Agent-native
Infrastructure an agent can operate safely
Micro-Substrate wasn't retrofitted with an AI endpoint. Mixed human-and-agent operation is a design principle — enforced by the same mechanisms that keep human operators safe.
Probe → read → decide → enqueue → watch → verify
An engineering agent connects over MCP and works the same loop a human does: read fleet state, reason over the declared-vs-observed join, enqueue a sanctioned job, stream its log, verify the outcome. Every step authenticated, RBAC-gated and audited with a via field recording which surface acted.
83 MCP tools
The full read model — fleet, jobs, reach, capacity, topology, IPAM, drift, audit — exposed as typed MCP tools over streamable HTTP. Connecting Claude Code or any MCP client is a thirty-second, documented procedure.
Mutations off MCP, by posture
Reads ship everywhere; destructive verbs deliberately don't ship on the agent surface. An agent constrained to MCP tools cannot mutate the estate even if compromised — capability is shaped by architecture, not by prompt.
Parity by mechanism
A contract gate walks the live API spec: every operation must map to a shipped CLI verb (and MCP read) or carry a reviewed exemption — in both directions. Agents never meet a stale or second-class surface.
The properties autonomy actually needs
Closed vocabularies
Job kinds, machine roles, reach states, terminal statuses — typed registries with fixed values, not free text. An agent can enumerate what's possible, and the trust boundary can refuse what isn't.
A fixed exit ladder
Success, runtime failure, refusal, interrupt — the same four exit codes on every command, sourced from authoritative job state. Automation branches on outcomes instead of parsing prose.
Refusal is a first-class outcome
A job the runner won't execute lands refused, distinct from failed. Destructive verbs require the arguments to echo their target's name — a forged request that skips the confirmation lands refused, not actioned.
Sagas, not half-states
Multi-step operations declare compensations up front. A failure runs the completed steps' undos in reverse and lands unwound — the estate an agent reasons about is never silently half-mutated.
One daemon, one outbound socket, no new holes
Every managed machine runs a single-file, dependency-free resident agent holding one outbound WebSocket to the control plane — the Teleport shape. It works behind NAT, IPsec and firewalls with zero inbound ports.
Live truth
Container state and stats every few seconds, host facts, security posture — pushed, not polled. Offline agents degrade to a timestamped snapshot, never stale data presented as live.
Identity-bound tokens
Each agent authenticates with a per-machine token bound to the machine's stable identity — salted hash, constant-time verification, atomic rotation. The upgrade token never crosses the job queue.
A gated exec bridge
An in-browser terminal into a named container, brokered through the control plane — RBAC-gated, session-bound, audited per open and close. The agent accepts exactly two commands; everything else is dropped by protocol.
The dark factory needs a floor built for it
Autonomous software needs more than compute. It needs a surface it can enumerate, outcomes it can branch on, state that never lies, and hard walls when something goes wrong. That's what this floor provides — a control plane built to be driven, and audited, around the clock.
Above this floor sits Loom, the intelligence layer of Microcelium — the agents themselves, their workflows and their memory. Micro-Substrate is where they stand. And what do they build up there? The Dark Software Factory runs on exactly this floor.
Point an agent at it
A briefing includes connecting an MCP client to a live fleet — and watching the audit log while it works.