Tentaflake

A runtime-agnostic NixOS flake template for isolated AI agents on one host. Declare agents in tentaflake.toml, choose an adapter, and manage them through systemd and the Rust tentaflake CLI. No mandatory web UI or control service.

Pre-1.0: interfaces and security policy can break between releases. Pin a revision and read the changelog and migration guide before updating.

Start here

1. Install or use the consumer example.
2. Follow the secure quickstart.
3. Import a stopped agent, then review and explicitly build/activate the host. Import never starts services.

The public tentaflake.toml stays an empty, commented template:

schemaVersion = 1
agents = []

Maintain real desired state in your own consumer flake or deployment fork, not in the upstream template. Track that installation's TOML in its owning Git source; untracked, ignored or missing configuration must fail rather than load the upstream empty inventory. Even private TOML enters the Nix store: keep secrets in runtime files. Fresh installations initialize their own empty inventory; no sample starts automatically. Add reviewed, stopped entries only to that installation's file. Existing agents.toml and agents.json inventories require a deliberate migration; they are never silently ignored in favor of an empty TOML inventory.

All managed container IDs are agent-<name>; names are globally unique across adapters. Default host state is /var/lib/tentaflake/agents/<name>. Configuration uses this file as the only instance source; host broker, worker, quota and Research policy stays in Nix.

The operator shell

The login shell presents host and agent status. Use tentaflake status, tentaflake logs agent-assistant and tentaflake doctor --security to inspect your installation. The image illustrates the layout, not a live host or vendor acceptance. See the operator shell guide for current commands.

Scope and support

Hermes and ZeroClaw have native adapters; real vendor acceptance remains pending. OpenClaw is a stopped refusal scaffold, not a runnable integration. Pi Durable is the same refusal scaffold by default; only explicit host admission of the reviewed runtime (tentaflake.piDurableRuntime) runs it, and real provider acceptance is pending. Generic workloads support reviewed digest-pinned OCI images and in-capsule argv, offline only with no accepted provider/model or Research integration. Discover fixed presets with tentaflake runtimes --json; the adapter catalog records support and evidence separately. Synthetic tests are not vendor acceptance.

Balanced containment uses gVisor, a read-only root, non-root ownership, bounded resources and no general egress. Automatic startup requires the exact agent's LLM broker, offline worker, workspace quota and Research relay. A worker declaration does not automatically intercept native tools. Provider keys stay on the host; private data never belongs in Nix inputs or Git. Read the security profiles and threat model before deployment.

Optional modules provide encrypted backup, image provenance, observability, runtime detection, a private Unix operator API, approval-bound system control and read-only enterprise connectors. They do not establish application readiness, native chat support or live provider acceptance. Their guides describe current source, not necessarily the website's pinned release.

Guides

• CLI, agent management, operations and restore
• Secrets, private management, observability
• Fork checklist, skills, roadmap
• Contributing, build/check boundaries, documentation ownership

Contributors start with just fast; evaluation, builds and live acceptance are separate gates. Enter nix develop for direct Cargo/lint commands. No check implicitly authorizes deployment. Report vulnerabilities through GitHub Security Advisories. Code is MIT licensed; DCO and trademark terms apply separately.