Infrastructure an agent can operate safely

Micro-Substrate wasn't retrofitted with an AI endpoint. Mixed human-and-agent operation is a design principle — enforced by the same mechanisms that keep human operators safe.

Probe → read → decide → enqueue → watch → verify

An engineering agent connects over MCP and works the same loop a human does: read fleet state, reason over the declared-vs-observed join, enqueue a sanctioned job, stream its log, verify the outcome. Every step authenticated, RBAC-gated and audited with a via field recording which surface acted.

83 MCP tools

The full read model — fleet, jobs, reach, capacity, topology, IPAM, drift, audit — exposed as typed MCP tools over streamable HTTP. Connecting Claude Code or any MCP client is a thirty-second, documented procedure.

Mutations off MCP, by posture

Reads ship everywhere; destructive verbs deliberately don't ship on the agent surface. An agent constrained to MCP tools cannot mutate the estate even if compromised — capability is shaped by architecture, not by prompt.

Parity by mechanism

A contract gate walks the live API spec: every operation must map to a shipped CLI verb (and MCP read) or carry a reviewed exemption — in both directions. Agents never meet a stale or second-class surface.

The properties autonomy actually needs

Closed vocabularies

Job kinds, machine roles, reach states, terminal statuses — typed registries with fixed values, not free text. An agent can enumerate what's possible, and the trust boundary can refuse what isn't.

A fixed exit ladder

Success, runtime failure, refusal, interrupt — the same four exit codes on every command, sourced from authoritative job state. Automation branches on outcomes instead of parsing prose.

Refusal is a first-class outcome

A job the runner won't execute lands refused, distinct from failed. Destructive verbs require the arguments to echo their target's name — a forged request that skips the confirmation lands refused, not actioned.

Sagas, not half-states

Multi-step operations declare compensations up front. A failure runs the completed steps' undos in reverse and lands unwound — the estate an agent reasons about is never silently half-mutated.

One daemon, one outbound socket, no new holes

Every managed machine runs a single-file, dependency-free resident agent holding one outbound WebSocket to the control plane — the Teleport shape. It works behind NAT, IPsec and firewalls with zero inbound ports.

Live truth

Container state and stats every few seconds, host facts, security posture — pushed, not polled. Offline agents degrade to a timestamped snapshot, never stale data presented as live.

Identity-bound tokens

Each agent authenticates with a per-machine token bound to the machine's stable identity — salted hash, constant-time verification, atomic rotation. The upgrade token never crosses the job queue.

A gated exec bridge

An in-browser terminal into a named container, brokered through the control plane — RBAC-gated, session-bound, audited per open and close. The agent accepts exactly two commands; everything else is dropped by protocol.

The dark factory needs a floor built for it

Autonomous software needs more than compute. It needs a surface it can enumerate, outcomes it can branch on, state that never lies, and hard walls when something goes wrong. That's what this floor provides — a control plane built to be driven, and audited, around the clock.

Above this floor sits Loom, the intelligence layer of Microcelium — the agents themselves, their workflows and their memory. Micro-Substrate is where they stand. And what do they build up there? The Dark Software Factory runs on exactly this floor.

Point an agent at it

A briefing includes connecting an MCP client to a live fleet — and watching the audit log while it works.