Transcript as runtime
- Control flow lives in prose.
- Authority is implicit in the available tools.
- Retries can repeat effects.
- “What happened?” requires reconstructing a conversation.
Slide 1 of 13: What is flux?
01 · orientation
What is flux?
A Rust agent SDK, harness, and authored workflow language built around one boundary:
The LLM is not the runtime.
Models supply bounded judgment. Authored control flow and a deterministic host own order, authority, effects, evidence, and stopping.
In about 20 minutes
- Trace an effect from request to guarded IO.
- Follow one adaptive turn to its one-shot approval receipt.
- Run one real authored flow locally.
- Place connectors and Exchange on the right side of the boundary.
For developers + SREs evaluating the system together.
02 · the problem
A transcript is not a runtime contract
Flux runtime
- Authored Flux-Lang owns order and bounds.
- Calls freeze into typed action batches.
- Caller identity and policy are explicit inputs.
- Sessions retain evidence, usage, approvals, and outcomes.
The model can be capable without becoming the process supervisor, policy engine, or IO implementation.
03 · the execution path
Judgment proposes. The runtime decides.
→→→→→
Step 1
Typed intent
Classify the request and expose only relevant capabilities.
Mandatory safety envelopeauthorization → approval → guarded IONo tool-side shortcut. No model-authored shell string.
04 · the agent loop
Adaptive turns, deterministic seams
- detect_intent
Classify the request; intersect its signals with registered, wired, and permitted operations.
- explore
The model works those operations’ exact native schemas. Safe reads run and return evidence; effectful calls are captured, not executed.
- freeze
Captured calls become one immutable, ordered action batch.
- approve_batch
A one-shot receipt bound to batch, session, caller, and policy.
- execute_batch
Authorization, approval scope, then guarded IO. Failures return to the same ledger for local correction.
- present_results
The answer — while the session keeps the full typed record.
Durable by construction
A typed decision request parks on Flux-Lang’s ordinary await. The user’s next message resumes the exact flow — bindings and native-stage ledger intact, nothing reconstructed. Receipts are one-shot: changed, stale, reused, or cross-session batches are rejected.
Why not model-generated plans?
A one-shot generated graph asked the least reliable component to pick operations, reproduce their schemas in a second language, and invent all control flow before it had evidence. The adaptive loop keeps judgment in typed stages; order, bounds, and batch identity stay with the authored flow and the host.
The model does not generate Flux code. It participates inside typed stages; authored Flux-Lang owns the sequence.
05 · run the real thing
Authored flow, guarded scratch
This is the same declared fixture used by the Flux-Lang console. In hosted docs it is an editor; from loopback flux docs it runs through the real dispatcher in an isolated scratch workspace.
flow rust-files(dirs: List<String>)
each dir in dirs -> flat files
glob(path: dir, pattern: "*.rs")
each f in files -> stats
file_stat(f)
return { files, stats }
flow rust-files(dirs: List<String>)
each dir in dirs -> flat files
glob(path: dir, pattern: "*.rs")
each f in files -> stats
file_stat(f)
return { files, stats }
06 · one substrate
Use it at the surface you need
CLI + TUI
Daily coding agent, approvals, sessions, replay, and evidence.
Flux-Lang
Authored flows, programs, channels, triggers, budgets, and concurrency.
Rust SDK
Embed the same parser, engine, dispatcher, and typed host contracts.
HTTP + A2A
Serve authenticated agents or connect to another agent over a standard protocol.
Plugins
Temporary compatibility integrations, removed after their Exchange replacements prove parity.
Remote system
Keep identity and approval local while guarded effects land in a remote workspace.
Different entry points; one execution substrate and one safety envelope.
07 · vendor vocabulary
Connectors describe. Hosts execute.
Source snapshot · 2026-08-05flux-connectors main · v0.20.0
author onceprovider TOML
→compile + reviewtyped Flux
→publishcatalogue + manifest + Tool pack
What is vendor truth
Base URLs, authentication shape, operations, inputs, risk, effects, idempotency, and declared inbound events.
What stays host-owned
Credential values, grants, guarded HTTP, private-network policy, audit evidence, and deployment.
Every official integration is connector-owned. Exchange is the only official integration executor; Flux embeds one client rather than hosting connector runtimes.
