook and Local Dev Loop.

First gated command

# Route a task through LACP policy gates
lacp run --task "hello world" --repo-trust trusted -- echo "LACP is working"

# Make claude/codex/hermes default to LACP routing (reversible)
lacp adopt-local --json | jq

Why teams adopt LACP

• Route commands through explicit policy and budget gates.
• Keep evidence, provenance, and verification results with each run.
• Leave remote execution disabled until an operator enables it.
• Isolate parallel agents with sessions and Git worktrees.

Use-case recipes

1) Harden local agent usage in under 5 minutes

lacp bootstrap-system --profile starter --with-verify
lacp adopt-local --json | jq   # wraps claude + codex only; Hermes stays native
lacp posture --strict

2) Run one risky command with explicit policy controls

lacp run \
  --task "dependency update with tests" \
  --repo-trust trusted \
  --context-profile default \
  -- pnpm up && pnpm test

3) Generate PR-ready evidence before opening a PR

lacp e2e smoke --workdir . --init-template --command "npx playwright test --grep @smoke"
lacp api-e2e smoke --workdir . --init-template --command "npx schemathesis run --checks all"
lacp pr-preflight --changed-files ./changed-files.txt --checks-json ./checks.json

4) Run parallel agents safely on isolated worktrees

lacp worktree create --repo-root . --name feature-a --base HEAD
lacp up --session feature-a --instances 3 --command "claude"
lacp swarm launch --manifest ./swarm.json

Documentation

Project health files

• CONTRIBUTING.md - contribution and PR expectations
• SECURITY.md - vulnerability disclosure process
• CHANGELOG.md - release history
• LICENSE - MIT

Architecture

lacp/
├── bin/                    # CLI commands (lacp <command>)
│   ├── lacp                # Top-level dispatcher
│   ├── lacp-bootstrap-system
│   ├── lacp-doctor         # Diagnostics (--json, --fix-hints)
│   ├── lacp-route          # Policy-driven tier/provider routing
│   ├── lacp-sandbox-run    # Gated execution with artifact logging
│   ├── lacp-brain-*        # Memory stack (ingest, expand, doctor, stack)
│   ├── lacp-obsidian       # Vault config management
│   ├── lacp-up             # Multi-instance agent sessions
│   ├── lacp-swarm          # Batch orchestration
│   └── lacp-claude-hooks   # Hook profile management
├── config/
│   ├── sandbox-policy.json     # Routing + cost ceilings
│   ├── risk-policy-contract.json
│   ├── obsidian/               # Vault manifest + optimization profiles
│   └── harness/                # Task schemas, sandbox profiles, verification policies
├── hooks/                  # Python hook pipeline for Claude Code
├── scripts/
│   ├── ci/                 # Test suites
│   └── runners/            # Daytona/E2B execution adapters
└── docs/                   # Guides and reference docs

Control Flow

Agent invocation
  → lacp route (risk tier + provider selection)
    → context contract validation
      → budget gate check
        → session fingerprint verification
          → sandbox-run (dispatch + artifact logging)

Features

Policy-Gated Execution

Every command routes through risk tiers (safe → review → critical), budget ceilings per tier, and context contracts that validate host, working directory, git branch, and remote targets before execution.

5-Layer Memory Stack

lacp brain-stack init --json | jq          # Bootstrap all layers
lacp brain-ingest --url "https://..." --apply --json | jq
lacp brain-expand --apply --json | jq      # Full expansion loop

Hook Pipeline for Claude Code

Modular Python hooks enforcing quality at every session stage:

Profiles: minimal-stop, balanced, hardened-exec, quality-gate-v2. Apply with lacp claude-hooks apply-profile <profile>. hardened-exec also logs SubagentStart / SubagentStop. It does not install a WorktreeCreate hook (that event replaces Claude's git worktree creation).

Mycelium Network Memory

Biologically-inspired memory consolidation modeled on fungal networks:

Multi-Agent Orchestration

# dmux-style multi-instance launch
lacp up --session dev --instances 3 --command "claude"

# Git worktree isolation
lacp worktree create --repo-root . --name "feature-a" --base HEAD

# Batch swarm execution
lacp swarm launch --manifest ./swarm.json

Evidence Pipelines

Generate machine-verifiable evidence for PR gates:

lacp e2e smoke --workdir . --init-template --command "npx playwright test --grep @smoke"
lacp api-e2e smoke --workdir . --init-template --command "npx schemathesis run --checks all"
lacp contract-e2e smoke --workdir . --init-template --command "forge test -vv"
lacp pr-preflight --changed-files ./changed-files.txt --checks-json ./checks.json

Prerequisites

The installer auto-detects and installs missing dependencies on macOS via Homebrew.

Install options

Homebrew

brew tap 0xNyk/lacp
brew install lacp            # published v0.10.1 release (tap may lag)
brew install --HEAD lacp     # current main

cURL Bootstrap

curl -fsSLo /tmp/lacp-install.sh \
  https://raw.githubusercontent.com/0xNyk/lacp/v0.10.1/install.sh
LACP_REF=v0.10.1 bash /tmp/lacp-install.sh

Change both references to main only when you intend to install unreleased development code. The script also accepts --dir, --profile, and --with-verify; run it with --help before installation to see the full contract.

Who it is for

LACP is for developers who need reproducible local agent runs with explicit pass/fail gates and artifacts that can be inspected after execution.

It is a poor fit when you want a managed cloud service, a chat UI, or a setup with no local policy and configuration to maintain.

Testing

lacp test --quick       # Fast smoke tests
lacp test --isolated    # Full isolated suite
lacp doctor --json      # Structured diagnostics
lacp posture --strict   # Policy compliance check

scripts/ci/test-route-policy.sh
scripts/ci/test-mode-and-gates.sh
scripts/ci/test-knowledge-doctor.sh
scripts/ci/test-ops-commands.sh
scripts/ci/test-install.sh
scripts/ci/test-system-health.sh
scripts/ci/test-obsidian-cli.sh
scripts/ci/test-brain-memory.sh
scripts/ci/smoke.sh

Core

Memory & Knowledge

Orchestration

Security & Policy

Release & Evidence

Utilities

Security

• No secrets in repo config; credentials come from the environment or local .env
• Zero external CI by default (LACP_NO_EXTERNAL_CI=true)
• Remote execution disabled by default (LACP_ALLOW_EXTERNAL_REMOTE=false)
• Risk-tier gating with TTL approval tokens
• Structured input contracts for risky runs
• Artifact logs for auditable execution history
• See SECURITY.md for vulnerability reporting

Contributing

Contributions welcome. See CONTRIBUTING.md for guidelines.

Support

If LACP helps your work, sponsor its continued maintenance.

Solana: 2k1oq9U99mwy4gm8P2hXPJoZusoXQCpFs35EEf5Ve73y

Need agent infrastructure, trading systems, or Solana applications built for your team?

Builderz ships production AI systems across 32+ products in 15 countries.

Get in touch | Nyk | @nykdotdev

License

MIT © 2026 0xNyk

From this repo to a working agent OS

Quiet commercial paths from nyk.dev — same operator, fixed scope:

• Free checklist: https://www.nyk.dev/resources/agent-os-checklist?utm_source=github&utm_medium=readme&utm_campaign=oss_proof&utm_content=lacp
• Self-serve Production Agent OS Kit (€149 founding): https://www.nyk.dev/go/agent-os-kit?utm_source=github&utm_medium=readme&utm_campaign=oss_proof&utm_content=lacp
• Hands-on packages: https://www.nyk.dev/consulting?utm_source=github&utm_medium=readme&utm_campaign=oss_proof&utm_content=lacp#agent-os