The operating systemfor agentic systems.
Alcyoneus OS is a production-grade Python framework for turning LLM calls, tools, memory, policies, and multi-agent collaboration into explicit, persistent, observable state-graph workflows.
Agent demos do not become reliable systems by adding more prompts.
Production agent software needs explicit state, controlled transitions, durable recovery, tool permissions, tenant boundaries, provider fallbacks, live execution signals, and tests that verify behavior instead of only checking final prose. Alcyoneus OS treats those concerns as one runtime rather than a pile of application-level conventions.
Make the workflow visible, resumable, and governable.
A graph is the contract: state moves through named nodes and edges; tools sit behind policies; memory is selected by a storage boundary; events explain what is happening; and the same compiled workflow can be invoked, streamed, evaluated, replayed, and deployed.
From Python definition to production trace.
The complete Alcyoneus path is deliberately composable: every layer can be adopted independently, but the pieces share state, policy, and observability contracts.
MODEL THE STATE
Define a typed AgentState or domain state that carries messages, context, tool results, metadata, and durable run information through the workflow.
COMPOSE THE GRAPH
Build a StateGraph from Python nodes, edges, conditional routes, subgraphs, handoffs, and Command-based dynamic navigation.
ATTACH INTELLIGENCE
Connect provider-agnostic Agents, prebuilt ReAct/RAG/swarm/supervisor patterns, structured output, skills, memory, and tools.
COMPILE WITH CONTROLS
Compile with checkpointers, vector stores, media, callbacks, interrupts, recursion limits, timeouts, guardrails, and policy boundaries.
RUN OR STREAM
Invoke synchronously, run asynchronously, or stream graph, node, tool, handoff, interrupt, and error events through the same runtime.
OPERATE AND PROVE
Persist state, publish telemetry, enforce tenant policy, inspect traces, replay runs, evaluate trajectories, and ship through Docker or Kubernetes.
The system beneath the agent.
A programmable execution model
StateGraph, MessageGraph, nodes, edges, conditional routing, catch-all selectors, subgraphs, compiled graphs, remote graph serving, and inline Command routing make the workflow explicit and inspectable.
Prebuilt patterns for real work
ReactAgent, RAGAgent, SwarmAgent, SupervisorTeamAgent, PlanActReflectAgent, RouterAgent, StructuredOutputAgent, AudioAgent, handoffs, and dynamic prompts reduce application code without hiding control flow.
Provider choice without graph rewrites
OpenAI and Responses, Google Gemini and Vertex AI, Anthropic, LiteLLM, and AnyLLM adapters share a normalized runtime. Retry policies and fallback models keep provider failures inside the control plane.
Tools with bounded capability
Search, browser automation, policy-guarded shell, sandboxed code, files, semantic file search, image generation, calendars, schedulers, subagents, memory, computer use, and custom tool registries are first-class runtime citizens.
From working context to durable memory
Typed working state flows into in-memory, SQLite, PostgreSQL plus Redis, MongoDB, SQLAlchemy, Dapr, or encrypted session backends. Qdrant and Mem0 provide long-term retrieval, namespace isolation, TTL, and top-k controls.
Text, audio, image, and live interaction
Streaming events, SSE heartbeats, response granularity, Gemini Live, OpenAI Realtime, Azure Realtime, local Whisper plus TTS, barge-in, WebRTC frame broadcast, media storage, and resolver policies cover interactive products.
Capabilities are useful only when the boundary is explicit.
Alcyoneus separates what a model can suggest from what the runtime is allowed to execute. Guardrails, policy decisions, identity, secrets, and tenant scope are part of the execution path—not documentation left for the application team to reconstruct.
PII detection, prompt-injection prevention, length limits, custom validators, and input tripwires run before the graph accepts work.
JSON schema enforcement, blocked words, output limits, and output tripwires keep generated results inside a declared contract.
Tool input and output guardrails support allow, deny, ask-user, validation, and rate-limit decisions around every capability.
A nine-priority policy engine combines allow, deny, ask-user, tenant scope, workspace-only rules, and confirmation for sensitive commands.
RBAC, tenant isolation, JWT/JWKS, mTLS, RFC 7662 token introspection, API keys, and OAuth-style protocol auth protect the runtime.
Vault, AWS, GCP, and Azure Key Vault integrations can be composed into a fallback chain so credentials do not become graph state.
One runtime, several ways to connect.
Run dangerous capabilities away from the core process.
Shell, code, browser, and computer-use capabilities can be placed behind the sandbox backend that matches the risk and deployment environment. Resource limits, mounts, PTYs, GPU access, and workspace scope stay explicit.
GPU passthrough, resource limits, mounts, PTY, and workspace-scoped execution.
Pod lifecycle, exec, quotas, GPU scheduling, and cluster-native isolation.
Micro-VM execution for stronger process and resource boundaries.
Unix PTY locally plus optional E2B, Modal, Runloop, Daytona, Blaxel, Cloudflare, Vercel, and Azure-backed extensions.
X11, Wayland, headless, VNC, remote desktop, accessibility bridges, and action verification.
The production loop is part of the framework.
OpenTelemetry decorators for graphs, nodes, LLM calls, tools, guardrails, handoffs, tasks, and custom spans; Prometheus metrics for requests, latency, tokens, errors, and sessions; structured JSON logs with W3C trace propagation.
The alc CLI creates, runs, validates, visualizes, debugs, replays, traces, lists, and tests graphs and tools, with Mermaid, Graphviz, and interactive HTML output for architecture review.
QuickTest, TestAgent, MockLLM, MockToolRegistry, MockMCPClient, TestContext, AgentEvaluator, factual accuracy, hallucination, safety, trajectory, rubric, and simulator-based evaluation make behavior measurable.