08 · shared authority
Exchange holds credentials, not the agent
Source snapshot · 2026-08-05flux-exchange main · v0.17.0
The credential never crosses the boundary; the authority does.
Identity + tenancy
shipsOIDC sign-in and tenant-scoped sessions.
Connections
shipsCreate, rotate, and delete tenant credentials and settings.
Metadata grants
shipsAdmit operations by connector, risk, effects, and idempotency—not maintained ID lists.
Invoke
shipsBuild and execute an admitted HTTP operation from its compiled connector definition.
Service Accounts
shipsCanonical bearer authentication keeps the vendor credential behind Exchange.
Inbound sockets
partialGenerated socket subscriptions and workflow activity ship.
Lifecycle + records
directionGeneral inbound lifecycle and execution records are charter, not yet built.
09 · topology
Core Flux stays useful without Exchange
Local operator topology: caller, then flux, then the guarded System, then the workspace or service.
callerlocal engineer
→judgment + controlfluxidentity · policy · approval · evidence
→local effectsguarded Systemworkspace · process · network
→external effectworkspace / service
Today: Flux is complete as a local agent, workflow engine, SDK, and guarded effect host.
Rule: Core Flux remains useful without Exchange; official external integrations do not.
10 · sessions
Sessions are the record
Every run persists a session: evidence, model calls, usage, approval outcomes, and results — replayable after the fact.
intent…
◆ intent: update the release notes
capabilities: workspace.read, workspace.write
exploring…
--show-loop prints one line per model call — stage, round, wall time, TTFT, operation count, schema size. The same redacted data is stored as model.call evidence with session and turn correlation; /evidence shows the audit trail.
Approvals leave receipts
Approve with y once or a always (saved to config), or deny.--yes installs a headless approver for trusted unattended work — and never overrides an authorization denial. Outcomes carry wait time; executed batches carry duration.
Redaction is registered
Secrets are registered with the redactor and scrubbed from tool output, logs, and stored evidence — not pattern-guessed after the fact.
Sessions are the record: “what happened?” is a query over typed records, not a re-read of a conversation.
11 · SRE truth
Know the boundary—and the gaps
Release-blocking invariants
- Caller identity is immutable for a live turn.
- Every real effect crosses guarded IO.
- Secrets are registered for redaction, never surfaced raw.
- Network destinations are resolved and private ranges gated.
- Session termination preserves provider-valid history.
Plan around these gaps
- Exchange integration is a one-shot HTTP invoke behind one Service Account; streaming invocation and the general stream/lease protocol are not built.
- Rich outbound runtime dispatch remains planned.
- General Exchange inbound lifecycle and execution records remain direction.
- Connector inbound support is narrow by design: declarative webhooks and generated socket subscriptions, unsigned-only until the HMAC verifier ships.
- OS process sandboxing is defense in depth and platform-dependent.
For SREs, an explicit refusal is a feature: unavailable paths fail closed instead of changing locality or authority.
12 · model strategy
Any provider. Same envelope.
A provider is a wire codec and a credential lifecycle; the model string after it goes to the provider verbatim. Judgment is swappable because authority never lives in the model.
flux run -m opus "…" # Anthropic alias
flux run -m openai/gpt-5 "…" # provider/model, forwarded verbatim
flux run -m openrouter/z-ai/glm-4.6 "…" # long-tail catalogue
flux run -m mock "…" # offline, deterministic
Offline by default
mock is the deterministic offline provider: no key, no network, and it exercises the full pipeline — evaluate the machinery in CI or air-gapped.
Local to cloud
Eight production prefixes over four wire codecs: API keys, subscription OAuth (Claude, Codex), Bedrock, local Ollama, and OpenRouter's long-tail catalogue.
No surprise egress
A sub-agent always runs on its parent's provider; a role naming a different provider fails at spawn time, not mid-turn.
13 · next step
Evaluate it from your own machine
Start offline. Inspect the machinery. Then choose where effects should live.
# Full loop, no provider credential or network
flux run -m mock "inspect this repository and explain its test posture"
# Release-matched docs + guarded scratch examples
flux docs
# Reveal typed stages and the action-batch machinery
flux run -m mock --show-loop "summarize the architecture"