Beyond standard agents: An elastic, highly-controllable execution runtime enforcing externalized governance and fail-closed security

[小洋同学 (xiaoyang-student)]

Hi community and maintainers,

I've been closely following the evolution of agentic workflows. While many frameworks focus on expanding agent capabilities, I noticed a recurring pain point in production: unpredictability, state corruption, and infinite retry loops when LLMs hallucinate or tools fail.

To address this, I built SO-Agent as an experimental, open-source proof-of-concept. The core philosophy is strictly "LLM thinks, code decides". The LLM is solely responsible for understanding, planning, and generating; while all state transitions, permission grants, and failure recoveries are rigidly enforced by a deterministic code layer.

Interestingly, Satya Nadella recently emphasized a critical direction for Enterprise AI that perfectly aligns with the architecture I've been building: "Decoupling the underlying AI model from the control framework... externalizing control and security measures... ensuring authorized personnel have the ultimate power to pause or shut down the model."

It's validating to see this industry shift, as SO-Agent was designed from the ground up to enforce this exact "externalized governance" in practice. Here is how the runtime maps to this vision of a highly controllable, secure, and elastic AI system:

🛡️ 1. Externalized Control & Zero-Trust Security (Decoupled Framework)

Tool authorization is strictly decoupled from LLM output. Permissions are granted via a code-level proposal → grant mechanism only after a deterministic plan review passes. Crucially, authorizations are unconditionally revoked on all exit paths (completion, agent replacement, or replanning), ensuring no lingering privileges.

📜 2. Tamper-Proof Execution Evidence (Human-Readable Audit)

Instead of relying on opaque LLM state, SO-Agent uses a 13-stage declarative Shadow FSM (python-statemachine) as the authoritative source of truth. All valid state transitions are explicitly declared; illegal migrations are rejected and immutably logged. Combined with SQLite persistence for Executions and PlanVersions, this provides a complete, tamper-proof audit trail for compliance.

🛑 3. Ultimate Human Override & Bounded Execution (Pause/Shut Down Power)

To guarantee the "ultimate power to shut down," the runtime implements a 5-Layer Timeout & Pipeline Gate system (first-event, model idle, tool execution, agent budget, pipeline deadline). Once a deadline is hit or a cancellation is triggered, the PipelineGate strictly rejects all late-arriving actions. Furthermore, bounded recovery policies (e.g., max 1 replacement chain, max 3 replanning attempts) ensure the system gracefully degrades to a human_required state rather than entering infinite, costly loops.

🔄 4. Elastic Agent Orchestration (Resource Efficiency)

The system features a Two-Tier Star Architecture with Quadrant Task Routing. Based on "complexity × duration," tasks are dynamically routed to direct answers, deep reasoning, persistent workflows, or full multi-agent orchestration. This elastic fusion ensures we don't over-provision multi-agent overhead for simple tasks, while maintaining strict isolation (sub-agents have no direct communication channels).

🔗 Links & Documentation:

• Repository: https://github.com/xiaoyang-student/so-agent
• Architecture (English): [SO_Agent_Execution_Runtime.md],[English_README.md]
  (https://github.com/xiaoyang-student/so-agent/blob/master/SO_Agent_Execution_Runtime.md)
  (https://github.com/xiaoyang-student/so-agent/blob/master/English_README.md)
• Architecture (Chinese): [多_Agent_框架.md],
  [README.md]
  (https://github.com/xiaoyang-student/so-agent/blob/master/多_Agent_框架.md)
  (https://github.com/xiaoyang-student/so-agent/blob/master/README.md)

Note: This project is currently in an experimental/research state. It is explicitly designed to validate these governance and safety patterns, rather than being a drop-in production solution.

I would be incredibly grateful to get feedback from the core maintainers or engineers working on reliable AI, especially regarding the Shadow FSM design or the failure recovery boundaries.

Thank you for your time and for driving the ecosystem toward safer, more controllable AI!