What is Cradle?

The definition

Cradle is the gate between your agent and its tools. The agent proposes an action, rules decide whether it may run, and the decision stays in a log that cannot be quietly rewritten.

The mechanism has one name throughout these docs: the execution gate. Your agent does not call tools directly. It submits a typed proposal; the gate evaluates it without a model in the loop; the outcome is appended to a hash-chained log.

Three properties follow, in this order:

• Governed. The rule lives outside the agent and carries a version, so you can see which one allowed the call. Backed by policy.ts, registry.ts, approvals.ts.
• Sovereign. Your hardware, your network. Models and data do not leave it. Backed by Docker, local GGUF models, node-llama-cpp.
• Auditable. An append-only log with a hash chain, checked by running a command. Backed by audit.ts and verifyAuditChain().

What runs today

Two mechanisms exist in the code. They govern different things and they are not connected to each other.

The execution gate — actions against systems

src/core/runtime/ decides whether a tool call may happen:

Agent proposal            typed, submitted instead of a direct call
  → deterministic gate    contract, tool registration, required scopes,
                          side-effect class (pure → irreversible), idempotency
  → human approval        for irreversible actions: scoped, expiring,
                          single-use, never self-granted
  → execution             an unregistered tool is not callable at all
  → audit record          proposal, decision, observation — SHA-256 chained

Reached today through the agent tool-use loop and the desktop client. It is not exposed over HTTP: src/server/ does not reference gateway.ts, so an external agent cannot submit a proposal to the server.

Two-tier risk gating — replies to humans

src/core/triage/ decides whether a drafted reply may be sent:

Incoming message
  → Risk L1 (deterministic rules)     → PII / injection / danger flags
  → Risk L2 (LLM classifier)          → { category, risk, confidence, skills }
  → Router                            → picks the agent by role + skills
  → RAG                               → grounds the draft in your knowledge base
  → Agent                             → drafts a reply with citations
  → Decision:
      green            → auto-reply
      yellow / red     → operator Inbox → approve / edit / reject → send

This path does not go through the execution gate: orchestrator.ts does not call gateway.ts.

Verification

The verification engine exists — registry, tool-backed verifiers, compensation, state transitions. No verifiers ship with the domain packs (verifiers: [] in both). A postcondition with no registered verifier resolves inconclusive, never pass. The mechanism is built; the content is not. Treat "prove what actually happened" as not yet part of the product.

The accepted architecture

Cradle is a neuro-symbolic runtime: the model reasons in probabilities, the runtime governs in explicit rules, and those rules are expressed over an execution vocabulary rather than the prose of a prompt. That is a decision about where the product is going, and it is documented in full in the neuro-symbolic runtime document, which labels every section as current or target.

What that document does not claim: that the risk gate consults the execution vocabulary today. It does not — the two mechanisms above are separate. The claim becomes true when the path exists, not before.

The pieces

Channels that exist: Telegram, an embeddable web widget, a plain HTTP API, and MCP in both directions — Cradle can consume your MCP servers and be consumed as one.

Where to go next

• New to Cradle? Install the desktop app.
• Running a GPU box? Follow the GPU server guide.
• Want the mental model? Read the architecture overview.
• Want the full target design? Read the neuro-symbolic runtime.
• Using the voice note companion? Read the SmartNotes docs.