Arizuko Research

GitOps for agents · From multi-channel orchestration to declarative product platform
Last updated: 2026-05-26

One Sentence

Arizuko is GitOps for agents. Persona, skills, ACL, routes, secrets, diaries, decisions — all in git. The gateway commits per turn. Containers run against the working tree. SQLite is derived cache. Audit, fork, distribute — native git verbs.

This page documents the research direction: from today's multi-channel orchestration platform to tomorrow's declarative product platform. Four tiers map competitive gaps to shippable features. Each agent research topic (tools/security, memory, subagents, project management) projects into concrete platform capabilities.

Why GitOps?

State lives in git, not the database. agents.toml (products + deployments), acl/, routes/, skills/, personas/, MEMORY.md, .diary/, decisions/, secrets (age-encrypted). SQLite becomes operational cache — rebuildable from git + inbound message log.
Gateway is the only writer. Agents act through MCP; gateway sees every state-changing call and commits at turn boundary. Prevents "agent forgot to commit" bugs. One commit per turn with JSON sidecar listing events.
Audit = git log. Fork = git worktree. Distribute = git push. No bespoke versioning machinery. Signed commits + branch protection = compliance trail.
Products are TOML files in shared repos. Same shape as Terraform modules. arizuko product fetch <url> includes via submodule. One repo per instance (krons, marinade, sloth); products defined elsewhere.

Competitive Landscape

Replacement candidates by buyer segment. Every competitor is strong on 1-2 axes; none have the combination.

Buyer	Threat	Why They Win	Why We Can Win
SMB long-tail	Zapier Agents	Gravity. SOC2/SAML shipped, 1M+ existing Zapier users	Multi-channel + per-folder identity + BYOC
Slack+Notion buyer	Dust.tt	Only credible full substitute, SOC2+HIPAA, optional self-host	12 adapters vs 3, product templates, single-host footprint
Enterprise CX	Sierra ($150k+/yr) Salesforce Agentforce Cohere North (air-gap)	Enterprise sales motion, compliance theater, air-gap for Cohere	SQLite+Go vs PostgreSQL+ClickHouse+Redis, operator-owned infra
Dev-leaning self-host	n8n + Anthropic Skills assembled OpenHands+Langfuse+E2B	Familiar primitives, composable	6-12 engineer-months to assemble + ongoing drift vs one binary
Most threatening	CrewAI Enterprise (AMP)	One product decision (add Slack/Teams adapters) from covering 70% of our pitch	Speed to Tier A+B before they ship adapters

Defensible Wedge

The combination, not any single axis. Each axis has a stronger specialist alone; nobody has all four:

Multi-channel persistent team agent — 12 adapters in tree (Telegram, Discord, WhatsApp, Slack, email, Mastodon, Bluesky, Reddit, X/Twitter, LinkedIn, web chat, webhooks)
Per-folder agent identity — PERSONA + skills + MEMORY + .diary + ACL + secrets; filesystem as tenant boundary
Single-host operator footprint — SQLite + Go daemons + Docker; no K8s/Postgres+ClickHouse/Redis
Uniform MCP+REST per resource — agent-first protocol, REST as impedance match for external tools

Real Gaps (We Lose Today)

Observability — journalctl + dashd is not Langfuse. No OTLP export.
Sandbox strength — Docker-per-group weak vs gVisor/Firecracker. crackbox (egress isolation) exists but gVisor RuntimeClass not shipped.
Product abstraction — no arizuko product clone, no manifest, no registry.
No K8s / cloud-provider templates — single-host only today.
Evals at scale — specs/10/8-self-eval-skill.md exploratory, not production.

GitOps Architecture

Three layers. Truth shifted out of the database.

GIT TREE (source of truth — versioned, signed, distributed)

• agents.toml (products + deployments)
• acl/, routes/, skills/, personas/
• MEMORY.md, .diary/, decisions/
• secrets/ (age-encrypted blobs or vault refs)
• turns/ (per-turn markdown — the trace)

↓ derive ↓

SQLITE (operational cache — rebuildable from git+input log)

• messages queue + cursors
• indexes (fast routing/dispatch)
• in-flight turn state
• materialized projections (graph view)

↓ projects ↓

CONTAINERS (ephemeral — projection of git@HEAD into runtime)

• read working tree at turn start
• MCP over unix socket to gated
• gateway commits state changes at turn end

arizuko apply = read agents.toml from git → diff against SQLite cache → reconcile.
Audit = git log. Fork = git worktree. Distribute = git push.

The Path Forward

Four tiers map gaps to shippable capabilities. GitOps direction influences every tier.

🎯

Tier A

4 weeks · Declarative composition

agents.toml schema (products + deployments) — committed to git, source of truth
arizuko plan / arizuko apply verbs (Terraform-for-agents)
deployments table in SQLite (cache; rebuildable from git)
Three canonical product templates: oncall, support, sales-assist
Finish specs/5/5 Phase C — folder/user-scope secrets layering (BYOA primitive)
Spec: specs/11/2-declarative-composition.md

📊

Tier B

6 weeks · Monitoring + sandbox + git-as-event-log

Drop the bespoke events table. Gateway becomes the only git writer; commits per turn with sidecar event list
Projection function over working tree + SQLite hot path → graph view for plan/dashd/fork/OTLP
OTLP-out via OpenLLMetry → Langfuse self-host (operator's choice)
gVisor RuntimeClass under existing Docker — per-product sandbox profile in TOML

📦

Tier C

10 weeks · Distribution + proof product

Product registry = git repo of TOML files
arizuko fork <folder> --at <commit> = git worktree add + spawn container against that worktree
Eval primitive — Haiku-judge as gated post-turn hook
Ship oncall agent end-to-end through the whole pipeline as the proof

☸️

Tier D

When deals demand it · Enterprise

Helm + multi-node — federation via git remote basically free
Signed product manifests + cosigned images
OPA/Rego as policy alternative

Bridge: Agent Research → Platform Features

For each major research topic, show how it becomes a shippable arizuko feature and which tier it slots into.

