Hangar · Autopilot · diagrams
Every page separates what is built from what is proposed. Start with the plan set, then the Autopilot design, then the general reference architecture.
Architecture · 01 of 08 · The family
Autopilot sits beside Airframe and Glidepath, not above them. It uses Airframe's contract through tools, uses Glidepath's guardrails as gates, and shows up in Tower as an Agent tab.
Gantt · 02 of 08 · Roadmap
Durations are estimates for one person; the order is the point. The contract comes before the next components, ownership comes before agent write tools, and the planner (the parachute sentence) is the acceptance test that everything before it exists to enable.
Dependency graph · 03 of 08 · Order
Skyport's remaining components join the contract stream instead of waiting behind it, so each is built once. Ownership must be split before agents get write tools, which is why it sits on the path to the Autopilot core.
Matrix · 04 of 08 · Scorecard
Re-runnable: hangar/tools/airframe-scorecard/scorecard.py. It measures readiness against the full contract, so most of the gap is artifacts that do not exist yet, not things that are broken. The amber tick on each bar is the A+ line at 97.
Architecture · 05 of 08 · The contract
Everything an agent needs to know about Airframe comes out of one bundle. Validate, Tower's forms, the agent tools and the docs all read it, so they can never disagree.
Sequence · 06 of 08 · One sentence
The agent never edits a file. It describes what it wants, reviews a plan with the assumptions stated, and applies it. Clearance opens PRs, humans merge the flight ones, and verify is a check against the running system, not a green pipeline.
Matrix · 07 of 08 · Skyport AI
Business-domain agents operating a system, plus the platform agents that already exist. None can apply a change: they read, draft, store artifacts, ask a human and spawn narrower runs. That is what "humans on the loop" looks like without the demo being able to break Skyport.
Sequence · 08 of 08 · Event to team
Three things are proved here: at-least-once delivery does not start two runs, delegation only narrows, and consequential output waits for a person. Every step carries the same task id, so the Flight recorder shows one story.
Architecture · 01 of 19 · Hangar today
Nothing here replaces a Hangar component. Clearance sits next to Tower and federates its MCP actions. Durable writes are git commits the cluster pulls, like any human commit. Ephemeral agent runs are claims to Crossplane, dev clusters only.
Architecture · 02 of 19 · Two planes
Committing every session to git would be slow, noisy, rate-limited and unreviewable. So ephemeral, bounded, disposable things are created as claims, and everything that outlives a run stays a reviewed commit.
Secure paved road · 03 of 19 · The write path
This is the spine for anything that outlives a run. Agents hold no cluster credential. They propose changes as pull requests, ArgoCD pulls what has been merged, and the one imperative action, syncing a lower environment, is delegated to ArgoCD under its own narrow account. Ephemeral runs are the other plane.
Matrix · 04 of 19 · Workload shapes
The platform does not care what the agent does or which framework it uses. A definition is durable and reviewed. A run is a disposable instance of it. A long-running service agent is just the durable half, deployed the way any application is.
Architecture · 05 of 19 · Definition to run
The image is built and signed by the same pipeline as any application, so a run can only execute what was reviewed. The run itself is a claim that Clearance narrows and Crossplane renders.
Architecture · 06 of 19 · Run anatomy
The contract is small on purpose so any framework fits: environment in, a workspace and an output folder, two audience-bound tokens, and two places to send traffic. Nothing inside holds a credential.
State machine · 07 of 19 · Run lifecycle
Every path ends in deletion. The deadline is enforced by the composition, not by the gateway, so a dead or compromised Clearance cannot leave a run alive. A tripped breaker freezes a run for review instead of destroying the evidence.
Tree · 08 of 19 · Agent teams
Delegation is narrowing. A planner can hand work to workers without any of them being able to do more than the planner could. The reservation makes it arithmetic: the children cannot collectively spend more than the root was granted.
Architecture · 09 of 19 · Backend fleets
Hangar keeps managing agent workloads and their state. Self-hosted model serving is delegated to a separate fleet run by Modelplane, and the only thing Hangar depends on is an OpenAI or Anthropic compatible URL, so hosted providers and Modelplane are interchangeable behind the model proxy.