Tools & Security

↓

Tier A: Per-product tool profiles in agents.toml (minimal/coding/messaging/full)

Tier B: Hermes threat-pattern scanner (932 LOC) → product sandbox profiles with gVisor. Tap (credential injection proxy) already exists in specs/5/T — ships with Tier B.

Research insight: Muaddib's host/guest tool split is cleanest privilege model; smolagents' code-first approach eliminates schemas. NanoClaw's IPC proxy = tap component.

Memory

↓

Tier A Phase C: BYOA primitive = bring-your-own-pgvector as alternative to in-folder markdown. ElizaOS pgvector pattern, OpenClaw hybrid (vector + BM25).

Tier C: Memory projection function: MEMORY.md + .diary/ + facts/ → unified queryable surface across all products.

Research insight: All converge on markdown as substrate; differ on write safety (LLM-editable vs operator-only).

Subagents

↓

Tier A: Product mixins in agents.toml. Compose a support product from (base-agent + slack-responder + escalation-child) fragments.

Already shipped: delegate_group, escalate_group, observe_group MCP tools. Per-folder isolation = NanoClaw's container-per-child model.

Research insight: Six trust models compared; we already ship the strongest (container boundary per folder).

Project Management

↓

Tier C: Oncall agent proof — autonomous PM loop (Stripe ships 1,300 PRs/week from Slack messages, zero human interaction).

Tier B: Git-as-event-log enables post-turn eval hooks (Aeon's Haiku-scores-Opus quality gate).

Research insight: Autonomy spectrum maps to isolation strength. More autonomous = stronger boundaries needed.

Building Blocks

↓

Tier A: Doom loop prevention (max-turns cap, explicit continue required). Network isolation (crackbox egress allowlist).

Tier B: Harness engineering — per-product test harness in TOML. Blueprints = product templates.

Research insight: 13 patterns distilled; most map directly to agents.toml declarative config.

Aeon

↓

Tier C: Self-healing batch loop = git-as-database (already Tier B direction) + Haiku quality gate (eval primitive) + reactive triggers (scheduled tasks already exist) + category repair playbooks (product templates).

All mechanisms already designed. Tier C integrates them.

Research insight: GitHub Actions runtime is the container orchestration we already have (Docker Compose).

What We Will NOT Do

Runtime-graph fantasy — The interior of an agent is Turing-complete; don't model it. The organizational layer (products + deployments + folders + ACL + channels) IS a graph, expressed as files in git. No bespoke projection beyond git checkout.
Pure event-sourcing — ActiveGraph (arxiv:2605.21997) overreaches. Hard parts (bit-perfect replay across stochastic LLM calls, cheap-prefix-share fork, schema migration via events) are future work. We need enough history to analyze + improve + audit — not bit-perfect replay. Git already ships this.
K8s pre-emptive — Single-host with SQLite+Docker wins on operator burden until deals demand multi-node. Federation via git remote is Tier D (when revenue forces it).

Open Questions

Inbound message storage — Per-day JSONL in git, or fully hot in SQLite? Lean per-day in git for replay-enough.
Crash recovery — Between SQLite write and git commit, what's the recovery protocol? Idempotent reapply on restart?
Fork lifecycle — Does forked branch get its own container? Same DB? Separate cache? Spec the lifecycle.
Operator UX — arizuko log, arizuko diff, arizuko revert wrappers — what's the surface?
dashd tier-1 write — Currently edits SQLite directly. Under GitOps: commit → apply, or commit-immediate-apply? Pick a default.
Tracing granularity vs audit granularity — Commit-per-turn loses sub-turn lineage; sidecar restores it; is sidecar enough or do we need per-event commits on a side branch?
Is "GitOps" the right term? Too K8s-coded? Substitute "git-native"? Sharper positioning vs Argo CD ("Argo CD for AI agent fleets") or against it?

Three-Lens Synthesis

Lens	Status Under GitOps
agent is data	Data lives in git ✓
agent-first platform	MCP/REST verbs are git-aware mutations ✓
agent is a graph	Working tree IS the graph; commit DAG IS the lineage; no bespoke projection needed beyond `git checkout` ✓

Trace vs projection distinction:
• Trace = git log (history, queryable)
• Projection = working tree at HEAD (current shape, queryable as graph)
• Fork = git worktree add on a sha + spawn container
• Replay-enough = git checkout <sha> + walk the tree
• Audit = signed commits + branch protection

Hardest Unsolved Problem

Crash recovery between SQLite write and git commit. If the gateway writes to SQLite (in-flight turn state, message cursor advance) but crashes before the git commit, the next restart sees stale git state but advanced cursors. Three options: (1) idempotent reapply on restart (read git HEAD, diff against SQLite, reconcile), (2) WAL-style two-phase commit (write intent to git first, then SQLite, then finalize), (3) accept eventual consistency (SQLite cursor rollback on missing git commit). Option 1 is simplest; option 2 is safest but adds latency; option 3 risks duplicate message delivery. Deliberate further before Tier B implementation.