Architecture · 10 of 19 · Model and tool plane
Tools and models are governed separately because they fail differently. Tools change the world and are tiered and reversible in git. Models cost money and leak data, so they get an allowlist, a token budget and a caller identity that ties every request to a run.
Sequence · 11 of 19 · Identity and credentials
The agent never sees a GitHub token. Clearance derives who is acting from Tower's login, decides in CEL, and gets a token scoped to one repository for that one call. The audit id in the reply is the record the rest of the platform correlates on.
Access matrix · 12 of 19 · Tool tiers
Write access is mostly a pull request, which a human can revert. The few imperative actions are delegated to systems that already audit themselves. The last row is not exposed to any identity, including Clearance itself.
Architecture · 13 of 19 · Authority
Any of the five can say no; none can say yes on behalf of another. The claim and the parent can only narrow what the definition grants, and the breaker can only take authority away, so a compromised run cannot widen its own reach.
Flowchart · 14 of 19 · Agent PR guardrails
Agents get no shortcut. Their PRs hit the same required checks as anyone's, and two new gates catch the failure modes that only agents have: editing their own controls, and acting under an identity that does not match the audit record.
Data flow · 15 of 19 · Flight recorder
Almost all of this already exists. The additions are one field, task_id, carried on every record from every agent type, and one chain for the audit events that is tamper-evident, not just searchable. Model calls are audited with the same id as tool calls.
Process · 16 of 19 · Preflight
Hangar's own dead-ends list is the corpus: each case has a documented cause and a known fix, so the verifier is a deterministic check and not another model. Any change to a profile, a model or a policy has to score no worse than the last one.
Architecture · 17 of 19 · AI triage
This is the first real consumer, and it already works: a broken canary produced a real diagnosis and a real fix PR. The change is small and removes a standing credential, which also takes pressure off a GitHub rate limit that four or more shared tokens have already hit.
Deployment · 18 of 19 · Fleet placement
This follows the cluster registry's dev and upper types. Bootstrap-tier mutations are already dev-only, and agent runs are the same shape, so a production cluster holds no agent credential and runs no agent.
Gantt · 19 of 19 · Rollout
Each phase ends with a check against real state, not a checklist. Durations are estimates for one person working alone, which is how Hangar has been built. A Modelplane hub trial and a second cloud come after this, once agents run and their spend is bounded.
Architecture · 01 of 10 · Agent substrate
Every agent task gets its own disposable environment. The broker decides scope, the claim creates it, and the only way out of the sandbox is the governed gateway.
Secure paved road · 02 of 10 · Tool gateway
Agents never hold infrastructure credentials. The gateway validates the call, asks policy, mints a scoped token for that one call, and records it. Direct routes stop at the boundary.
Sequence · 03 of 10 · Golden path contract
The agent never grades its own work. The path ships its own verifier, and a failure comes back as a rule id and a fix hint the agent can act on.
Flowchart · 04 of 10 · CI/CD validation loop
Every probabilistic step has a deterministic gate behind it. The gates are fast and return structured failures, so the agent can converge without a human, and humans sit on the loop at the risk tiers that need them.
Layer stack · 05 of 10 · Multi-cloud platform
Teams claim a capability once. Only the compositions layer knows whether that is AWS or OCI, so business lines converge on one surface and differ only where regulation or workload genuinely requires it.
Nested · 06 of 10 · Agent identity
Authority only narrows as it moves inward. The unit an agent actually holds is one token, for one verb, on one resource, and that is also the unit that gets audited.
Timeline · 07 of 10 · Observability
One task_id is stamped on the intent, the tool calls, the commits, the pipeline runs and the deploy. The last event is not a green build: it is the service confirming the change did what it was meant to.
State machine · 08 of 10 · Autonomy
Each alert class climbs one rung at a time on measured evidence. Any regression steps it back down, and a policy violation trips a breaker that has to be reviewed before it can climb again.
Swimlane · 09 of 10 · Remediation
The agent never acts on a hunch. It tests the hypothesis on a copy first, and when it cannot fix the problem the human still starts ahead: the page arrives with the hypothesis and the evidence.
Process · 10 of 10 · Evaluating infrastructure agents
Every model, prompt or tool change is replayed against the same corpus in disposable sandboxes and scored by the same verifiers that gate production. If it is worse than the baseline, it does not ship.